kapa.ai procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | unknown | “Our Data Processing Addendum is expressly incorporated herein by reference and applies between you and kapa together with this Agreement. 2.10 Priority of Enterprise Agreement. If a Subscriber subsequently executes, or becomes subject to, an Enterprise Agreement with kapa, the Enterprise Agreement will control over these Terms from the effective date of that agreement forward, including specifically the Subscriber terms in Sections 2.5 through 2.11. 2.11 Authorized Users. If a Subscriber is a company or other legal entity, each individual authorized to access the Services through that Subscriber’s account is an “ Authorized User ” for purposes of these Terms. Authorized Users access the Services subject to these Terms directly (not a separate Enterprise Agreement). Authorized Users have no separate indemnification obligation to kapa — the Subscriber entity is the primary and sole obligor under Section 11.2. kapa’s aggregate liability to the Subscriber and all Authorized Users collectively is governed by the cap in Section 10.2(e). 2.12 Account Security. If you have an account, you are responsible for keeping your login credentials confidential and for all activity that occurs under your account. Notify kapa promptly at founders@kapa.ai if you believe your account has been compromised or accessed without authorization.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ If you are from the European Economic Area (“EEA”), the United Kingdom (“UK”), or Switzerland, you may have the right, under certain circumstances, to: Access your Personal Data;” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Additionally, the General Data Protection Regulation (“GDPR”) also gives you the right to lodge a complaint with your local supervisory authority. We would, however, appreciate the opportunity to first address your concerns and would welcome you to direct your inquiries to us via the contact information at the bottom of this Privacy Notice. The above rights are not absolute and can be reasonably limited, for example when the exercise of such right by the adversely affects the rights and freedoms of others. Lawful Bases for Processing (EEA, UK, and Swiss Individuals). Our legal bases for collecting and using your Personal Data is as follows: The performance of your contract or to enter into the contract and to take action on your requests. For example, the processing of your account registration.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF (“UK-U.S. DPF”), and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”) (collectively, the “DPF”) as set forth by the US Department of Commerce. We have certified that we adhere to the EU-U.S. Data Privacy Framework Principles (“EU-U.S. DPF Principles”) with regard to the processing of Personal Data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. We have certified to the U.S. Department of Commerce that we adhere to the Swiss-U.S. Data Privacy Framework Principles (“Swiss-U.S. DPF Principles”) with regard to the processing of Personal Data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this Privacy Notice and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles (collectively, the “DPF Principles”), the DPF Principles shall govern. To learn more about the, DPF program, and to view our certification, please visit https://www.dataprivacyframework.gov . With respect to Personal Data received or transferred pursuant to the DPF, we are subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission. Pursuant to the DPF Principles, EU, UK, and Swiss individuals have the right to obtain our confirmation of whether we maintain Personal Data relating to you in the United States. ” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Compliance with a mandatory legal obligation. For example, accounting and tax requirements, which are subject to mandatory retention periods. We may also collect your Personal Data to record your requests to exercise your rights and to verify your identity for such requests.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Are we subject to a legal, contractual, or similar obligation to retain your Personal Data? Examples can include mandatory data retention laws in the applicable jurisdiction, government orders to preserve data relevant to an investigation, or data that must be retained for the purposes of litigation, or protection against a possible claim.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ We keep your Personal Data for the period necessary to fulfill the purposes for which it has been collected. Please keep in mind that in certain cases a longer retention period may be required or permitted by law. The criteria used to determine our retention periods include but are not limited to: How long is the data needed to provide you with our Services or to operate our business?” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Do you have an account with us? In this case, we will keep your data while your account is active or for as long as needed to provide the Services to you.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ 6.1 AI Models and Infrastructure. kapa’s Services rely on third-party AI foundational models, vector database providers, and other infrastructure providers. These third parties process data on kapa’s behalf under contracts with kapa. However, kapa does not control or guarantee the performance, availability, or outputs of third-party components. 6.2 External Links. The Services may include links to third-party websites. Those websites are not operated by kapa, and kapa is not responsible for their content or practices.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Provide measurement services and targeted ads (you can opt out of these services at websites such as http://www.aboutads.info/choices and http://www.youronlinechoices.eu/ );” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Legal Obligations and Rights: We may disclose Personal Data to third parties, such as legal advisors and law enforcement: in connection with the establishment, exercise, or defense of legal claims; ” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Affiliates and Service Providers: We share your information with our third-party service providers and any subcontractors as required to offer you our products and services. The service providers we use help us to: Run, operate, and maintain our Services through third-party platforms and software tools;” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ to comply with laws or to respond to lawful requests and legal process; ” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Ad Networks and Advertising Partners: We work with third-party ad networks and advertising partners to deliver advertising and personalized content on our Services, on other websites and services, and across other devices. These parties may collect information directly from a browser or device when an individual visits our Services through cookies or other data collection technologies. Learn more in our Cookie Banner.