Kiloclaw procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | medium | “The Services are hosted in the United States and the personal information we collect will be stored and processed on our servers in the United States. Our employees, contractors and affiliated organizations that process information for us as described above may be located in the United States or in other countries outside of your home country which may have different data protection standards to those which apply in your home country.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Where your personal information is transferred outside of the EEA, Switzerland and UK and where this is to a country which is not subject to an adequacy decision by the EU Commission or considered adequate as determined by applicable data protection laws, we will take steps to ensure your personal information is adequately protected by safeguards such as Standard Contractual Clauses (“SCCs”) approved by the EU Commission or by the UK Government. A copy of the relevant mechanism can be obtained for your review on request by using the contact details in the 'Contacting Kilo Code About Your Privacy' section of this Privacy Policy.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “Once deletion is confirmed, your Kilo account, prompts, conversation history, and account metadata are removed from Kilo's systems. Data already shared with third-party AI providers to generate responses is governed by those providers' retention policies, including those linked from the OpenRouter model list and the providers' own privacy documentation. Sentry retention varies by data type and plan; errors, session replays, uptime data, and attachments are generally retained for 30 to 90 days, logs, profiles, crons, application metrics, and most spans are generally retained for 30 days, and some sampled span data may be retained for up to 13 months on Business or Enterprise plans. AppsFlyer user-level raw data retention varies by integration type and partner requirements; raw data is typically available to advertisers during a 90-day access window, and aggregated data is retained for up to 25 months.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Data Retention & Deletion : We retain this data as long as your Kilo Code account is active. You may request the deletion of your Google data at any time by deleting your account. You can also revoke our access to your data at any time through your Google Account Security settings.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Users can request account deletion from their profile in the Kilo App. Users may also request account deletion by emailing support@kilo.ai .” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ You can request account deletion by emailing support@kilo.ai . If you use the Kilo App, you can also request account deletion from your profile in the app. Once deletion is confirmed, your Kilo account, prompts, conversation history, and account metadata are removed from Kilo's systems. Data already shared with third-party AI providers to generate responses is governed by those providers' retention policies, including those linked from the OpenRouter model list and the providers' own privacy documentation. Sentry retention varies by data type and plan; errors, session replays, uptime data, and attachments are generally retained for 30 to 90 days, logs, profiles, crons, application metrics, and most spans are generally retained for 30 days, and some sampled span data may be retained for up to 13 months on Business or Enterprise plans. AppsFlyer user-level raw data retention varies by integration type and partner requirements; raw data is typically available to advertisers during a 90-day access window, and aggregated data is retained for up to 25 months.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ Kilo Code will retain your information for as long as your account is active or as needed to perform our contractual obligations, provide you services through the Services, to comply with legal obligations, resolve disputes, preserve legal rights, or enforce our agreements. For Google user data, we retain the data as long as your Kilo Code account is active, subject to deletion if you remove your account or revoke our access through your Google Account Security settings. Retention periods will be determined taking into account the type of information that is collected and the purpose for which it is collected, bearing in mind the requirements applicable to the situation and the need to destroy outdated, unused information at the earliest reasonable opportunity. We may rectify, update or remove incomplete or inaccurate information, at any time and at our own discretion. For more information on our retention periods you can contact us using the details in the 'Contacting Kilo Code About Your Privacy' section of this Privacy Policy.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Kilo Code only shares your personal information with those of its employees, contractors, and affiliated organizations that (i) need to know that personal information in order to process it on Kilo Code's behalf or to provide services available as part of the Services, and (ii) that have agreed not to disclose it to others.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Prompts and conversation content are sent to the AI provider you select per request, routed through OpenRouter. This information is used only to generate the response.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Sentry - Crash reporting and performance monitoring. Does not receive prompt or conversation content.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Account ID and request metadata are sent to Kilo Gateway, our backend, for authentication, request routing, and billing reconciliation.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ App events and attribution data are sent to AppsFlyer. This information is used to measure app performance and understand which channels bring new users. It does not include prompt or conversation content.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may aggregate all information (including your personal information) collected from the Services for our own statistical and analytics purposes and share such aggregated information with third parties for our own promotional purposes (e.g. by publishing a report on trends in the usage of the Services).” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Legal Requirements . We may disclose personal information to government authorities or other third-parties if required to do so by law or in the good faith belief that such action is necessary to: (a) comply with a subpoena, court order or similar legal obligation, (b) protect and defend our rights or property, (c) act in urgent circumstances to protect the personal safety of users of any App or the public, (d) protect against legal liability, (e) to investigate fraud or other unlawful activity, or (f) or as otherwise required or permitted by law.