This policy covers kymoscope.com, the web app (app.kymoscope.com), the live relay, the SDK, the Python package, the collector, the MCP server and the plugins (together, the “Service”).
1. Who we are
“Kymoscope” means the owner of the Kymoscope software and service, the controller of the personal data described here. For anything about this policy or your data, write to hola@kymoscope.com.
We have not appointed a Data Protection Officer; the address above handles every privacy request.
2. The short version
- Files you open in the app are read in your browser. Their contents are never uploaded.
- Live streams, cloud recordings and history are end-to-end encrypted: we store and forward them without being able to read them. Open streams, which anyone may watch, are the exception.
- We keep what we need to run your account: your name, email address, plan, and what you choose to save in the cloud.
- We use no advertising, no analytics trackers and no cookies of our own.
- We do not sell your data and we send no marketing email.
- You can delete your account yourself in the app, and write to us for anything else.
3. What we collect
Account. Your email address, first and last name, a password (stored only as a hash by our authentication provider), the industry you may pick at sign-up, a profile picture if you upload one, your theme, your plan and account role. If you sign in with Google, Google sends us your name, email address, account identifier and profile picture link, which our authentication provider keeps with your sign-in record.
Security. If you turn on two-step verification, the data needed to check your codes. For each browser you use with encrypted features, a public key, a label naming the browser type, dates of creation and last use, and the approvals given to it; the matching private key never leaves your browser. API keys are stored only as a one-way hash of part of the key, with a short prefix for display, a name and dates; the part of the key that decrypts your streams never reaches us.
Organizations and projects. Their names and descriptions, members and roles, invitations (including the email address invited), access requests and the message you add to them, in-app notifications, and a record of significant actions (for example, role, plan or security changes).
What you save in the cloud.
- Workbooks: analysis settings such as charts, the names of the channels they show, axis ranges and markers, never your file data. Personal workbooks, and workbooks in projects without end-to-end encryption, are stored readable by us. Workbooks in end-to-end encrypted projects are encrypted in your browser.
- Math channels and alert rules: formulas and rules, which may name channels and people to notify. In end-to-end encrypted projects, alert rules are encrypted too.
- Live streams and cameras: stream names and settings. The data itself is encrypted by the sender and only decrypted by viewers; our relay forwards it without a key.
- Cloud recordings: the encrypted data exactly as the relay forwarded it, with its name, who started it, times and sizes.
- History: encrypted day files uploaded by the collector, stored either with us or in a storage bucket your organization provides, with their stream name, time zone, channel count, time ranges and sizes.
Collector, Python package, MCP server and plugins. These run on your own machines. They send to Kymoscope only what you configure them to send: your encrypted streams and history, the API key that authorizes them, and, for collector alerts, the rule, the event and its times, and the members’ email addresses to notify. They contain no telemetry. When you use the MCP server with an AI assistant, what you share with that assistant is between you and its provider.
Emails we send. Account confirmation and password reset, invitations, project access requests, demo invitations, plan and licence notices, account deletion notices, and the alerts you set up. Alert emails name the rule, the source and the times, never a measured value.
Enquiries and demos. When you contact us or ask about Enterprise: your name, email address, company, team size and message, and our notes. When we invite you to a demo: your email address and the invitation details.
SDK licences. The organization, the website domains a licence covers, its dates and who requested it.
Billing. Your plan, subscription status, billing dates and the identifiers that link your account to our payment provider. Card details go straight to the payment provider; we never see them.
Usage and technical data. For each live stream, the account that sends it and measurements such as data volume, number of viewers and duration, used to run plans and capacity. Our relay checks request rates per IP address in memory, without storing them. Our hosting providers keep technical logs of requests (such as IP address, browser and time).
4. Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Running your account and the Service: cloud, collaboration, live, recordings, history | Contract (Art. 6(1)(b)) |
| Plans, billing, tax and accounting records | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) |
| Service emails, including the alerts you configure | Contract (Art. 6(1)(b)) |
| Security, preventing misuse, keeping records of significant actions | Legitimate interest (Art. 6(1)(f)) in protecting the Service and its users |
| Understanding which industries use Kymoscope (the optional sign-up question) and measuring usage to plan capacity | Legitimate interest (Art. 6(1)(f)) |
| Answering enquiries and demo requests | Steps before a contract, at your request (Art. 6(1)(b)) |
| Meeting legal obligations and lawful requests | Legal obligation (Art. 6(1)(c)) |
You can object to any use based on legitimate interest (see section 9).