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Some external service providers may also collect information directly from you (for example, a payment processor may request your billing and financial information) in accordance with their own privacy policy. These external service providers do not share your financial information, like credit card number, with us, but may share limited information with us related to your purchase, like your zip code. For example, we use third-party payment processor Stripe to process credit card payments made to us. As such, we do not retain any personally identifiable financial information in connection with credit card payments, such as credit card numbers. Rather, all such information is provided directly by you to our third-party processor. The payment processor’s use of your Personal Data is governed by their privacy notice. Usage Data Automatically Collected. As is true of many digital properties, we and our service providers may automatically collect certain information from or in connection with your device or browser when visiting or interacting with our Services. Such data includes: Log Data: Includes internet protocol (IP) address, operating system, device type and version, browser type and version, browser id, the URL entered and the referring page/campaign, date/time of visit, other user agent string data, the time spent on our Services, and any errors that may occur during the visit to our Services. ” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ to protect our rights and property and the rights and property of others, including to enforce our agreements and policies;” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ The categories of third parties with whom we share your Personal Data.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may also share, transmit, disclose, grant access to, make available, and provide Personal Data with and to third parties, as follows: Your Employer / Company : If you interact with our Services through your employer or company, we may disclose your information to your employer or company, including another representative of your employer or company.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Business Transaction or Reorganization: We may take part in or be involved with a corporate business transaction, such as a merger, acquisition, joint venture, or financing or sale of company assets. We may disclose Personal Data to a third-party during negotiation of, in connection with, or as an asset in such a corporate business transaction. Personal Data may also be disclosed in the event of insolvency, bankruptcy, or receivership. ” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ to protect the health and safety of us and others; or, ” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ With Your Consent or At Your Direction: We may disclose Personal Data about an individual to certain other third parties or publicly with their consent or at their direction. For example, with an individual’s consent or direction we may post their testimonial on our Services or Service-related publications. ” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Marketing Providers: We coordinate and share Personal Data with our marketing providers in order to communicate with individuals about the Services we make available. ” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ as otherwise required by applicable laws.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ If you have questions about or need further information concerning the legal basis on which we collect and use your Personal Data, please contact us using the contact details provided at the end of this Privacy Notice. International Transfers of Data. Any data that you provide to us may be accessed, shared, or processed by our offices, located in the United States, and service providers located in the United States, if such data transfer is necessary for the specific purpose for which you submitted your data (such as the provision of goods or services under a written contract). This may entail a transfer of your Personal Data across international borders. The data protection standards may differ and be lower than the standards enforced in your jurisdiction. We maintain appropriate safeguards as required by applicable law for any Personal Data transferred internationally. Data Privacy Frameworks & International Transfers of Data . We may transfer information from or about you or your devices to countries other than the country where you are located (including to the United States), which may not have the same data protection laws as your jurisdiction. For more information regarding our compliance with the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework to authorize these data transfers, please review the following disclosures. We comply with the EU-U.S. ” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ These Terms apply to you differently depending on how you interact with kapa. We have four categories of users: Casual Visitors, External Users, Internal Users (where your employer has licensed kapa under an Enterprise Agreement), and Subscribers (which includes Authorized Users accessing the Services through a Subscriber entity’s account). The table below gives you a quick overview; full details are in the Sections that follow.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ 1.1 What kapa Does. kapa is an AI-powered question-and-answer platform. When you submit a question, kapa searches and synthesizes information from relevant sources and generates a response. The sources available to you depend on your user type:” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ 2.5 Subscription Plans. A company or individual who accesses the Services under a paid subscription plan without a separate Enterprise Agreement with kapa is a “Subscriber.” If you are a Subscriber, your subscription is governed by the plan you select at signup (or as set forth in an applicable order form). kapa offers subscription plans at different usage tiers, as described on kapa’s pricing page (which kapa may update from time to time with reasonable advance notice). If your employer or organization subsequently executes an Enterprise Agreement with kapa, that agreement will supersede any conflicting provisions of these Terms as of the effective date of that agreement. 