KAIPU / LEGAL
Privacy policy
Recording locally and uploading to Cloud are separate actions. This policy explains what data is processed, why and by whom, including for accounts, Cloud storage and paid plans.
Controller and contact
Niway S.A.C., Lima, Peru, is responsible for Kaipu account and operational data. Contact contacto@niway.dev for privacy questions or requests. If you upload other people’s data, you must have a valid basis for doing so; we host that content under your instructions and the service terms.
Content on your device
Local recordings, screenshots, projects and exports are stored on your device in locations used or configured in the app. Signing in alone does not upload them to Cloud. When you use an upload feature, the selected file and data needed to manage it are sent to the service. Screen, microphone and camera permissions support the features you activate and are managed through your operating system.
Account and service data
We process name, email, verification status, account and session identifiers, dates and credentials protected with hashing. If you sign in with Google we also receive the data described in the section on Google sign-in. When you create an account we record your confirmation that you are of legal age and your acceptance of the legal documents, with their version and date. Sessions are described in their own section. We also process your plan, quota usage, preferences, product communications and the information you send when requesting support.
Google sign-in and Google user data
If you choose Sign in with Google, Kaipu asks Google only for the scopes openid, email and profile. From your Google account we receive: your Google account ID, your email address, whether Google has verified that email, your name and the URL of your profile picture. We use them to create or identify your Kaipu account, sign you in, and show your name and picture in the app and on the website. Kaipu does not call any other Google API, does not access your Gmail, Google Drive, contacts or calendar, and does not use Google data for advertising or to train AI models. We store this data in our database (Neon) and, as with any sign-in, the tokens Google issues to Kaipu (access, refresh and ID tokens) are kept server-side in the same database, with access limited to what operating the service requires. We do not sell Google user data and do not share or transfer it to anyone except the infrastructure providers listed in this policy as needed to operate the service, or when the law requires it. Kaipu's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We keep Google data while your account exists. To delete it, delete your account from the account page in the web app or email contacto@niway.dev; you can also revoke Kaipu's access at any time in your Google Account settings under third-party access, which stops further sign-ins with Google until you authorize it again.
Sessions and devices
Each time you sign in, on the website or on a device, Kaipu creates a separate session. Each session records a session token, its creation and expiry dates, your IP address and your browser or device user agent, so we can keep your account secure and tell sessions apart. On the website the session is kept in cookies; on the desktop app it is kept as a session token stored locally on your device. Signing out ends the session, and a password reset ends all sessions. We use this data to authenticate you, detect abuse and support account security, not for advertising.
Recordings and images you upload
When you upload to Cloud, we store your videos, screenshots, images, audio and related files, together with their name, type, size, duration where applicable, dates, revisions, status and sharing settings. Files are stored in Cloudflare R2 and their metadata in our database. To provide the service we may create derived files, such as thumbnails, previews, compressed or converted versions and, if you use those features, transcripts. Your content may show your face, voice, screen or information about other people; we process it only to provide the features you use and do not use it to identify people by their biometric features.
Paid plans and payments
If you buy a paid plan, such as premium Cloud storage or features, payments are handled by a payment processor or a reseller that acts as merchant of record. They collect your card or payment details under their own privacy policy, and Niway does not store full card numbers. We receive and keep what is needed to manage your plan: plan and subscription status, billing period, amounts, currency, taxes, country, billing name and address or tax ID if provided, transaction and invoice identifiers, and limited payment-method details such as brand, last four digits and expiry. We use them to charge, renew and cancel plans, apply entitlements and limits, issue receipts, handle refunds and disputes, prevent fraud and meet tax and accounting obligations.
How we use data
We use data to create and secure accounts, authenticate you, host and deliver files, manage plans, payments, limits and entitlements, provide support, analyze and improve the service, develop new features, detect abuse and fraud, send service, billing and legal notices, and comply with legal obligations. Processing relies on the contract, legitimate interests, legal obligations or your consent where required. Marketing communications require consent and include a way to opt out. We do not sell personal data or use your recordings for advertising, and we do not use recordings to train general-purpose AI models without your permission. Features you choose to use, such as transcription or AI assistance, process the content needed for them, which may include specialized providers. If a new feature needs data or a purpose this policy does not cover, we will update the policy and ask for consent where required before using it.
Where data is stored and who processes it
We use infrastructure and service providers to run Kaipu, currently including Cloudflare (website, API and R2 file storage; cloudflare.com/privacypolicy), Neon (PostgreSQL database for accounts, sessions, plans and Cloud metadata; neon.com/privacy-policy) and PostHog (diagnostics in versions where it is enabled; posthog.com/privacy). As the service evolves we may add or replace providers, such as for payments, email delivery, support, analytics or AI. Payment processors and merchants of record may act as independent controllers under their own privacy policies. Data may be transferred to and processed in other countries, including the United States and the European Union, under the safeguards required by Peruvian data protection law. We update this policy when material providers change. For sign-in, Google (policies.google.com/privacy) acts as an identity provider when you choose Sign in with Google.
App diagnostics
When telemetry is enabled in a distribution, PostHog receives an installation identifier, technical events, device or version information and error reports with messages, stack traces and context that may include file paths or names. Kaipu disables PostHog session recording, automatic click capture and automatic pageviews. This does not mean no technical events or error reports are sent. Diagnostics are not designed to send video or audio from your recordings. You may contact us to exercise rights over this data.
Age requirement
Kaipu accounts, Cloud and paid plans are only for people who are at least 18 years old, or the age of majority where they live. When you sign up you confirm that you meet this requirement. We do not knowingly collect personal data from minors. If we learn that an account belongs to a minor, we may close it and delete its data, except what we must keep by law. If you believe a minor has given us data, contact us.
Retention and deletion
We retain data while the account is active and afterwards as long as needed for the purposes described, to resolve disputes, prevent abuse, and meet legal, tax or accounting obligations. Billing and payment records are kept for the period required by tax and accounting law, even after the account is closed. You may delete files in the app and request account closure by email. Deletion may not be immediate for every copy: backups and logs are overwritten on their normal cycle. Cloud files may also be deleted under the Cloud terms, including over-limit and inactive-account rules, or when a paid plan ends and stored content exceeds the limits of your new plan. Aggregated or anonymized data may be kept without limit. Google user data is kept while your account exists and is deleted when the account is deleted, subject to the same backup and log cycle.
Your rights
Under Peruvian Law 29733 and other applicable laws you may request access, rectification, cancellation or objection, and other rights where they apply. Email us from your account address; we may ask for proportionate information to verify your identity and will respond within the legal deadlines. You may also file a claim with the National Authority for Personal Data Protection of Peru.
Security and changes
We apply reasonable technical and organizational measures to protect data, but no system eliminates every risk. Do not share passwords or upload information you are not authorized to process. We will update this policy when practices change, showing the date and version and communicating material changes. Publishing an update does not replace consent where required or authorize incompatible new uses of your data.
Contact
Niway S.A.C. · Lima, Peru
contacto@niway.devFor support, privacy, account deletion or abuse reports, email us. Include your account email and the reason; do not send passwords or sensitive recordings.