The short version.
- The records you keep in Kyllo — your clients, invoices, payments and CRM — belong to your business. We store and process them only to run the service for you.
- We do not sell personal data, show advertising, or use analytics or tracking cookies.
- Your data is hosted in the European Union. A few service providers outside it (email delivery, AI models, push notifications) receive only what their job needs.
- AI features are optional, and we never use your data to train models.
- You can ask us at any time for a copy of your data, to correct it, or to delete it: write to [email protected].
1. Who we are
Kyllo (the “service”), available at kyllo.app and through our iOS app, is operated by AppCabinet LTD, a company registered in England and Wales under company number 15498413, whose registered office is at 1st Floor, 124 Cleveland Street, London W1T 6PG, United Kingdom (“we”, “us”, “our”).
This policy explains how we handle personal data when you visit our website, ask for early access, use the service, or are a person whose details a business has recorded in it. It should be read together with our Terms of Use.
For anything about privacy, including exercising your rights, write to [email protected]. We have not appointed a data protection officer, because the law does not currently require one for a service of our kind; the same address reaches the people responsible for data protection.
2. Our two roles: controller and processor
Data protection law distinguishes between a controller, who decides why and how personal data is used, and a processor, who handles it on someone else's behalf.
- We are the controller of the data we need to run our own business: visitors to our website, people who ask for early access, the accounts of the people who sign in, our subscription and billing records, and our correspondence with you.
- We are a processor for everything a business (our “customer”) records in the service about its own clients, leads, contacts and staff — what we call Customer Data. The customer is the controller of that data and decides what goes in and why. We process it only on the customer's instructions, as set out in the data processing terms in section 9 of our Terms of Use.
If you are a client or contact of a business that uses Kyllo, see section 13.
3. What we collect
3.1 When you ask for early access
Your email address and, if you choose to fill it in, a short description of how you work today. We record the date of the request and whether we have notified ourselves about it. We do not store your IP address or browser details with the request.
3.2 Your account
- Your email address and, if you give it, your name.
- The companies you belong to in the service and your role in each (member or manager), and whether you are a platform administrator.
- Your language preference, where you have set one.
- Sign-in data: we sign you in with one-time links sent by email, and store only a one-way fingerprint (hash) of each link, its purpose and its expiry — never the link itself. We record when you last signed in.
- Passkeys, if you register one: the public key, an identifier, a nickname you choose, a usage counter and when it was last used. Your private key and any biometric data (such as your fingerprint or face) never leave your device and are never seen by us.
- If you use our iOS app and allow notifications: your device's push token, so we can send you reminders and alerts.
3.3 Your business's details
The details your company enters to issue invoices: its name, address, email, phone, tax number, payment details printed on invoices (such as bank account details), invoice numbering settings, currency, time zone and language. Where these identify a person — for example a sole trader — they are personal data, and we are their controller to the extent we use them to provide the service and bill you.
3.4 Customer Data (processed on your behalf)
Depending on which features a business uses, it may record in the service:
- Clients and invoices: client names, addresses, emails, tax identifiers and tax settings; invoice lines, amounts, dates, notes and terms; payments recorded against invoices; and email templates.
- CRM records: people and organisations (“parties”), their contact details (email, phone, WhatsApp, Telegram, Instagram, website), addresses, nationality, preferred language, identifiers such as tax or passport numbers, custom fields the business defines, stages, tags, comments, appointments and an activity timeline.
- Documents uploaded to a party's record, which may include identity documents and other sensitive papers.
- Leads that arrive through the partner API or by email to an address we issue, including the content of those submissions and emails.
- Imports: spreadsheets uploaded to create or update parties in bulk.
Customer Data can include special categories of data or other sensitive information (for example immigration status in an identity document) if a business chooses to record it. The business is responsible for having a lawful basis to do so; we treat all Customer Data as confidential.
3.5 Connected apps and integrations
If you connect an AI assistant or other app through our MCP server, we keep the app's registration (its name and redirect addresses), the authorisation you granted (which company and which permissions), hashed access and refresh tokens, and a log of each change the app makes, so you can review its activity. Partner API keys are stored only as a hash, with a short prefix so you can tell them apart.
