CURRENT VERSION · 24 SEPTEMBER 2026
Privacy policy
KYVLT limits collected data to what is necessary to create, verify, execute with your approval, and revoke your AI-agent mandates.
Service publisher
KYVLT is published by Ludovic MAUCELI, an individual entrepreneur trading as SOUVEN’CAMP, SIREN 490 931 417, SIRET 490 931 417 00029, 41 Le Tarillot, 71260 Lugny, France. For questions or requests for access, correction, export, or deletion, contact contact@kyvlt.com.
Data processed
Account identifier and email address supplied during sign-in; registered agents and declared passports; mandate settings; delegation chains; emergency contacts; authorization requests; integrity receipts; prepared Gmail or Google Calendar action content; connected Google account; and decision and result history. If you activate My Rights, KYVLT also processes your situation profile, detected opportunities, application status, and documents you choose to upload.
My Rights and document vault
The My Rights profile produces a pre-screening result and a list of applications to verify with official bodies. It is not an eligibility decision. Files are held in separate private object storage, and ownership is checked server-side for every download or deletion. No document is automatically sent to an agency or the AI model.
AI assistant
When you use the assistant, your conversation text, the default email address or connected Google account address, a limited list of active mandates and, for benefit questions, a summary of My Rights opportunities and available document categories are sent to OpenAI to produce a response or proposed action. The contents of vault files are never sent. KYVLT asks the API not to store the response and does not keep the conversation in its own history; OpenAI’s technical processing and retention rules still apply. Only an action you choose to stage is retained for review.
ChatGPT and Codex plugin
When the KYVLT plugin is used, ChatGPT or Codex may send only the information required for the request, such as the objective, proposed action, limits, data scope, duration, or budget. The plugin does not give KYVLT access to the user’s other conversations. Its tools accept no vault file, payment-card, health, or government-identifier data, and no password, one-time code, cookie, API key, or secret token. An action can be executed only by a compatible, connected, and explicitly authorized service.
Recipients and processors
Data is received by KYVLT and the providers strictly required to operate it: OpenAI for service hosting, sign-in identity, and the AI features you use; Google only when you connect Gmail or Calendar; and Stripe and Link for subscriptions, billing, fraud prevention, and payment support. The plugin never sends data to a government agency; you continue on the official service yourself. KYVLT does not sell or rent data and does not use it for targeted advertising.
Payment and subscription
Payment takes place on a secure page hosted by Stripe and Link through Stripe Managed Payments. Stripe or the entity identified at checkout acts as merchant of record and processes payment, billing, and fraud-prevention data under its own notices. KYVLT neither receives nor stores the full card number or security code; it may receive only the information needed to track the subscription and provide support.
Partner programme
Applications store the creator’s account identity, contact details, channel, reserved code and accepted terms. Redeeming a code associates the signed-in customer with one partner and stores the subscription references required to apply the offer and calculate commissions. No affiliate advertising cookie is set. Creators see aggregate counts and commission amounts only, never customer identities or benefit documents. Account deletion removes unused applications; for existing financial activity, displayed contact details are removed while minimal references needed for payments, accounting and duplicate-trial prevention remain subject to applicable retention duties. Accounting records are retained for ten years. Contact contact@kyvlt.com to exercise your rights.
Gmail and Google Calendar
KYVLT stores a staged action so it can be shown to you before approval. For integrated Gmail sending and Calendar event creation, Google provides encrypted OAuth tokens to KYVLT after your consent; KYVLT never receives your password. The requested permissions are limited to sending email and managing events on calendars you own. You can revoke this access from the Services tab or your Google account.
Notifications
Alerts are optional and use the notification permission of your browser or installed application. You can disable them at any time in your device settings.
Secret tokens
A complete mandate token is shown only once. KYVLT stores only a SHA-256 hash, which can verify the token but cannot reveal it.
Public proof
Mandate verification can expose a public code, status, agent name, mission, limits, and expiry. An action receipt exposes its decision, public agent-chain identifiers, and cryptographic fingerprints. These pages do not display the owner’s identity, email address, secret token, or private action content.
Retention
Active data is retained while your account exists. Account deletion immediately removes the profile, mandates, history, vault files, and associated tokens from active systems; KYVLT creates no separate user archive, and any infrastructure-level technical copies follow the hosting provider’s deletion cycle. Google OAuth tokens are deleted as soon as you disconnect the service. Voice recordings are sent only for transcription and are not added to KYVLT history. Rate-limit counters expire with their technical window. A legal duty or security incident may exceptionally justify longer, case-specific retention.
Usage measurement
The website records limited technical events associated with a random session identifier. These are pseudonymised data, not a guarantee of anonymity. Simulator input, IP addresses and identity are not stored in this measurement table. Campaign attribution, referring domain and page path may be stored. Events older than thirteen months are purged during collection. Hosting security logs are separate.
Your rights
You may request access, correction, erasure, restriction and, where applicable, portability of your data. You may object to processing based on legitimate interests under the GDPR and withdraw consent at any time without affecting prior lawful processing. Write to contact@kyvlt.com; requests are normally answered within one month, with notice of any lawful extension. My account provides structured-data export and deletion of active data and tokens. Download vault files before deletion. Partner-programme and statutory retention exceptions continue to apply.
Complaints
You may contact KYVLT at contact@kyvlt.com and lodge a complaint with the competent data-protection authority, including the CNIL in France at cnil.fr. You do not have to complain to KYVLT first.
Questions? Contact KYVLT support.