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Anthropic, OpenAI, Google, and other AI providers - Generate AI responses to your prompts. The specific provider used for each request depends on the model you select.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “OpenRouter - Routing layer that forwards your request to the AI provider you select per request, including Anthropic, OpenAI, Google, xAI, Mistral, Meta, and other providers listed at https://openrouter.ai/models . OpenRouter and the downstream providers are bound by data protection terms equivalent to those described in this policy. Anthropic, OpenAI, Google, and other AI providers - Generate AI responses to your prompts. The specific provider used for each request depends on the model you select.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Service Providers and partners . Kilo Code engages a number of service providers or partners to manage or support certain aspects of our business operations on our behalf. For instance, we currently use the following service providers who will handle your personal information:” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ to enforce compliance with our terms of use and other policies or otherwise in connection with legal claims, compliance, regulatory and investigatory purposes as necessary (including disclosure of such information in connection with legal process or litigation);” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Third-Party Software. The Service may link to, include, or incorporate third-party services and software components, including AI Models (collectively, “Third-Party Components”), including Third-Party Components that are generally available free of charge under licenses granting recipients broad rights to copy, modify, and distribute those components. Although the Service is provided to you subject to these Terms, nothing in these Terms prevents, restricts, or is intended to prevent or restrict you from obtaining Third-Party Components under the applicable third-party licenses or to limit your use of Third-Party Components under those third-party licenses. Additional terms may apply to your use of Third-Party Components, and you are solely responsible for reviewing and understanding those terms. Unless otherwise agreed by the provider of any Third-Party Component and you, you use all Third-Party Components at your own risk.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Kilo Code may share your personal information with the third-parties listed below for the purposes that are described in this Privacy Policy or otherwise with your consent.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Kilo Code may sell, transfer or otherwise share some or all of our business or assets, including your personal information, in connection with a business transaction (or potential business transaction) such as a corporate divestiture, merger, consolidation, acquisition, reorganization or sale of assets, or in the event of bankruptcy or dissolution. In such a case, we will make reasonable efforts to require the recipient to honor this Privacy Policy.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ The app shows a consent screen on first launch describing each data flow. No data is shared with third parties until consent is granted. Users can revoke consent at any time in Settings → Privacy & data sharing.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Crash and performance diagnostics are sent to Sentry. This information is anonymous and does not include prompt or conversation content.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ to comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government authorities.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ OpenRouter - Routing layer that forwards your request to the AI provider you select per request, including Anthropic, OpenAI, Google, xAI, Mistral, Meta, and other providers listed at https://openrouter.ai/models . OpenRouter and the downstream providers are bound by data protection terms equivalent to those described in this policy.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ B. Payment Processing. FOR THE AVOIDANCE OF DOUBT, KILO DOES NOT DIRECTLY PROCESS PAYMENTS FOR ANY THIRD PARTIES. To facilitate payment for Fees and other expenses, we use Stripe and its affiliates (“Stripe”) and Coinbase and its affiliates (“Coinbase” and, together with Stripe and any other payment processors we add from time to time, the “Payment Processors”). Payment processing is subject to additional terms and conditions and policies, including privacy policies, made available by the applicable Payment Processors from time to time (collectively, the “Payment Processor Agreements”). By agreeing to these Terms, users that use the payment functions of the Service also agree to be bound by the Payment Processor Agreements, as the same may be modified by the applicable Payment Processors from time to time. You hereby authorize the Payment Processors to store and continue billing your specified payment method even after such payment method has expired, to avoid interruptions in payment for your use of the Service, in accordance with the terms of the Payment Processor Agreements and these Terms. Please contact the applicable Payment Processors for more information. Kilo disclaims all liability for your use of the Payment Processors’ services.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ AppsFlyer (mobile only) - Mobile attribution and analytics. Does not receive prompt or conversation content.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Our service providers and partners are required by contract to safeguard any personal information they receive from us and are prohibited from using the personal information for any purpose other than to perform the services as instructed by Kilo Code.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Kilo Code may disclose your personal information to professional advisors, such as lawyers, bankers, auditors and insurers, where necessary in the course of the professional services that they render to us.