3.6 Technical data
- IP addresses are used briefly to protect sign-in, early-access and API endpoints from abuse (rate limiting). They are counted in a temporary cache and not stored with your account. Our web server's request logs also record IP addresses, the pages requested and response codes, for security and troubleshooting.
- Email delivery data: our email provider records whether messages we send were delivered, bounced or marked as spam.
- We do not use analytics, advertising or tracking tools, and we do not build profiles of how you use the site.
3.7 Subscription and billing
Which plan you are on (monthly or yearly), your trial and subscription dates, the invoices we issue to you and the payments we receive. We take payment by bank transfer or similar means arranged with you; we do not collect or store card numbers.
3.8 Communications
Messages you send us, and our replies, for example support requests or questions about your subscription.
4. Why we use it, and our legal bases
We are established in the United Kingdom, so the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 apply to us; where we offer the service to people in the European Economic Area, the EU GDPR applies as well (together, the “GDPR”). Under both, we rely on the following legal bases. We use your data only for these purposes.
| Purpose | Data | Legal basis |
|---|---|---|
| Considering and answering an early-access request | 3.1 | Steps taken at your request before entering into a contract (Art. 6(1)(b)); our legitimate interest in choosing who to onboard (Art. 6(1)(f)) |
| Creating your account, signing you in and keeping it secure | 3.2, 3.6 | Performance of our contract with you (Art. 6(1)(b)) |
| Providing the service: storing records, producing invoices and PDFs, sending emails you ask us to send, reminders and notifications | 3.2–3.5 | Contract (Art. 6(1)(b)); for Customer Data, the customer's instructions (Art. 28) |
| Optional AI features | Only what the feature needs (see section 5) | Contract, when you or your business turn the feature on (Art. 6(1)(b)); for Customer Data, the customer's instructions |
| Preventing abuse, fraud and security incidents | 3.6 | Legitimate interest in keeping the service and its users safe (Art. 6(1)(f)) |
| Billing you, keeping accounting records and meeting tax obligations | 3.3, 3.7 | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) |
| Service messages (security alerts, changes to these documents, trial and renewal notices) | 3.2 | Contract (Art. 6(1)(b)); legitimate interest (Art. 6(1)(f)) |
| Support and correspondence | 3.8 | Contract or legitimate interest in answering you (Art. 6(1)(b) and (f)) |
| Establishing, exercising or defending legal claims, and responding to lawful requests from authorities | Any, as strictly necessary | Legal obligation or legitimate interest (Art. 6(1)(c) and (f)) |
We do not send marketing email. If we ever want to, we will ask for your consent first where the law requires it, and you will be able to withdraw it at any time.
Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can object at any time (see section 11).
5. AI features
Some features use large language models. Each is limited to the data it needs:
- Smart billing drafts recurring invoices. It sends the automation you configured and the relevant invoice and client details to a model to prepare a draft. A person always reviews and sends the invoice; the feature never sends anything to a client on its own.
- Emailed leads: when a business turns on lead intake by email, the body of an incoming lead email is sent to a model to extract the lead's name and contact details, which a person then confirms before anything enters the CRM.
- Conversation summaries: text a user pastes is sent to a model to produce a summary. Only the pasted text is sent — nothing else from the CRM record — and the paste is not stored. These requests go only to providers that commit to zero data retention and do not collect the data.
- Connected assistants (MCP): if you connect an assistant such as Claude, it reads and changes data according to the permissions you grant. What the assistant's provider does with that data is governed by your agreement with that provider, not by us.
We route model requests through OpenRouter, which forwards them to the model provider chosen for that feature. We do not use your data or Customer Data to train AI models, and we do not allow our providers to do so where we can control it. Model output can be wrong, which is why every AI result in Kyllo is reviewed by a person before it is sent or filed.
None of these features makes decisions that have legal or similarly significant effects on you without human involvement.
