Privacy Policy

Kluy is a project- and finance-management tool for freelancers and small operators. It lets you manage projects, clients, partners and the money flowing through your work. This policy explains what information Kluy collects, how it is used, who it is shared with, and the choices you have.

• Account details — your email address, and a name and workspace/business name if you provide them. Authentication is handled for us by Supabase (see below).
• Workspace content you create — projects, tasks, comments and chat messages, clients and team/partner records (names, emails, phone numbers, addresses you enter), invoices, and payment records (amounts, dates, references, notes).
• Files you upload — e.g. payment slips or invoice images/PDFs you attach to a record. You may also link files from your own Google Drive; in that case Kluy stores only the link, never a copy of the file.

Payment records in Kluy are bookkeeping entries that you enter. Kluy is not a bank, payment processor, or money-transfer service, and does not move funds.

• Authentication cookies / tokens — to keep you signed in (httpOnly cookies on the web; the device keychain on mobile).
• Basic technical data — such as device/browser type and error logs, used to keep the service running and fix problems.

Kluy does not use third-party advertising or cross-app tracking, and does not sell your personal information.

• To provide the service and the features you use.
• To authenticate you and keep your account secure.
• To send service email you ask for or that the product needs — for example invoices you send, invitation emails, and notifications (e.g. when an invitation is accepted). These are sent via Brevo.
• To diagnose problems, prevent abuse, and improve the product.

We share data only with the service providers that make Kluy work, and only as needed:

• Supabase — database, authentication and file storage hosting.
• Brevo — sending transactional email (invoices, invitations, notifications).
• Google— if you choose “Sign in with Google” (web), and the Google Drive picker if you choose to link a Drive file (least-privilege; Kluy only sees files you explicitly pick, and stores only the link).
• Cloudflare — DNS and content delivery.
• DeepSeek— our third-party AI provider, used only when you choose to use Kluy AI. See “Kluy AI and third-party AI processing” below.

Because Kluy is multi-tenant, the people you invite to a project (your client, partner, or a collaborator) can see the specific data that their role on that project allows — never your whole workspace. We may also disclose information if required by law.

Kluy AI is an optional assistant, available on the Business plan. It is off until you open it and agree to the notice shown in the app.

What is sent: when you send a message to Kluy AI, we transmit your message together with the specific workspace data needed to answer it — for example your invoices, clients, projects, tasks and team details relevant to your request. If you connect Kluy AI over WhatsApp, the messages you send to the assistant are processed the same way.

Who it is sent to: this data is sent to our third-party AI provider, DeepSeek, which generates the response and returns it to you. DeepSeek processes this data on servers in China, and its handling of the data is also governed by DeepSeek’s own terms and privacy policy. We only share what is needed to answer your request, we send it only after you have agreed in the app, and we do not sell this data. We require the providers that handle this data to keep it confidential and to protect it to a standard consistent with this policy; because DeepSeek processes it in China, where protections may differ from those in your own country, we send it only with your explicit consent. If you would rather not share this data, simply don’t use Kluy AI.

Your permission: the app asks for your consent before the first time it sends any data to the AI provider, and you can simply not use Kluy AI if you prefer not to share this data. Kluy AI never sends, deletes, or moves money on its own — it only prepares actions for you to confirm.

• Access is enforced at the database level with row-level security, so each account only reads the rows it is entitled to.
• Data is encrypted in transit (HTTPS) and at rest by our hosting providers.
• File downloads use short-lived, access-checked signed links.

No method of transmission or storage is 100% secure, but we work to protect your information using industry-standard measures.

We keep your information for as long as your account is active or as needed to provide the service. When you delete your account (see below) we delete or anonymise your personal data, except where we must retain certain records to comply with legal obligations.

• Access & correction — you can view and edit most of your information directly in the app.
• Account & data deletion — you can delete your account from within the app (Settings), or by emailing us at support@thekluy.com. Deleting your account removes your personal data and the workspace content you own.
• Email — service email is part of using Kluy; you can stop by closing your account.

Kluy is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us data, contact us and we will remove it.

We may update this policy as the product evolves. We will revise the “Effective” date above and, for material changes, notify you in the app or by email.

Questions about this policy or your data? Email support@thekluy.com.