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Data Sharing : We do not sell your Google user data. We only share this data with trusted third-party service providers, as outlined in the "Sharing your information" section, when absolutely necessary to provide the Services. Kilo Code's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.” | Captured 2026-06-07Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ If you are accessing and using the Service as an Enterprise User (defined below), the terms of the applicable Enterprise Agreement (defined below) govern your use of the Service. In the event of a conflict between these Terms and the applicable Enterprise Agreement, the terms of the Enterprise Agreement shall control.” | Captured 2026-06-08Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ F. Promotions. Any free trial, bonus Credits, or other promotional access to the Service must be used within the time specified at the time you registered for such free trial or promotion or received such Credits. At the end of the applicable promotional period, your access to the applicable Service or promotional Credits will expire. Kilo reserves the right to modify or cancel any promotion at any time.” | Captured 2026-06-08Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ General Payment Terms. You may be required to pay fees in order to access and use certain features of the Service (“Fees”), including without limitation usage fees based on your use of AI models and other third-party services (“Usage Fees”). Before you pay any Fees, you will have an opportunity to review and accept the terms (including payment terms) applicable to such features or services. Unless otherwise specifically provided for in these Terms, all Fees are quoted and payable in U.S. Dollars and are non-cancellable and non-refundable, except as required by law. The pricing and payment terms in this Section 4 are subject to any pricing and payment terms set forth in an order form or other enterprise agreement between Kilo and you (“Enterprise Terms”).” | Captured 2026-06-08Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ B. Enterprise Services. Certain Services (“Enterprise Services”) are made available only to the Authorized Users (defined below) of Organizations that have entered into an agreement with us with respect to such Enterprise Services (“Enterprise Agreement”). If you are using any such Enterprise Services, or otherwise accessing the Service subject to an Enterprise Agreement, you acknowledge and agree that additional rights and obligations set forth in the Enterprise Agreement govern your access to and use of the Service.” | Captured 2026-06-08Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ A. Price. Kilo reserves the right to determine pricing for the Service. Kilo will make reasonable efforts to keep pricing information published on the Service up to date. We encourage you to check current pricing information periodically, either within the Kilo Extension settings (Settings > Providers > under your selected model) or at https://kilo.ai/models . Kilo may change the Fees for any feature of the Service, including additional fees or charges, if Kilo gives you prior advance notice of changes, whether through the Service user interface, a pop-up notice, email, or through other reasonable means. Your continued use of the Service after the price change becomes effective constitutes your agreement to pay the new Fees. You will be responsible for all taxes associated with the Service, other than taxes based on Kilo’s net income. Kilo, at its sole discretion, may make promotional offers with different features and different pricing to any of Kilo’s customers. These promotional offers, unless made to you, will not apply to your offer or these Terms.” | Captured 2026-06-08Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ C. Subscription Service. The Service may include certain subscription-based plans with automatically recurring Fees for periodic charges (“Subscription Service”). The “Subscription Billing Date” is the date when you purchase your first subscription to the applicable Service. The Subscription Service will begin on the Subscription Billing Date and continue for the subscription period that you select on your Account (such period, the “Initial Subscription Period”), and will automatically renew for successive periods of the same duration as the Initial Subscription Period (the Initial Subscription Period and each such renewal period, each a “Subscription Period”) unless you cancel the Subscription Service or we terminate it. If you activate a Subscription Service, then you authorize Kilo or its third-party Payment Processors to periodically charge, on a going-forward basis and until cancellation of the Subscription Service, all sums accrued on or before the payment due date. Your Account will be charged automatically on the Subscription Billing Date and thereafter on the renewal date of your Subscription Service for all applicable Fees and taxes for the next Subscription Period. You must cancel your Subscription Service before it renews in order to avoid billing of the next periodic Fee (“Subscription Fee”) to your Account. Kilo or its third-party payment processor will bill the periodic Subscription Fee to the payment method associated with your Account or that you otherwise provide to us. You may cancel the Subscription Service by using the cancellation functionality made available in your billing menu or by contacting us at hi@kilocode.ai. YOUR CANCELLATION MUST BE RECEIVED BEFORE THE RENEWAL DATE IN ORDER TO AVOID CHARGE FOR THE NEXT SUBSCRIPTION PERIOD.” | Captured 2026-06-08Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ E. Kilo Pass. Kilo offers a Subscription Service model (“ Kilo Pass ”) that converts the applicable Subscription Fee to Credits (“ Monthly Credits ”) on a 1:1 basis, or otherwise as set forth at the time you sign up for Kilo Pass. Once all Monthly Credits have been used during the applicable month, Kilo Pass users may be entitled to receive additional Credits for use during such month. Upon termination or cancellation of a Kilo Pass, all Monthly Credits will remain available in your Account following such termination; provided that all promotional Credits will automatically expire at the end of the applicable month. Kilo reserves the right to modify or cancel the Kilo Pass program at any time.” | Captured 2026-06-08Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ D. Usage Fees. Usage Fees may purchase credits that can be used on the Service, including to interact with AI Models and use Kilo cloud infrastructure (“Credits”). All Credits must be used before the sooner of (i) one (1) year of the date of purchase or (ii) the deletion of your Account or other access to the Service. Credits have no cash value and are non-cancellable and nonrefundable. If you run out of Credits, you may purchase more Credits by paying additional Usage Fees in accordance with the then-current functionality of the Service.” | Captured 2026-06-08Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.