LAUNCH VERSION · 19 SEPTEMBER 2026
Privacy policy
KYVLT limits collected data to what is necessary to create, verify, execute with your approval, and revoke your AI-agent mandates.
Service publisher
KYVLT is a project published by Ludovic Mauceli, an entrepreneur based in Saône-et-Loire, France. For questions or requests for access, correction, export, or deletion, contact contact@la-cle.app.
Data processed
Account identifier and email address supplied during sign-in; registered agents and declared passports; mandate settings; delegation chains; emergency contacts; authorization requests; integrity receipts; prepared Gmail or Google Calendar action content; connected Google account; and decision and result history. If you activate My Rights, KYVLT also processes your situation profile, detected opportunities, application status, and documents you choose to upload.
My Rights and document vault
The My Rights profile produces a pre-screening result and a list of applications to verify with official bodies. It is not an eligibility decision. Files are held in separate private object storage, and ownership is checked server-side for every download or deletion. No document is automatically sent to an agency or the AI model.
AI assistant
When you use the assistant, your conversation text, the default email address or connected Google account address, a limited list of active mandates and, for benefit questions, a summary of My Rights opportunities and available document categories are sent to OpenAI to produce a response or proposed action. The contents of vault files are never sent. KYVLT asks the API not to store the response and does not keep the conversation in its own history; OpenAI’s technical processing and retention rules still apply. Only an action you choose to stage is retained for review.
ChatGPT and Codex plugin
When the KYVLT plugin is used, ChatGPT or Codex may send only the information required for the request, such as the objective, proposed action, limits, data scope, duration, or budget. The plugin does not give KYVLT access to the user’s other conversations. An action can be executed only by a compatible, connected, and explicitly authorized service.
Gmail and Google Calendar
KYVLT stores a staged action so it can be shown to you before approval. For integrated Gmail sending, Google provides encrypted OAuth tokens to KYVLT after your consent; KYVLT never receives your password. The requested Gmail scope is limited to sending email. You can revoke this access from the Services tab or your Google account. Google Calendar currently opens directly in Google.
Notifications
Alerts are optional and use the notification permission of your browser or installed application. You can disable them at any time in your device settings.
Secret tokens
A complete mandate token is shown only once. KYVLT stores only a SHA-256 hash, which can verify the token but cannot reveal it.
Public proof
Mandate verification can expose a public code, status, agent name, mission, limits, and expiry. An action receipt exposes its decision, public agent-chain identifiers, and cryptographic fingerprints. These pages do not display the owner’s identity, email address, secret token, or private action content.
Retention
Data is retained while your account exists so mandates, My Rights and their history can operate, and is deleted with the account. Vault documents are also removed from file storage. Google OAuth tokens are deleted when the service is disconnected or the account is deleted. Technical rate-limit counters contain only hashes that are not directly identifying. Legal duties or incident handling may exceptionally require limited additional retention.
Launch measurement
The website records limited anonymous technical events, such as opening a page, starting the demo, or selecting a link to create an account. Demo input, IP addresses, and identity are not recorded in this measurement. A campaign source may be retained when it is present in the link.
Your rights
The My account section lets you download an export of structured data and permanently delete your profile, agents, passports, mandates, requests, receipts, events, contacts, My Rights data, and documents. Vault files remain individually downloadable before deletion. Deletion also invalidates associated tokens.
Complaints
You may write to contact@la-cle.app. If, after contacting us, you believe your rights are not respected, you may contact the competent data-protection authority, including the CNIL in France.
Questions? Contact KYVLT support.