Legal
Privacy Policy
This policy explains what personal data Korve collects, why, and what you can do about it.
Who is responsible for your data
Korve is run by an independent developer based in India, working as a sole proprietor, who decides how your data is used. You can reach us at support@korve.cloud. If you need the operator's legal name for a legal, tax or data protection reason, email us and we will give it to you.
What we collect
| Data | Examples | Why we need it |
|---|---|---|
| Account | Email, display name and a bcrypt hash of your password. If you use Google sign-in, your Google ID and profile picture | Signing you in and contacting you about your account |
| Cloud credentials | The AWS access key ID and secret access key you enter | Carrying out the actions you ask for in your cloud account |
| SSH keys | Private keys you add for Remote Access, with the host, user, port and key fingerprint | Running the commands you ask for on your servers |
| Cloud account details | Account ID, region, display name, resource state and cost figures | Showing My Clouds, resources, cost and drift |
| Workflows | The services, settings and connections on your canvas | Saving and deploying your work |
| Ask AI | Your prompts, files you attach, and the plans and summaries generated | Producing answers and keeping your chat history |
| Remote commands | Commands you run, the target instance and the exit code | Your activity history |
| Billing | Dodo Payments customer ID, subscription ID and status. We never receive your card or UPI details | Applying the plan you paid for |
| Support and feedback | Your messages and screenshots, the page you were on and your browser's user agent | Fixing problems and answering you |
| Usage and abuse prevention | Daily usage counts, and a salted one-way hash of your IP address and user agent at sign-up | Enforcing plan limits and investigating abuse |
| Site analytics | Page views, referrer, device type and country, through Cloudflare Web Analytics, which does not use cookies | Understanding how the site is used |
How your credentials are protected
AWS credentials and SSH private keys are encrypted by our application before they reach the database, and the encryption key is kept separately from it. AWS credentials are held only for your active session, which currently expires after 8 hours or when you sign out. SSH keys stay stored until you remove them or delete your account. Your browser only ever holds an opaque session token, and credentials are never sent to the AI model.
We also use TLS for all traffic, bcrypt for passwords and per-user row-level security in the database. No system is perfectly secure. If a breach affects your data, we will tell you as the law requires.
Who processes your data
We do not sell your personal data, and we do not use it to train AI models of our own. These providers process it for us:
| Provider | What they do | Data involved |
|---|---|---|
| Cloudflare | Website hosting, network protection, DNS and analytics | All site traffic, including IP addresses |
| Fly.io | Runs our API servers | All API traffic |
| Supabase | Hosts our database | The data listed above |
| Dodo Payments | Merchant of Record: payments, tax and invoices | The billing details you give them at checkout |
| Resend | Sends account and billing emails | Your email address and the message |
| NVIDIA | AI model provider for Ask AI | Your prompts, attached files and the relevant workflow and account context, such as resource names and settings |
| Pollinations | AI model for the IAM role wizard on the Connect pages | What you type into the wizard |
| Google sign-in and web fonts | Your Google profile if you use sign-in, and your IP address when fonts load |
Please do not put passwords or other secrets into Ask AI prompts or the role wizard.
Our servers are in Japan and South Korea, and some providers operate in other countries, including the United States. Your data may therefore be processed outside your own country.
Cookies and browser storage
We use a sign-in cookie that lasts up to 7 days and a short-lived cookie during Google sign-in. We also use your browser's local storage for preferences. We do not use advertising cookies.
Why we are allowed to use your data
Where laws such as the GDPR require a legal basis, we rely on the contract with you to provide Korve, on our legitimate interests in keeping it secure, preventing abuse and understanding how it is used, and on your consent where the law requires consent.
How long we keep it
We keep your account data until you delete your account. To delete it, email support@korve.cloud from your account email, and we will complete the deletion within 30 days. Backups expire on their normal cycle, and we keep only what the law requires. Dodo Payments keeps its own billing records as tax law requires.
Your rights
Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it, or stop or limit how we use it. You can also withdraw any consent you gave. Email support@korve.cloud and we will respond within one month.
You can also complain to your local data protection authority. In India, that is the Data Protection Board of India.
Children
Korve is not intended for anyone under 18, and we do not knowingly collect their data.
Changes to this policy
We will change the date at the top when we update this policy, and we will tell you by email or in the product about significant changes.
Contact and grievances
Privacy questions and complaints go to support@korve.cloud. Our contact page explains how complaints are handled.