2.6 Billing and Payment. For Subscribers, kapa bills in advance on a monthly or annual basis, depending on the plan selected. Fees are due on the first day of each billing period. kapa will charge the payment method you provide at signup. You agree to provide accurate and complete billing information and to update it promptly if it changes. All fees are stated exclusive of applicable taxes; you are responsible for any sales, use, or similar taxes levied on your use of the Services. 2.7 Nonpayment and Suspension. If payment is not received when due, kapa may: (a) suspend your access to the Services (with notification via pop-up and/or sent to the email address associated with your account); and (b) terminate your subscription if payment remains outstanding for 30 days following suspension. ” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ • Internal Users: kapa also searches your employer’s internal documentation and knowledge bases, in addition to public sources.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ • External Users: kapa searches publicly available documentation provided by businesses that license kapa, together with other publicly available sources (such as public developer forums and third-party websites).” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “In that case, “Subscriber” means the entity on whose behalf you are contracting, and your acceptance of these Terms constitutes the entity’s agreement to be bound. 2.9.2 Authorized Users. As a Subscriber, you are responsible for (a) identifying and managing the individuals authorized to access the Services under your subscription (“Authorized Users”); (b) ensuring that all Authorized Users comply with these Terms; and (c) promptly revoking access for any individual who is no longer an Authorized User. Each Authorized User who accesses the Services through your account is subject to these Terms as provided in Section 2.11. 2.9.3 Account Responsibility. You are responsible for all activity that occurs under your account, including activity by your Authorized Users, whether or not you authorized it. You will promptly notify kapa at founders@kapa.ai if you become aware of any unauthorized access to or use of your account. 2.9.4 Data Handling Notice. Without an Enterprise Agreement, information submitted through your subscription is not subject to contractual confidentiality obligations on kapa’s part beyond those required by applicable law. See Section 7. kapa strongly recommends that Subscribers who require confidentiality protections for information they or their Authorized Users submit to the Services execute an Enterprise Agreement prior to such use. To the extent that you are a Subscriber and information submitted through your subscription includes personal information or personal data, you acknowledge and agree that you are the controller in respect of such information and that you instruct kapa to process such information pursuant to this Agreement and our Data Processing Addendum . ” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ No, your primary relationship is with the customer whose site you're using Governed by these Terms and any Enterprise Agreement your employer has signed Yes — these Terms apply directly to Subscribers and Authorized Users” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ IF YOUR EMPLOYER HAS AN ENTERPRISE AGREEMENT WITH KAPA, YOUR RIGHTS AND KAPA’S LIABILITY ARE AS SET FORTH IN THAT AGREEMENT, WHICH TAKES PRECEDENCE OVER THIS SECTION 10.2(c).” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ 2.1 Casual Visitors. If you are browsing kapa.ai’s website without an account, you may access publicly available website content on the kapa.ai domain. Your use of the kapa website is governed by these Terms. kapa has no ongoing obligations to Casual Visitors beyond what is set out in these Terms. 2.2 External Users. If you are using a kapa-powered AI assistant embedded on another company’s website or application, you are interacting with kapa’s technology as deployed by one of our Customers. Your primary relationship is with that Customer, not with kapa. The Customer is responsible for the configuration of its AI assistant, the documentation it has made available, and its own terms of service with you. kapa’s direct obligations to External Users are limited to those set out in these Terms. 2.3 Internal Users. You are an Internal User if your employer or organization (a “Customer”) has an Enterprise Agreement with kapa and given you an account. Your access to the Services is subject to:” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ Subscriber: company or individual subscribing to kapa under a paid plan (no Enterprise Agreement). Authorized User: individual accessing the Services through a Subscriber entity’s account.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ • Subscribers and Authorized Users: kapa searches the Subscriber’s internal documentation and knowledge bases, in addition to public sources.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “Suspension or termination for nonpayment does not relieve you of the obligation to pay all outstanding amounts, and no refund will be issued for any prepaid fees. 2.8 Auto-Renewal and Cancellation. Paid subscriptions renew automatically at the end of each billing period at the then-current rate unless you cancel before the renewal date. To cancel, notify kapa at founders@kapa.ai at least 10 days before the end of your current billing period. Cancellation takes effect at the end of the billing period in which notice is received; kapa does not provide refunds or credits for partial billing periods or unused subscription capacity, except as required by applicable law. If kapa increases subscription fees, kapa will provide at least 30 days’ advance written notice, and the increased rate will take effect at your next renewal. Continued use of the Services after a price increase takes effect constitutes acceptance of the new pricing. California subscribers: notwithstanding the foregoing, cancellation and auto-renewal rights are also governed by Cal. Bus. & Prof. Code §17600 et seq. to the extent applicable. 2.9 Subscriber Entity Obligations. The following provisions apply where the Subscriber is a company or other legal entity (rather than an individual accessing the Services solely on their own behalf). 2.9.1 Authority to Bind. If you are subscribing to the Services on behalf of a company or other legal entity, you represent and warrant that you have the legal authority to bind that entity to these Terms. ” | Captured 2026-09-25Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.