Kova

Privacy Policy

Last updated 9 November 2026

Kova handles your team’s knowledge, so we keep this plain: what we collect, why, who processes it, and what you can do about it.

1. Who we are

Zidni runs Kova. For your workspace content, the organization that owns the workspace decides what goes in and who can see it; we process that content on its behalf. For account and usage data, we decide how it is used, as described here.

2. What we collect

  • Account details: your name, work email, password (stored only as a secure hash), role and the date you accepted our terms.
  • Workspace content: files, knowledge-base material, messages and prompts you add, and the AI responses, reports and tasks created from them.
  • Usage and technical data: sign-in times, the model you choose, IP address, browser type and error logs, used to keep Kova secure and working.

3. How we use it

  • to run Kova: sign you in, answer your questions and build what you ask for;
  • to keep it secure: prevent abuse, investigate problems and enforce our Terms;
  • to improve the product using aggregated usage patterns, not the content of your files or messages;
  • to contact you about your account and important changes.

We do not sell personal data, and we do not use your workspace content to train AI models.

4. How AI processing works

When you ask Kova something, your message, the relevant parts of your workspace content and the conversation so far are sent to an AI model to generate the answer. Today these requests are routed through the OpenUI Gateway, operated by Thesys, to the model provider you select in Kova (for example Google, OpenAI or Anthropic). Conversation history is currently stored with OpenUI Cloud so you can return to past chats.

Files and the knowledge base. Files you upload are stored on Kova’s servers. Kova extracts their text and keeps it, split into passages, in its own database so it can search them when you ask a question. Only the passages relevant to a question are sent to the AI model. When meaning-based search is enabled, passages and search queries are also sent to OpenAI to create search vectors (“embeddings”); OpenAI processes them under its API terms. Scanned PDFs without a text layer are sent to an OCR service to read their text: Mistral AI or Datalab, whichever the operator has configured. Deleting a file removes the file and its passages.

These providers process the content to return responses, under their own terms and data-protection commitments. Avoid putting sensitive personal data into Kova unless your organization has approved it.

5. Who we share it with

  • Service providers that help us run Kova, such as hosting, AI model routing and AI model providers, and Resend, which delivers invitation emails (the invitee’s email address, the inviter’s name and the workspace name), bound to use data only for that purpose;
  • People in your workspace, according to the roles and permissions your owner or admins set;
  • Authorities, when the law requires it, or to protect people’s safety and rights;
  • A buyer or successor, if Kova is part of a merger or sale, under the same protections.

6. Where it is stored and how it is protected

Accounts and workspace data are kept in Kova’s own database on servers we manage. Access is limited by role, each workspace can only read its own data, passwords are hashed, and we keep server access restricted and logged. Some processing happens in other countries through the providers above; where that applies we rely on their contractual and security safeguards.

7. How long we keep it

We keep account and workspace data while your account is active. When you or your workspace owner delete content, we remove it from Kova within a reasonable time, and from backups as they expire. We may keep limited records longer where the law requires it or to resolve disputes.

8. Your choices and rights

You can update your name, and ask us to access, correct, export or delete your personal data, or object to certain uses. For workspace content, contact your workspace owner first, as they control it. Depending on where you live, you may also complain to your local data-protection authority.

9. Children

Kova is for work use by adults. It is not directed at anyone under 18, and we do not knowingly collect their data.

10. Changes and contact

We will update this policy as Kova adds features, and tell you about material changes before they apply. Questions or requests: [email protected].