5. Who helps us
We share personal data only with the providers that run the Service for us, under their data processing terms, and only as much as each needs.
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, sign-in, server functions | Database in the European Union (Paris, France); server functions may run nearest to the request |
| Cloudflare | Websites, app, live relay, storage of recordings and history, network security, usage measurements | Global network; recordings and history stored in the European Union |
| Resend | Sending our emails | European Union (Ireland); Resend is a US company |
| Zoho | Our mailbox, for messages you send us | European Union |
| Stripe | Payments, when card payment is offered | European Union and United States |
| Sign in with Google, if you use it | United States and other countries |
We may also share data with professional advisers, a successor if the Service changes hands, or authorities when the law requires it.
Inside an organization, other members see what its settings show them, such as your name, email address, role and activity in shared projects.
6. Transfers outside the EU
Some providers above may process data outside the European Economic Area, mainly in the United States. Those transfers rely on the EU–US Data Privacy Framework for certified providers or on the European Commission’s Standard Contractual Clauses. Write to us for a copy of the safeguards.
7. How long we keep it
- Account: while it is open. When you delete it in the app (Account → Delete account), it closes at once and is deleted 30 days later, with your personal content; you can cancel until then. Work in an organization’s projects stays with the organization.
- Workbooks and other cloud content: while you keep them. Deleted items wait 30 days in the trash, then are deleted for good.
- Cloud recordings: until their retention period ends: 30 days on Pro, 90 days on Team and Enterprise, or what a project sets. Deleted recordings wait 30 days in the trash. Deleted data leaves storage within about an hour.
- History (Enterprise): raw data for 5 years, summaries for 10 years; data around alarms and segments you mark is kept until you delete it.
- Backups: deleted data may remain in our database provider’s backups for their short retention period.
- Billing records: six years, as Spanish commercial law requires.
- Records of significant actions: while the account or organization they concern exists and afterwards as long as they may be needed to establish or defend legal claims. Once an account is deleted, they keep only a pseudonymous identifier.
- Enquiries and demo invitations: as long as the conversation or the customer relationship may continue. Ask us and we delete them.
- Providers’ technical logs: for the periods those providers set.
8. Cookies and browser storage
We set no cookies and use no advertising or analytics tools. The websites and the app use your browser’s storage only for what the Service needs: keeping you signed in, your theme and display preferences, dismissed notices, the workbook open in a tab, unsaved changes, and the keys and stream passwords that let your browser open encrypted content. It stays in your browser; clearing it signs you out and may ask you for stream passwords again. Google and Stripe pages you visit to sign in or pay follow their own cookie policies.
9. Your rights
You can ask us to:
- give you access to your personal data and a copy of it;
- correct it;
- delete it (you can also delete your account yourself in the app);
- restrict how we use it;
- send you the data you gave us in a machine-readable format (portability);
- stop using it where we rely on legitimate interest (objection).
Write to hola@kymoscope.com. We may ask you to confirm your identity, and we reply within one month. You can change your name and picture in the app at any time. If your data belongs to an organization’s workspace, we may pass your request to that organization.
You may also complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or to the authority where you live.
10. Organizations
When an organization uses Kymoscope, it decides what its members store in its projects. For that content, the organization is the controller and we process it on its behalf. Organizations can ask for a data processing agreement at hola@kymoscope.com.
11. Automated decisions and children
We make no decisions about you by automated means alone that have legal or similarly significant effects, and we do not profile you. The Service is for people aged 18 or over.
12. Security
Data is encrypted in transit and at rest by our providers, and end-to-end where the Service offers it. Two-step verification is available to everyone, administrative access needs strong authentication and is logged, and organizations and projects have access controls. If a breach affects your data, we will tell you and the authorities as the law requires. Security explains exactly what is protected and how.
13. Changes
We will tell you about important changes by email or in the app before they apply. The date at the top shows the latest version.
14. Contact
Kymoscope, hola@kymoscope.com