Privacy policy

1. ActiveKit holds data in two different positions

ActiveKit is operated by Hello MSG Inc, a corporation registered with the Securities and Exchange Commission in the Philippines. Where this policy says ActiveKit, it means that company. Your rights depend on which of the two positions applies to you, so this is the first thing to read rather than the last.

Members, the people who sign in to ActiveKit. ActiveKit decides what it collects about you and why, so it is the controller of that data. Everything below describes it.

Your users, the people who use the product an organization built. ActiveKit only handles what that organization sends, and only to run the campaigns it configured. The organization decides what to send and why, so it is the controller and ActiveKit is the processor. If you used a product that runs on ActiveKit and you want your data seen, corrected, or deleted, ask that organization first: its own privacy policy governs, and ActiveKit acts on its instruction.

ActiveKit does not publish a standard data processing agreement yet. An organization that needs one can write to hello@activekit.app, and this policy links it here once it is published.

2. What ActiveKit collects

• Account data. Your name, your work email, your organization name, your role in it, and a record of your sign-ins. This arrives through the identity provider ActiveKit uses for authentication.
• Billing data. Paddle collects and holds the payment details for your subscription. ActiveKit receives the invoice record, the plan you are on, and whether the subscription is active. It never receives a full card number.
• Event data an organization sends. Whatever that organization chooses to send, which is typically an identifier for one of its users and the fact that something happened in its product. Organizations are told not to send special category data, and section 4 of the terms of service makes it a condition of the account.
• Technical data. IP address, browser, and timestamps, in request logs and in error reports. ActiveKit keeps these to secure the service and to debug it.

3. Why ActiveKit uses it

• To run the service you or your organization asked for, which is the reason most of it exists.
• To authenticate you and to keep an account attached to the right organization.
• To bill a subscription and to produce the invoice records tax rules require.
• To answer a support request, which usually means looking at the account it came from.
• To keep the service secure, to find abuse, and to investigate an incident.
• To tell you about a change that affects your account, such as a price change or a new version of these policies.

4. What ActiveKit does not do

ActiveKit does not sell personal data. It runs no advertising, shares nothing with ad networks, and does no cross site tracking. It does not use the event data an organization sends to train machine learning models.

5. Cookies

The activekit.app website sets no cookies of its own today, and it never sets an advertising cookie, runs third party analytics, or tracks you across other sites. Nothing here follows you off this site, so there is no consent banner to dismiss.

That changes in one direction as the platform ships. The dashboard will set the cookies that keep you signed in and remember which organization you are working in, and it does not work without them. The hosting and abuse protection layers in front of the site may set a cookie that tells ActiveKit whether a request looks automated, which keeps the service secure and does not identify you. This section is updated when either lands.

6. Who else sees it

ActiveKit runs on service providers, and each receives only what it needs to do its job. ActiveKit engages a provider only where the terms it offers bind it to process that data on instruction from ActiveKit, keep it secure, and use it for nothing of its own.

• Cloudflare, for hosting the site, the API, and the edge storage behind them.
• Neon, for the Postgres database the service runs on.
• Kinde, for authentication and organization membership.
• Paddle, for payments, invoicing, and tax.
• Resend, for transactional email such as an invite or a password reset.
• Sentry, for error monitoring.

That is the set of providers ActiveKit has selected for the service. The platform is still being built, so not every one of them is handling data yet, and this page changes as the list does. ActiveKit also discloses data when the law requires it, and it tells you first unless it is forbidden from doing so.

7. Where data is processed

Hello MSG Inc operates from the Philippines, and the providers above run in more than one country, so personal data can be processed outside the country you are in. Each transfer happens under the contract terms that provider offers for international transfers.

8. How long ActiveKit keeps it

• Account data, for as long as the account is open, then deleted within 90 days of it closing.
• Event and campaign data, for as long as the account is open, or until the organization deletes it.
• Invoices and tax records, for as long as tax law requires them, which outlives the account.
• Request logs and error reports, for 90 days.

9. Your rights

Write to hello@activekit.app to ask for a copy of your data, to correct something wrong in it, to have it deleted, or to object to how it is used. ActiveKit answers within 30 days and asks for enough detail to be sure the request comes from you. Depending on where you live, you may also have the right to complain to a data protection authority.

10. Children

ActiveKit is a business product and is not directed at children. It does not knowingly collect data from anyone under 16. If you believe it has, write to hello@activekit.app and the data is deleted.

11. Changes to this policy

ActiveKit updates this policy as the service changes, and the date at the top says when it last did. For a change that materially affects you, ActiveKit emails the account owner at least 30 days before it takes effect.

12. Contact

Privacy questions and requests go to hello@activekit.app.