This policy explains what Kilva collects about you, why, and what you can do about it.
Who is responsible
IO Consulting OÜ, registry code 14810620, Sarapuu tn 74, Tabasalu alevik, Harku vald, 76901 Harju maakond, Estonia, is the controller of your data. Write to us at [email protected].
What we collect
- Account: your email address, the name you choose, your language, and your password in a form we cannot read back.
- Play: your rounds, answers, answer times and points.
- Plans and payments: your plan, its dates and your invoices. Stripe holds your card details; we never see the card number.
- Security: the address and browser of each signed-in session, kept while the session lasts.
- Guests: a random number in a cookie, so the free daily try works without an account.
- Messages: question reports and anything you write to us.
- Notifications: if you turn them on, your device's push address, the language and the browser, until you turn them off.
Why, and on what basis
- To run your account, your games and your plan: because of our contract with you.
- To keep Kilva safe, stop cheating and improve the questions: our legitimate interest.
- To keep invoices: the Estonian Accounting Act requires it.
We do not sell your data, show ads, or use tracking cookies.
Who else handles it
- Hosting: our own server at Adminor AB in Stockholm, Sweden, in the EU.
- Stripe: payments. Stripe may process data outside the EU under the EU's standard contractual clauses.
- Resend: sending our emails.
- Sentry: error reports, stored in the EU. A report holds the error and the page address, never your name, email or IP address.
- Push services: if you turn on notifications, your browser's push service (Google, Apple, Mozilla or Microsoft) delivers them. It receives the notification text, not your account details.
- AI providers: they write and check questions. They never receive any personal data.
Cookies
Kilva only uses cookies it needs to work: your session, your language and the guest number. Stripe sets its own cookies during checkout to prevent fraud.
What others see
Rankings show your first name and the first letter of your last name, as you set them in your account. Nothing else about you is public.
How long we keep it
- Your account and play history: until you delete the account.
- Invoices: 7 years, as the law requires, even after the account is deleted.
- The audit log of staff and system changes: 3 years.
- Backups: up to 14 days.
Your rights
You can download everything we hold about you and delete your account at any time, with the buttons in your account. You can also ask us to correct your data or object to how we use it. If you think we handle your data wrongly, you can complain to the Estonian Data Protection Inspectorate (aki.ee).
Changes
If we change this policy in a way that matters to you, we email you before the change takes effect.