Privacy Policy
How Kliff collects, uses, shares, and protects your information.
This policy explains what information Kliff collects when you use our website, web app, desktop app, and API, why we collect it, who we share it with, and the choices you have.
Kliff is operated by Bluebik Nexus Company Limited, 51 Naradhiwas Rajanagarindra Road, Bang Rak, Bangkok 10500, Thailand ("we", "us"). We are the data controller for the information described here, except where your organization controls it (see When your organization controls the data).
If you have a question or want to make a request, use the contact page. Choose the Support topic and start your message with "Privacy request".
Information we collect
Information you give us
- Account details. Your name, email address, and profile photo. If you sign in with Google or GitHub, we receive your name, email address, and profile photo from that provider, plus your GitHub username and user ID.
- Sign-in security. Passkey public keys and device names, two-factor authentication secrets and backup codes. We never receive the private key of a passkey.
- Organization details. Organization name, logo, time zone, billing email, preferred data location, and the email addresses of people you invite.
- Your content. Messages and instructions you send to agents and automations, files you attach to a prompt (images or text files), project and repository settings, and setup commands.
- Secrets and credentials. Repository and environment secrets, and the credentials for connectors you add (such as an OAuth sign-in, an API header, or the email address of a connected Gmail account). We encrypt these before storing them.
- Contact form messages. Your name, work email, topic, and message when you write to us through the contact page.
Information we collect automatically
- Session and device information. Your IP address and browser user agent for each signed-in session. We show these to you in your security settings so you can spot sessions you don't recognize.
- Service logs. Request details such as IP address, time, URL, and errors, recorded by our hosting provider so we can operate and debug the service.
- Usage records. The runs and agent turns you start, their status, token counts, and credit usage, so we can bill you and show your history.
- Sign-in protection. Cloudflare Turnstile checks your browser when you sign in or sign up, to block automated abuse.
We do not use third-party analytics, advertising trackers, or session recording tools.
Information we receive from connected services
- GitHub. When you install the Kliff GitHub App, we receive the repositories you grant access to, their code, and events such as pull requests, pushes, CI results, issue labels, and comments that mention Nexus. These can include the usernames and content of other people who contribute to those repositories.
- Connectors. When an agent or automation uses a connector you added, such as Gmail, Slack, or a custom MCP server, it reads and writes data in that service on your behalf, limited to what you allow. For example, a Slack connector can read channel history and post messages as you.
- Stripe. Payment status, subscription details, and invoice records. We do not receive or store your full card number.
How we use information
| Purpose | Information used | Legal basis (GDPR and PDPA) |
|---|---|---|
| Create and secure your account, sign you in, and keep sessions working | Account details, sign-in security, session and device information | Contract |
| Run agents and automations on your repositories and connectors | Your content, secrets and credentials, data from connected services | Contract |
| Bill you for plans and credits | Organization details, usage records, Stripe data | Contract, legal obligation |
| Send service emails such as sign-in links, invitations, receipts, and notices | Email address, organization details | Contract |
| Answer your questions and support requests | Contact form messages, account details | Legitimate interests |
| Prevent abuse, fraud, and security incidents | Session and device information, service logs, sign-in protection | Legitimate interests |
| Debug and improve reliability | Service logs, usage records | Legitimate interests |
| Meet legal requirements and enforce our terms | Any information we hold, as needed | Legal obligation, legitimate interests |
You can turn off notification emails in your account settings. Sign-in, security, and billing emails are needed to run your account and cannot be turned off.
Our support staff can access your account, including signing in as you, only to resolve a support request you made or to investigate abuse or a security incident.
AI processing
Agents and automations send your instructions, the repository code they work on, and tool output to an AI model to produce a result. Depending on the model chosen, that model is provided by:
- Anthropic, for agents, which run Claude Code.
- Cloudflare Workers AI, for runs and automations by default.
- xAI, when an xAI model is selected or you supply your own xAI API key.
Requests pass through Cloudflare AI Gateway. Each provider processes this content to return a response, under its own terms for API customers.
How we share information
We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
We share information only with:
| Recipient | What they do | Location |
|---|---|---|
| Cloudflare | Hosting, storage, databases for agents and runs, file storage, email delivery, logs, sign-in protection, AI Gateway, Workers AI | Global network |
| PlanetScale | Hosts our main database | United States and other countries |
| Stripe | Payments, subscriptions, and invoices | United States and other countries |
| Anthropic | AI model for agents | United States |
| xAI | AI model, when selected | United States |
| Google and GitHub | Sign-in, when you choose them | United States |
| Services you connect | GitHub, Gmail, Slack, and custom MCP servers receive the actions an agent takes on your behalf | Set by each service |
We also share information:
- Within your organization. Members of an organization can see its projects, agents, runs, and member list, including names and email addresses.
- For legal reasons. When required by law, court order, or a valid government request, or to protect the rights, safety, or property of our users, the public, or us.
- In a business transfer. If we are involved in a merger, acquisition, or sale of assets, information may transfer to the new owner, who must keep honoring this policy.
When your organization controls the data
If you use Kliff through an organization that your employer or another business manages, that organization decides what repositories, connectors, and content are used. For the content processed on its behalf, the organization is the controller and we act as its processor. Contact your organization's administrator first for requests about that content.
International transfers
We and our providers process information in the United States and in other countries where they operate, which may differ from where you live. Organization owners can choose a preferred storage location for files, but this is a placement preference, not a guarantee that all processing stays in that region.
When we transfer personal information out of the European Economic Area, the United Kingdom, or Thailand, we rely on safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or other mechanisms recognized by the applicable law.
