Kepaio Privacy Policy
Last updated 12 November 2026
1. Who we are
Kepaio is operated by HBS MANAGEMENT SARL AU, a Moroccan company registered under RC 150059 and ICE 00 351 5007000096. This policy covers kepaio.com, Kepaio accounts and workspaces, and the Kepaio plugin for ChatGPT. It explains what personal information we process, why we process it, who receives it, and how you can exercise your rights.
HBS MANAGEMENT SARL AU is the controller of personal information it processes for its own purposes, including account administration, service security, and support. Where an organization determines how personal information in its workspace is used and Kepaio processes that information on its instructions, that organization is the controller and Kepaio acts as its processor. An organization’s own privacy notice may also apply.
2. Information we process and why
| Category | What it can include | Why we use it |
|---|---|---|
| Account and sign-in | Email address, account identifier, sign-in and account-linking information, and profile details supplied through your sign-in method | Create and authenticate your account, connect it to ChatGPT when you authorize the connection, and send account notices |
| Workspace and app content | App configurations, fields, records, files you upload or import, and content submitted through a plugin action | Store and display your apps and records, run requested actions, and support features you use |
| Collaboration and publishing | Invitations, workspace membership and roles, shared app or template information, and reports about published content | Manage permissions, enable sharing, and review abuse reports |
| Technical and operational information | Request identifiers, timestamps, errors, and action or access events where recorded | Diagnose failures, protect accounts, investigate incidents, and maintain the service |
| Subscription information | Plan, subscription status, and transaction references provided by the billing provider when you purchase a plan | Enable paid features, resolve billing issues, and maintain required transaction records |
| Support and privacy requests | Your contact information, messages, and material you choose to send us | Respond to you, investigate issues, and handle requests about your information |
We receive information from you, authorized members of your workspace, and services you connect or use, such as your sign-in provider or ChatGPT. We also generate some operational information when the service runs. Please provide only information needed for the action or request.
Where applicable law requires a legal basis, we process information as necessary to provide the service you request and perform our agreement with you, comply with legal obligations, pursue legitimate interests such as service security and abuse prevention where permitted, or rely on your consent where required. Where processing relies on consent, you may withdraw it without affecting processing that took place before withdrawal.
3. How Kepaio works with ChatGPT
ChatGPT provides AI capabilities. Kepaio stores the structured apps and records you create or manage through the service. OpenAI operates ChatGPT under its own terms and privacy policy.
When you link your Kepaio account, you authorize the plugin to use the permissions granted during account linking. When ChatGPT calls a Kepaio action, it can send Kepaio the information needed to perform that action, such as an app identifier, a search term, an app configuration, or the fields and values to save. Kepaio can return information to ChatGPT, such as matching records, an app view, or the result of a change. Information returned to ChatGPT may be used in the conversation and handled according to your OpenAI account settings and OpenAI’s policies.
For example, if you ask ChatGPT to add a task, the task details may be sent to Kepaio and saved in your workspace. If you ask ChatGPT to summarize your tasks, records returned by Kepaio may be processed by ChatGPT to produce the summary.
You can disconnect Kepaio through the connected-app controls in ChatGPT. Disconnecting stops access through that connection. Existing records remain in Kepaio until deleted through the applicable Kepaio controls or on request. Conversation information held by OpenAI is managed separately. See the OpenAI Privacy Policy.
Do not enter payment card details, passwords, authentication codes, API secrets, or protected health information into the Kepaio plugin. Follow our Acceptable Use Policy for further restrictions.
4. Who receives information
- Infrastructure and sign-in providers. Providers supporting hosting, application storage, file storage, authentication, and service operations receive information needed for their functions.
- OpenAI. When you use the ChatGPT integration, OpenAI receives information returned by Kepaio to support the requested action or display.
- Billing providers. If you purchase through Creem, Creem processes the checkout and payment information under its own privacy policy. Kepaio uses the subscription and transaction information it receives to provide access and support. See the Creem Privacy Policy.
- Workspace members and people you share with. Workspace owners, administrators, and collaborators may access information according to their permissions. Content you publish publicly may be seen or copied by others. Review records, sample data, files, and links before publishing.
- Authorities and advisers. We may disclose information when legally required or where lawful and necessary to address fraud, protect rights or safety, or obtain professional advice.
5. International processing
Kepaio is operated from Morocco. Providers supporting the service and connected platforms may process information outside Morocco. Where a transfer is subject to data protection law, applicable transfer conditions and safeguards apply. You can contact us for information about the destinations and safeguards relevant to your data.
6. Retention, deletion, and backups
| Information | How long it is kept |
|---|---|
| Account information | While the account remains active, followed by the period needed to process closure and any applicable legal, security, or dispute obligations |
| Apps, records, and files | While retained in an active workspace or until deleted by someone with the necessary permission. Where a recovery feature applies, deleted items may remain recoverable for the period associated with that feature |
| Backups and operational logs | For the applicable backup rotation or logging period, with longer retention only where needed for an incident, dispute, or legal obligation |
| Support and abuse reports | While the issue is being handled and afterward as needed to document the outcome, address recurring abuse, or meet legal obligations |
| Billing records | For the periods required for accounting, tax, and dispute purposes. Creem applies its own retention rules to records it controls |
Use the available workspace controls to delete records or export information you are authorized to access. To request account deletion, email contact@kepaio.com. We may ask for information reasonably necessary to verify the request. Closing your account may leave records in a shared workspace that continues to operate. Copies already exported or made by authorized recipients and information held by OpenAI are handled separately.
7. Cookies and similar technologies
Sign-in and session controls may use cookies or similar technologies to keep you signed in, protect your account, and maintain essential settings. Where optional technologies are used, the relevant choices will be presented as required by applicable law. You can also manage cookies in your browser settings. Blocking essential cookies may affect sign-in and other account features.
8. Security
Access to workspace data depends on account authentication and workspace permissions. Review your invitations and permissions regularly, and contact us if you suspect unauthorized access or disclosure. Send only the information needed to investigate the issue and avoid including credentials or secrets.
9. Your privacy rights and choices
Under Morocco’s Law No. 09-08 and other applicable laws, you may have the right to access and correct your personal information and to object to certain processing. Depending on the law that applies, you may also be able to request deletion, restriction, or portability, withdraw consent, or lodge a complaint with the relevant authority.
To exercise a right, email contact@kepaio.com with the email associated with your account and a description of your request. If the information is in an organization-managed workspace, the organization may need to respond as a controller. Where appropriate, we will help direct your request. You can contact Morocco’s National Commission for the Control of Personal Data Protection (CNDP) about processing subject to Moroccan law.
10. Children’s privacy
The Kepaio plugin is not directed to children under 13. Eligibility and parental consent requirements are described in our Terms of Use. If you believe a child has provided personal information in circumstances that do not meet applicable requirements, contact us so we can review it.
11. Changes and contact
We will update the date at the top of this page when the policy changes. We will provide additional notice of material changes where required and request consent when applicable law requires it.
HBS MANAGEMENT SARL AU
Place La Liberté, Angle Avenue My El Hassan et Avenue Med V, Rés Berdai, Immeuble B, Appartement 2, Guéliz, