Kyppo

Privacy Policy

Last updated: October 23, 2026

This policy explains what personal data Kyppo (kyppo.app) processes, why, who we share it with, and what your rights are. It covers the website, the app and our integrations.

1. Who is responsible

VEXTR AB (Swedish limited company (aktiebolag)) is the data controller for the data processed in Kyppo. The legal entity behind the service is VEXTR AB — see vextr.co.

When you create projects and invite others, you (or your organisation) decide what goes into the project. We process that content to provide the service to you.

2. What we process

  • Account: email address, name, profile picture and user ID from Google or GitLab if you sign in with them, and your settings (language, theme, notifications).
  • Content: projects, tickets, comments, attachments, labels and history that you and your colleagues create, and the email addresses of people you invite.
  • Billing: plan, subscription status and invoice details (such as company name and VAT number). Card details are entered at Stripe; we never see your card number.
  • Integrations: if you connect Slack: workspace, channel and user IDs and webhook addresses, so we can send the notifications you chose.
  • Technical and security: IP address, browser and device information, server and error logs, and hCaptcha signals when you sign up or sign in.
  • Cookies: see section 9 and our cookie policy at kyppo.app/cookies.

3. Why we process it, and on what legal basis

  • Providing Kyppo: account, sign-in, projects, sharing and in-app notifications. Legal basis: contract (GDPR Art. 6(1)(b)).
  • Email and Slack notifications: only the ones you turn on. Legal basis: contract.
  • AI features: only when you ask for an AI draft or summary (see section 4). Legal basis: contract.
  • Payments and bookkeeping: subscriptions, receipts and accounts. Legal basis: contract and legal obligation (Art. 6(1)(c), bookkeeping rules).
  • Security and operations: protecting against abuse and bots, finding and fixing errors. Legal basis: our legitimate interest in a secure, stable service (Art. 6(1)(f)).
  • Preference cookies: remembering language and theme. Legal basis: consent (Art. 6(1)(a)), which you can withdraw in cookie settings.

We do not sell your data, and we do not use it for advertising.

4. AI in Kyppo

Kyppo has AI features that draft a ticket description or write a one-line summary. They only run when you (or a colleague in the project) ask for it.

When that happens, the ticket's title, description and acceptance criteria and your short note are sent to Google's Gemini API. The result is saved on the ticket. We do not use your content to train our own models, and the AI makes no automated decisions about you.

Content is only sent to Gemini when someone asks for an AI draft or summary.

5. Who we share data with

We use these providers (processors) to run Kyppo. They may only use the data to provide their service to us:

  • Supabase: database, sign-in and file storage. Data is stored in the EU (Frankfurt, Germany).
  • App hosting: the app itself runs on a server operated by VEXTR AB.
  • Stripe: payments and invoicing (Ireland/USA).
  • Resend: sending emails such as invitations and notifications (USA).
  • Google: Gemini AI (see section 4) and Google sign-in, if you choose it.
  • GitLab: GitLab sign-in, if you choose it.
  • hCaptcha (Intuition Machines): bot protection at sign-up and sign-in (USA).
  • Slack: only if you or your team connect Slack (USA).

We may also disclose data where the law requires it, or to protect users and the service from abuse.

6. Transfers outside the EU

Some providers are based in the USA. Transfers rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s Standard Contractual Clauses.

7. How long we keep data

  • Account and content: for as long as your account exists.
  • When you delete your account (under Profile), your profile, comments and access are deleted. Projects you own must be deleted or handed over first. Tickets you created in other people’s projects stay in that project without your name attached.
  • Deletion record (email, time and reason): as long as needed to document the deletion.
  • Payment and bookkeeping records: as long as bookkeeping rules require.
  • In-app error log: rows are deleted automatically 30 days after the error was last seen. Other server logs are kept only as long as needed for operations and security.
  • Backups: only as long as needed to restore the service.

8. Your rights

You have the right to access, rectify, erase, restrict and port your data, and to object. You can withdraw consent at any time. Much of this you can do yourself in the app (profile, notifications, delete account); otherwise, write to us.

You can complain to the Swedish Authority for Privacy Protection (IMY, imy.se), the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk) or your local authority, but we would like to hear from you first.

9. Cookies

We use necessary cookies for sign-in, security and remembering your cookie choice, and preference cookies (language, theme) if you accept them. We do not use advertising or tracking cookies. Details and settings: kyppo.app/cookies.

10. Security

All traffic is encrypted (HTTPS). Access to data is enforced per project and ticket in the database (row level security), and secret keys only exist on the server. No system is 100% secure; if a breach may affect you, we will tell you as the law requires.

11. Children

Kyppo is not intended for children under 13.

12. Changes

We update this policy when Kyppo changes. The date at the top shows the latest version. For material changes we will let you know in the app or by email.

13. Contact

The legal entity behind Kyppo is VEXTR AB. Contact and company details are at vextr.co.