Privacy Policy
How we collect, use, and protect your data when using KudiBot services.
Information We Collect
We collect information that you provide directly to us, including: • For managers who open the dashboard: Discord user ID and public profile (username, display name, avatar). There is no KudiBot password: managers, coordinators and members sign in with a one-time link from /kudime • Workspace/guild information and configuration settings • Kudos data (givers, receivers, timestamps, optional reasons and, for message kudos, a link to the message) • If the server enables them: reward amounts calculated from kudos, and AI-generated member profiles • Usage statistics (command usage, interaction patterns) KudiBot cannot read your messages. It only uses Discord's Guilds and Guild Message Reactions intents; the text of your messages is never received or stored. Report text and tasks are stored only when the server turns on "Store reports and tasks"; otherwise /kudireport text is posted to Discord and not stored by KudiBot. Tasks registered with /kuditask (link, summary and time) are stored to report tasks and hours per project. Members can see, edit and delete their own tasks with /kudibot or their portal. We collect this information to provide, maintain, and improve our services.
How We Use Your Information
We use the information we collect to: • Provide and maintain KudiBot services • Process kudos and show your server's kudos ranking • Send technical notices and support messages • Improve our services through analytics and usage patterns • Ensure security and prevent abuse • Comply with legal obligations We do not sell or rent your personal information to third parties.
Data Storage and Security
We implement appropriate technical and organizational measures to protect your personal information: • Data is stored securely in MongoDB with encryption at rest • Dashboard sign-in links are single use, expire after 10 minutes and are stored only as a hash • JWT tokens are used for secure authentication • Regular security audits and updates • Access controls and role-based permissions We regularly review our security practices to ensure your information is protected.
Data Sharing
We do not sell or rent your personal information to third parties. We may share your information with service providers who assist us in operating our service, but only to the extent necessary to provide the service.
Organizations and HR data
KudiBot is also a platform for organizations. When an organization turns on KudiHR, its administrators store employee records (profiles, time off, attendance, documents, goals and reviews) and the organization is the controller of that data; KudiBot processes it on its behalf. Personal and sensitive fields are encrypted, access follows the roles and permissions the organization sets, sensitive reads are logged, and files are kept in the storage the organization chooses. We send emails only for sign-in links, invitations, notifications and password resets. The organization chooses retention periods and can export or delete its data; people can ask their organization for access, correction or deletion. Our staff can only access an organization's data as its support access setting allows, and every access is logged. This text is a draft pending legal review.
AI Processing (optional, per server)
AI features are off by default. A server's admins can turn them on with their own AI provider key (DeepSeek, Google Gemini, Anthropic or OpenAI). When they do: • Only text members wrote to KudiBot is sent: kudos reasons and, if the standup digest is on, /kudireport answers and, if task insights are on, /kuditask summaries. Discord messages are never read or sent • Names and Discord IDs are replaced with placeholders (U1, U2…) before sending, and amounts of money are removed • The provider processes this data under its own terms and privacy policy, chosen and paid for by the server; KudiBot has no AI key of its own • Unless the server turns on "Store reports and tasks", report text is held only until the AI interprets it, then deleted. KudiBot keeps only short interpretations (themes, focus areas, blocker topics) for up to 90–365 days, as the server configures • Mood is only ever shown as a team aggregate, never per person. AI output never scores, ranks or judges people • Members are told when their report is summarized by AI. With /kudime each member can see their own AI profile, delete their AI data, or exclude themselves from AI processing in that server
Your Rights
You have the right to: • Access your personal information • Correct inaccurate or incomplete data • Delete your account and associated data • Request a copy of your data • Object to processing of your data • Withdraw consent for data processing • File a complaint with data protection authorities To exercise these rights, contact us at hello@kodffe.com. We will respond within 30 days.
Cookies and Tracking
We use cookies and similar tracking technologies to track activity on our service and hold certain information. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent.
Browser extension
The KudiBot browser extension (Chrome and Edge) only talks to the KudiBot API. It keeps on your device a connection token for your account, the organization you picked and, until you close the browser, your KudiBot AI conversation. It sends only what you type or choose in it (tasks, daily reports, time off requests, kudos, chat messages) to the same organization you use on the web, where the rules in this policy apply. It does not read the pages you visit, your tabs or your browsing history, has no tracking or ads, and its data is never sold. You can disconnect it at any time from My account → Browser extension or from the extension itself; the token stops working right away.
KudiBot for Slack
When an organization adds KudiBot's official Slack app to its workspace: • What we read from Slack: the workspace name and id; each person's Slack id, name and confirmed email (to link them to their KudiBot account; people without a matching member are not stored); emoji reactions in conversations KudiBot is in (who reacted, the message author and the emoji, never the message text); what people type in KudiBot's slash commands and modals; the messages people send to KudiBot in its Messages tab (only that direct message, to answer it); and the list of channels, to choose where KudiBot posts • What we never read: channels, private channels, group DMs or other direct messages. KudiBot has no permission to read their history • What we store: the bot token (encrypted), the link between each Slack account and its KudiBot member, the other emails people add to their account (My account → Other emails) or that their organization's HR adds, used only to recognize their Slack account and never to sign in, short-lived one-time links (10 minutes) for people who link their Slack account themselves, the channels chosen in the settings, ids of KudiBot's own posts (to update or thread them), and the kudos, reports and tasks people submit, as organization data. The assistant keeps the last messages of a conversation in memory for 30 minutes and does not store them. Slack ids, workspace and channel names are never sent to AI providers • Data we receive and do not use: Slack sends request metadata (such as trigger and response ids) with every command and button; it is used only to answer that request and is not stored • Retention and deletion: when the app is removed from the workspace or its token is revoked, the token is deleted at once, and the people links, channel settings and Slack references (message links, post ids) are deleted after 30 days unless the app is added again. When an admin disconnects Slack in Settings → Apps, they are deleted right away. Kudos, reports and tasks stay with the organization under its retention settings, without their Slack references • Requests: people can ask their organization's admins, or us at hello@kodffe.com, for access, export or deletion of their data
Children's Privacy
Our service is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.
Changes to This Policy
We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date.
Contact Us
If you have any questions about this Privacy Policy, please contact us at hello@kodffe.com or through our community.
Questions About Your Privacy?
If you have any questions about our Privacy Policy or how we handle your data, please contact us.