KiroBack to Home
Data Privacy & Encryption

Privacy Policy

Last updated: November 2026. Your privacy and API credential security are our highest priority.

1. Information We Collect

When you use Kiro, we collect minimal information necessary to deliver our invoicing services:

  • Account Credentials: Your work or personal email address, name, and optional avatar image used for authentication and dashboard display.
  • Business Metadata: Your legal company name, registration or tax identification numbers (VAT, GST, EIN), address, logo, and preferred invoice numbering prefix.
  • Stripe Restricted Key: Your read-only Stripe Restricted Key used strictly to query your Stripe charges when your customer enters their checkout email.
2. AES-256-GCM Credential Encryption

We never store your Stripe keys in plain text. All restricted API keys are encrypted immediately with AES-256-GCM (Galois/Counter Mode) authenticated encryption using an isolated server-side master key before being saved to our Supabase database.

Decryption is only executed in memory during real-time customer search queries and is never logged to disk or sent to client-side browsers.

3. End-Customer Data & PDF Invoices

When your buyers visit your public self-service link (/i/yourbrand) and search with their checkout email, Kiro queries Stripe directly to retrieve the corresponding charges. We generate the PDF on the fly or through secure, non-public storage. We do not sell or share your customer emails or purchase histories with third parties or data brokers.

4. Third-Party Infrastructure

We rely on trusted, SOC-2 compliant cloud infrastructure providers:

  • Supabase: For secure database storage and authentication.
  • Stripe: For merchant charge verification and platform license checkouts.
  • Mailtrap: For sending transactional invoice links and PDF receipts upon customer request.

5. Data Deletion & Rights

You maintain full ownership of your data. You may modify your business details or replace your Stripe Restricted Key at any time from your Settings dashboard. If you wish to delete your account and all associated encrypted credentials, contact us at support@getkiro.fyi.