Privacy Policy
Who This Covers
This policy applies to all operators using Kavian OS, operated by Kavian Standard. Currently available in the United States, with UAE availability coming soon.
What Is Collected
- Account information: email address and hashed password
- Operator-authored content: audit documents, daily log entries, and data entered into the platform
- Referral source and operator type selected during onboarding
- Payment information: collected and processed exclusively by Stripe. Kavian Standard never receives, stores, or has access to payment card data.
- Basic usage data: login timestamps and session activity
How Operator Data Is Protected
All operator entries — including log data, audit documents, and generated reports — are encrypted at rest using AES-256-GCM. Data is never stored in readable form. The database contains only ciphertext. A breach of the underlying infrastructure would expose gibberish, not readable operator content.
Each operator's data is encrypted with a unique key derived from their account. AI-generated analysis is performed on temporarily decrypted data server-side; the resulting report is re-encrypted before storage. Kavian Standard does not read, access, or review operator log content.
Data Retention
Active accounts retain all data for the duration of the subscription. If an account becomes inactive, operator data is retained in encrypted form for up to 12 months, then permanently deleted. Operators who wish to delete their data before 12 months may do so by deleting their account — deletion is immediate and irreversible.
Third-Party Services
- Stripe — payment processing. Kavian Standard does not handle card data directly.
- Anthropic — AI analysis layer. Analysis operates on temporarily decrypted operator data server-side. Anthropic does not use API inputs to train its models. Under standard API access, Anthropic may retain API inputs for up to 7 days for trust and safety monitoring. See Anthropic's usage policy for full details. For a breakdown of Anthropic's compliance artifacts, visit their Trust Center.
No Data Sales
Operator data is never sold, shared with advertisers, or used for any purpose outside of operating the platform.
Changes to This Policy
Material changes will be communicated via email to active operators before taking effect.