6. Cookies and similar technologies
We use only cookies that are needed for the site to work or to remember a choice you made. We use no analytics, advertising or third-party tracking cookies, so we do not show a consent banner.
| Name | Purpose | Duration |
|---|---|---|
_billing_session | Keeps you signed in and protects forms against cross-site request forgery. Strictly necessary. | 30 days, renewed while you use the service; deleted when you sign out |
locale | Remembers the language you chose before signing in, or that you visited our Russian pages. | Until you clear it |
Cloudflare security cookies (for example __cf_bm) | Set by our network provider, Cloudflare, to tell people from automated traffic. Strictly necessary. | Up to 30 minutes |
Our iOS app stores your session and preferences on your device in the same way. You can delete cookies in your browser settings; if you delete the session cookie you will be signed out.
7. Who we share it with
We do not sell or rent personal data, and we do not share it for advertising. We share it only with the service providers below, who act on our instructions under contracts that require them to protect it, and in the limited cases listed after the table.
| Provider | What they do | Where |
|---|---|---|
| Hetzner Online GmbH | Hosts our servers and database | European Union (Germany / Finland) |
| Cloudflare, Inc. | Network security, DNS and delivery of the website; stores uploaded files (R2) | Global network; company based in the United States |
| Postmark (ActiveCampaign, LLC) | Sends our email and receives email sent to lead-intake addresses | United States |
| OpenRouter, Inc. and the model provider it routes to | Runs the optional AI features (section 5) | United States and other countries, depending on the model |
| Apple Inc. | Delivers push notifications to our iOS app | United States |
We may also disclose personal data:
- Within your company: other members of a company you belong to can see your name and email and what you did in that company's records (for example, who issued an invoice). Platform administrators can see accounts so they can provide support.
- To recipients you choose: when you send an invoice, receipt or appointment notice, or share an invoice's public link, its contents go to the people you send it to.
- To apps you connect, within the permissions you grant.
- To professional advisers (lawyers, accountants, auditors) under a duty of confidentiality.
- When the law requires it, to comply with a valid legal process or protect the rights, safety or property of our users, the public or us. Where the request concerns Customer Data, we will refer the authority to the customer and notify the customer unless the law forbids it.
- In a business transfer, such as a merger or sale of our business, to the acquirer, who must continue to protect it as this policy describes. We will tell you before that happens.
8. International transfers
We are based in the United Kingdom, and our servers and database are in the European Union. UK law recognises the European Economic Area as providing adequate protection, and the EU recognises the United Kingdom, so data can move between them without further safeguards.
Where a provider in section 7 processes personal data in another country, we rely on:
- for data protected by UK law: UK adequacy regulations — including the UK Extension to the EU–U.S. Data Privacy Framework, for providers certified under it — or the Information Commissioner's International Data Transfer Agreement or UK Addendum to the European Commission's Standard Contractual Clauses;
- for data protected by EU law: an EU adequacy decision — including the EU–U.S. Data Privacy Framework — or the European Commission's Standard Contractual Clauses;
together with additional safeguards where needed. You can ask us for a copy of the relevant safeguards at [email protected].
9. How long we keep it
We keep personal data only as long as we need it for the purposes above. Several kinds are deleted automatically:
| Data | How long |
|---|---|
| One-time sign-in links | Expire after 30 minutes (24 hours for an invitation) and work only once |
| Sessions | 30 days from your last activity, or until you sign out |
| Connected-app refresh tokens | Stop working after 30 days unused, or when you revoke them |
| Log of changes made by connected apps | 90 days |
| Uploaded import spreadsheets | 30 days; the import record and its column mapping, 60 days |
| Raw lead emails received at an intake address | 30 days |
| Emailed leads in the review queue | 30 days if discarded or ignored; 365 days otherwise |
| Partner API lead submission log | 30 days if rejected; 183 days otherwise |
| Early-access requests | Until we have decided on the request, and then for as long as we may still contact you about access; delete it any time by asking us |
| Web server logs | For a limited period, for security and troubleshooting, and then deleted |
| Your account and Customer Data | For as long as your subscription or trial lasts, then as set out in the Terms of Use: available for export for 30 days, then deleted from our live systems within a further 30 days, and from any backups within 90 days after that |
| Our own invoices to you and accounting records | As long as tax and accounting law requires, typically up to 10 years |
A business using the service decides how long to keep its own Customer Data, and can delete records at any time. Businesses are themselves often required by tax law to keep invoices for several years; they should export what they need before closing their account.
