OpenAIKits Privacy Policy

1. Information and purposes

OpenAIKits processes your account email and display name, memory content and original text, edit history, store memberships, protected API/OAuth credentials, security and usage records, and billing references needed to operate OAK.memory. We use this data for authentication, storing and recalling the content you request, access control, abuse prevention and billing. Cloud stores are separate from the local plugin database; local memories are not imported automatically.

2. Hosting, embeddings and payments

The current Supabase production database is hosted in Seoul, South Korea. Vercel hosts the application. Text submitted for semantic search or storage is sent through Vercel AI Gateway to OpenAI to create embeddings; this processing may occur outside South Korea. If you purchase credits or a subscription, Polar processes checkout and payment information, and OAK stores order/subscription identifiers and credit settlement records. Provider infrastructure logs and backups follow each provider’s applicable terms and configured retention. Do not submit information you are not entitled to process.

3. Sharing, retention and backups

A store is private until its owner grants membership. Authorized members can see its content, original text and recording authors according to their role. An OAuth connection is limited to the consented store and permissions and can be revoked. Active service data is retained while the account is in use; account withdrawal or a verified deletion request starts deletion, completed within one week. Infrastructure backups are separate from active service data and expire according to the provider’s configured rotation; Supabase Pro’s standard daily-backup window is seven days. Deleting an individual account does not immediately erase it from an existing whole-database backup. Previously completed deletions must be reapplied before a restored backup is returned to service.

4. Access, export, withdrawal and deletion

You can view, edit where permitted and export memories and links. Request account withdrawal or deletion at fredriccliver@gmail.com from your registered address. OpenAIKits verifies your account ownership and completes deletion within one week of a verified request. Self-service account deletion is not currently available. Shared data and other members’ contributions require identifying which records belong to the request; another user’s independent data is not deleted without authority. Ask the same contact about access, correction, export or this notice.

5. Recipients, service providers and international processing

OpenAIKits does not sell memory content or provide it for general AI-model training. Processing required for this service differs from information you send to an AI app you connect.

Supabase stores accounts, stores, memories and permissions in the Seoul production database; management infrastructure, logs and backups follow its configuration and policies. Vercel and Vercel AI Gateway handle hosting, security/request records and embedding requests. OpenAI processes requested text into embeddings over the network, potentially outside South Korea. Polar handles optional purchases, subscriptions, payments and refunds; OpenAIKits does not directly collect full card numbers in its checkout form. Google Analytics / PostHog processes public-site usage only after you opt in.

If you share memories with ChatGPT, Claude or another AI app, that app’s separate terms and privacy policy apply. Consult the official provider links below for their processing locations and retention. Decline optional features or contact us about available alternatives if you do not wish to use them.

Intercom provides customer support when you open the support messenger. It processes your messages, browser session information and, for signed-in customers, a verified account identifier. We do not automatically send your name, email address or memory content. Support cookies maintain your conversation. The messenger is not loaded until you request support, and is excluded from OAuth, authentication, admin and individual store pages.

6. Essential cookies and optional analytics

Authentication cookies maintain sign-in sessions and secure OAuth connections. Language and analytics choices are stored locally in your browser. Blocking essential cookies can prevent sign-in or connection.

Google Analytics / PostHog is off by default and used only on public marketing/documentation pages after you allow analytics. Analytics tags are not loaded on account, OAuth or admin pages. Analytics may include cookie identifiers, public-page usage, device/browser and approximate location. Advertising personalization and Google signals are disabled.

Refusing analytics does not limit the service. Change or withdraw your choice through Cookie settings. Withdrawal stops subsequent analytics and removes Google Analytics cookies that the browser permits us to remove. Provider procedures and policies also apply to records already collected.

PostHog processes public-page views in the United States only after consent. Session replay and automatic click/form capture are disabled. Query strings, URL fragments, referrers and account or memory content are not sent. Anonymous analytics identifiers are stored in browser local storage and cleared when consent is withdrawn.

7. Collection methods and processing grounds

We process information you supply or that is necessary when you register, sign in, store/search memories, configure sharing, consent to connections, pay or contact us. Account, requested functionality, security and billing processing is limited to delivering the service contract and protecting rights. Optional analytics relies on your revocable choice. The contact form opens your email application; messages actually sent and their email addresses are used to respond. Missing required information may prevent the related feature, but refusing analytics does not restrict the basic service.

8. Security and deletion procedures

We apply HTTPS, store-level access checks, least privilege, encryption and hashed credential verification. Product OAuth tokens are verified using hashes; personal API keys that must be displayed again are encrypted. No system eliminates every risk.

Deletion requests require verification of the registered account. The operator identifies account/authentication data, personal stores, memories and connections, performs deletion and checks the result. Other people’s independently owned shared records are separated. Transaction or dispute records subject to legal retention are isolated for the applicable statutory period and not used for other purposes. We explain any legal or shared-rights restriction on deletion. Reapplying completed deletions before restoring service from a backup is a manual operator procedure, not an automated account-deletion feature.

Where South Korean electronic-commerce retention duties apply, contract/withdrawal and payment/supply records are retained for five years, consumer complaint/dispute records for three years, and advertising/display records for six months. These periods apply only to the relevant records and do not justify retaining all memory content.

9. Children, representatives and rights requests

We do not provide a parental-consent process, so registration and use by children under 14 are not permitted. If identified, we take restriction/deletion measures required by law.

You may request access, correction, deletion, restriction, withdrawal of consent and available data export. Authorized representatives may provide evidence of their authority. Only minimum information needed for verification is requested. Where another person’s rights or legal retention restrict a request, we explain why and what is possible. Contact our privacy contact for questions or complaints.

10. Changes, effect and contact

The operator and privacy contact is OpenAIKits at fredriccliver@gmail.com. Changes are published here with the date and content. Changes materially affecting rights are notified before application and follow legally required consent/notice procedures. Updated wording does not substitute retroactive consent. This policy applies from publication.