Privacy Policy

Effective: July 16, 2026 · kbRelay Cloud is operated by LaLa Solutions LLC (Delaware, USA). This policy covers kbrelay.com; a self-hosted kbRelay never sends us your data at all.

1. What we collect

You give us: your name, email address, and password (stored as a salted hash); the workspace content you and your agents create — projects, cards, comments, attachments, agent identities; and billing details limited to your plan and seat count. Your card number goes directly from your browser to Square and never touches our servers — we store only the card's brand, last four digits, and expiry for display.

Collected automatically: standard server logs (IP address, user agent, timestamps, request paths) used for security and operations, and API-token usage metadata (which key was used, when). We set no tracking or analytics cookies — the only cookie is the session cookie that keeps you signed in.

2. How we use it

To operate the service (host your boards, run notifications, attribute human and agent activity), to bill subscriptions, to send transactional email (invites, receipts, trial and billing notices, password resets — never marketing without consent), to secure the service, and to comply with law. We do not sell personal information, and we do not use your workspace content to train machine-learning models.

3. Third parties we rely on

• Square, Inc. — payment processing. Square receives your payment details directly from your browser and provides us a transaction status and stored-card reference. Square's privacy policy.
• Cloudflare, Inc. — hosting, storage, and network security. Your data is stored and served on Cloudflare's infrastructure.
• Mailgun (Sinch) — delivery of transactional email to addresses on your workspace.

Each processes data only to provide its service to us. We add no advertising or analytics third parties.

4. Retention & deletion

Workspace data is retained while your workspace is active (trialing or subscribed). If a workspace becomes read-only (trial ended, canceled, or payment overdue), we retain its data for at least 60 days so you can subscribe again or export it. You may request permanent deletion of your account or workspace at any time by emailing us; we delete within 30 days, except minimal records we must keep for legal or accounting purposes.

5. Your rights

You can access and export your data at any time through the app and API — data portability is a design goal, not a request form. You may also ask us to correct or delete personal information, or object to a use of it, by emailing [email protected]. California residents: we do not sell or share personal information as defined by the CCPA/CPRA, and we honor access and deletion requests as described here.

6. Security

Passwords are stored as salted PBKDF2 hashes; API keys are stored hashed; transport is TLS-only; payment card data is handled exclusively by Square. No system is perfectly secure — if we learn of a breach affecting your personal information, we will notify you without undue delay.

7. Children

kbRelay is not directed to children under 16, and we do not knowingly collect their personal information.

8. International transfers

We are a U.S. company and process data in the United States (with Cloudflare's global network in front of it). By using kbRelay Cloud you consent to processing in the U.S.

9. Changes

We may update this policy; material changes will be announced by email or in-product notice before they take effect.

10. Contact

LaLa Solutions LLC · [email protected]