Privacy Policy

1. Introduction

Kyne ("we", "our", "us") is an AI-powered media production platform operated by Kynematic Technologies Private Limited, a company incorporated in India. This Privacy Policy explains how we collect, use, store, protect, and delete your information when you use our platform at kyne.studio and related applications ("Service").

By using our Service, you agree to the collection and use of information as described in this policy.

2. Information We Collect

• Account Information: During sign-up, Kyne collects only the user's email address and phone number. Additional profile information is obtained from the user's Google account with their consent. The designated contact email for communication is ben@kyneai.com.
• Usage Data: Information about how you interact with the platform — pages visited, features used, prompts submitted, projects created, and session activity.
• Generated Content: Media assets, video generations, scripts, and creative outputs produced through the Service.
• Authentication Data: Managed by Clerk (our authentication provider). We do not store raw passwords.
• Technical Data: IP address, browser type, device identifiers, and application logs for security and debugging purposes.

3. How We Use Your Information

We use your information to:

• Provide, operate, and improve the Service
• Authenticate your identity and manage your account
• Process AI media generation requests
• Respond to support queries and communications
• Ensure security and prevent fraud
• Comply with legal obligations

We do not use your data or generated content to train AI models — ours or any third party's.

4. Data Storage & Location

Your data is stored on infrastructure located in India (Mumbai region):

• Database: Neon DB (PostgreSQL) — AWS ap-south-1 (Mumbai)
• File & Media Storage: Cloudflare R2 — India region
• Authentication: Clerk (global, with data scoped to your account)

We take deliberate steps to ensure data residency within India for enterprise customers where required.

5. Sub-processors

We engage the following trusted third-party sub-processors to operate the Service. Each is bound by data protection obligations consistent with this policy:

6. Data Encryption

• At rest: All data stored in Neon DB and Cloudflare R2 is encrypted using AES-256.
• In transit: All data transmitted between your browser, our application, and our sub-processors is encrypted using TLS 1.2/1.3.

Encryption keys are managed by the respective cloud providers (AWS KMS for Neon, Cloudflare for R2).

7. Access Control & Security

• Role-based access control (RBAC) with least-privilege principles applied across all systems.
• User sessions are managed via secure JWT tokens with automatic rotation (Clerk).
• API keys and credentials are stored as encrypted environment variables and never exposed client-side.
• Periodic security assessments are conducted on our codebase to identify and remediate vulnerabilities.
• All third-party dependencies are monitored for known security vulnerabilities and patched promptly.

8. Data Retention

We retain your data only for as long as necessary:

9. Data Deletion & Destruction

Upon contract termination, account deletion, or written request, all your data is permanently deleted within 30 days. This includes:

• Hard deletion of all database records
• Permanent deletion of all media assets from Cloudflare R2
• Deletion of your user account and identity data via Clerk
• Expiry and purge of all database backups within 7 days

A written confirmation of deletion can be provided upon request. Deleted data cannot be recovered.

10. Your Rights

Under applicable law (including India's Digital Personal Data Protection Act, 2023), you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your data (right to erasure)
• Export your data in a portable format
• Withdraw consent at any time
• Raise a grievance with our Data Protection contact

To exercise any of these rights, contact us at: ben@kyneai.com

11. Data Breach Notification

In the event of a data breach or privacy incident affecting your data, we will:

• Notify you via email within 72 hours of becoming aware of the incident
• Provide details of: the nature of the breach, data and users affected, likely consequences, and remediation steps taken
• Provide regular updates until the incident is fully resolved

12. Business Continuity

The Service is designed for high availability:

• Database replication and point-in-time recovery (Neon DB) with RPO of ~1 minute
• Media assets served via Cloudflare's global network with near-zero RPO
• Application deployed on Vercel with global edge redundancy
• Target RTO: 30 minutes in the event of a major incident

13. Cookies

We use essential cookies for session management and authentication. We may use analytics cookies to understand usage patterns. You can control cookie preferences through your browser settings.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or an in-app notice at least 14 days before they take effect. Continued use of the Service after changes constitutes acceptance.

15. Contact & Grievance Officer

For grievances under the DPDP Act 2023, you may contact our Grievance Officer at the above email. We will respond within 30 days.