How long we keep information
| Information | How long |
|---|---|
| Account, organization, and project data | Until you delete your account or organization |
| Signed-in sessions | 7 days from last refresh, or until you sign out |
| Sign-in links | 15 minutes |
| Files attached to a prompt | Deleted when the run or agent turn ends |
| Repository access tokens for a run | Deleted when the run or agent ends |
| Records of skipped automation runs | 30 days |
| Agent conversation history and run logs | Until the organization they belong to is deleted. Runs you started stay with an organization that keeps other members when you delete your account |
| Notifications | The 50 most recent per person per organization |
| Contact form messages | In our email inbox for as long as needed to answer you |
| Billing and tax records | As long as tax and accounting law requires |
| Service logs | As set by our hosting provider, typically a few days |
Deleting your account
You can delete your account in Settings > Account > Delete account. This signs you out on every device and deletes:
- Your profile, profile photo, sign-in methods, connectors, and notifications.
- Any organization where you are the only member, with its projects, agents, automations, runs, conversation history, and files. If that organization has a paid plan, we cancel its subscription right away.
Account and organization records are deleted right away. Stored files and conversation history are deleted in the background shortly after.
In an organization that still has other members, your work stays with that organization, because it is part of your team's shared work. That includes the agents you created, your messages in their conversations, and the runs you started, with their logs and attached files. We hand those runs to an owner of the organization (or, if it has no other owner, an admin or member). To have any of this removed, ask an owner of that organization or send a privacy request through the contact page.
We keep billing records held by Stripe for as long as tax and accounting law requires.
Your rights
Depending on where you live, you have some or all of these rights:
- Access the personal information we hold about you and get a copy.
- Correct information that is wrong or incomplete. You can change your profile photo in your account settings.
- Delete your information.
- Portability: receive your information in a structured, machine-readable format.
- Object to processing based on our legitimate interests.
- Restrict how we process your information while a concern is resolved.
- Withdraw consent where we rely on it, without affecting processing that already happened.
- Complain to a data protection authority.
You can use some of these rights yourself in Settings > Account:
- Export your data downloads a JSON file with your profile, sign-in activity, organizations, and the projects, agents, automations, and runs you created. It does not include agent conversation history.
- Delete account deletes your account as described in Deleting your account.
For anything else, including a copy of your agent conversation history, send a privacy request through the contact page. We may ask you to confirm your identity, usually by replying from the email address on your account. We respond within 30 days, or sooner where the law requires.
Thailand
Under the Personal Data Protection Act B.E. 2562 (2019), you have the rights above. You can complain to the Office of the Personal Data Protection Committee (PDPC).
European Economic Area and United Kingdom
Under the GDPR and UK GDPR, you have the rights above. You can complain to the data protection authority in the country where you live or work, or where you believe a breach happened. In the UK, that is the Information Commissioner's Office.
California and other US states
California residents and residents of other US states with privacy laws have the right to know what personal information we collect, use, and disclose, to delete it, to correct it, and to opt out of its sale or sharing. We do not sell or share personal information, and we do not use sensitive personal information to infer characteristics about you.
In the last 12 months we collected these categories, for the purposes and from the sources described above: identifiers (name, email, IP address), commercial information (plans and purchases), internet activity (sessions and service logs), and account credentials.
You can use an authorized agent to make a request on your behalf. We will not treat you differently for exercising any of these rights.
Cookies
We use only cookies needed to sign you in, keep your account secure, and remember your display settings. We do not use analytics or advertising cookies.
| Cookie | Purpose | Duration |
|---|---|---|
session_token | Keeps you signed in | 7 days |
session_token_multi-* | Keeps additional accounts signed in when you switch between them | 7 days |
dont_remember | Ends your session when you close the browser if you chose not to stay signed in | Browser session |
two_factor | Holds a pending two-factor sign-in | 10 minutes |
trust_device | Skips two-factor checks on a device you chose to trust | 30 days |
kliff-auth-passkey | Completes a passkey sign-in | 5 minutes |
oauth_state, state | Completes a Google or GitHub sign-in | Up to 10 minutes |
admin_session | Used while support staff are signed in as you | During that support session |
last_used_login_method | Highlights the sign-in method you used last | 30 days |
__kliff-themes | Remembers your light or dark theme | Browser session |
sidebar_collapsed | Remembers whether the sidebar is collapsed | 1 year |
Sign-in cookie names start with a prefix such as __Secure-kliff-*.. Cloudflare Turnstile may also set cookies to check that you are not a bot. Blocking these cookies in your browser will stop sign-in from working.
Security
We protect your information with:
- Encryption in transit (HTTPS) for all traffic.
- AES-GCM encryption for repository secrets, environment secrets, and connector credentials before we store them.
- Hashed sign-in links, plus passkeys and two-factor authentication you can turn on.
- Rate limits on sign-in and other requests.
- Isolated containers for each agent and run, which are torn down when they finish.
- Masking of known secret values in agent and run logs.
No system is perfectly secure. If a breach affects your personal information, we will notify you and the relevant authorities as the law requires.
Children
Kliff is not for anyone under 16. We do not knowingly collect personal information from children under 16. If you believe a child has given us information, contact us and we will delete it.
Links to other services
Our site and app link to other services, such as GitHub, Stripe, and connector providers. Their own privacy policies govern how they handle your information.
Changes to this policy
We will update the date at the top of this page when we change this policy. If a change materially affects how we use your personal information, we will notify you by email or in the app at least 30 days before it takes effect.
Contact us
Bluebik Nexus Company Limited
51 Naradhiwas Rajanagarindra Road, Bang Rak, Bangkok 10500, Thailand
Send privacy questions and requests through the contact page, choosing the Support topic and starting your message with "Privacy request".