Some activity logs are append-only by design, so that a history of who did what cannot be rewritten. They are deleted together with the record they belong to or with the company's account.
10. How we protect it
- All traffic is encrypted in transit with TLS.
- There are no passwords to steal: sign-in uses one-time email links or passkeys, and we store sign-in links, API keys and access tokens only as one-way hashes.
- Every company's data is kept separate; each request is checked against the company the person belongs to.
- Uploaded documents are never served through shareable storage links: each download is checked against the signed-in person's access.
- Access to production systems is limited to the people who operate the service, and protected by key-based authentication.
- We keep the software and servers patched.
No system is perfectly secure. If a breach affects your personal data, we will notify you and, where required, the competent supervisory authority without undue delay — and, for Customer Data, we will notify the affected customer so it can meet its own obligations.
11. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and get a copy of it;
- correct data that is inaccurate or incomplete;
- delete your data (“right to be forgotten”);
- restrict or object to how we use it, including where we rely on legitimate interests;
- receive your data in a structured, commonly used, machine-readable format and have it sent to another provider (portability);
- withdraw consent at any time, where we rely on it, without affecting what was done before;
- complain to a data protection supervisory authority, in particular where you live, work or believe your rights were infringed.
You can correct most account details yourself in Settings. For anything else, write to [email protected]. We will answer within one month (extendable by two further months for complex requests, in which case we will tell you why). We may need to confirm your identity first. Exercising your rights is free, unless a request is manifestly unfounded or excessive.
A complete self-service export is not built yet. Until it is, we will prepare an export of your data on request.
Complaints. If you are unhappy with how we have handled your data, please tell us first at [email protected]. We will acknowledge your complaint within 30 days, look into it and tell you the outcome without undue delay. You can also complain to the Information Commissioner's Office (ico.org.uk), our lead supervisory authority, or to the authority in the country where you live or work.
12. Region-specific information
United Kingdom
We are the controller described in section 2 under the UK GDPR and the Data Protection Act 2018. Our supervisory authority is the Information Commissioner's Office (ico.org.uk).
European Economic Area and Switzerland
This policy is also written to meet the EU GDPR and the Swiss Federal Act on Data Protection. You can complain to the supervisory authority in your country; the European Data Protection Board publishes a list of them.
United States, including California
We do not sell personal information or share it for cross-context behavioural advertising, as those terms are defined in the California Consumer Privacy Act, and we do not knowingly collect data from anyone under 16. California residents and residents of other states with comparable laws may request to know, correct or delete their personal information, and will not be discriminated against for doing so. The categories, sources, purposes and recipients are those described in sections 3, 4 and 7.
Canada
We handle personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA). Some of it is stored and processed outside Canada, where it may be accessible to authorities under local law.
Russian Federation, Ukraine, Kazakhstan and other countries
Our servers are located in the European Union, so using the service involves a cross-border transfer of personal data from your country. Where your local law requires consent to such a transfer, or for the processing itself, you give it by creating an account and using the service, and you may withdraw it by closing your account. If you are a business, you are responsible for meeting any local requirement that applies to your own clients' data, including any requirement to store that data in your country first.
13. If a business using Kyllo holds your data
If you are a client, lead or contact of a business that uses Kyllo, that business is the controller of your data and decides how it is used; its own privacy notice applies. Please send requests about your data to that business first. If you contact us instead, we will pass your request to the business and help it respond. We do not use your data for any purpose of our own.
If you received an invoice or appointment email from a business through Kyllo, it was sent on that business's behalf. Public invoice links are kept out of search engines.
14. Children
Kyllo is a tool for businesses and is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.
15. Changes to this policy
We will update this policy when our practices or the law change, and change the date at the top. If a change is significant, we will tell signed-in users by email or in the service at least 30 days before it takes effect, unless the change is required sooner by law.
16. Contact us
AppCabinet LTD
1st Floor
124 Cleveland Street
London W1T 6PG
United Kingdom
Email: [email protected]
This policy is also available in Russian. If the two versions differ, the English version prevails, unless your local law requires otherwise.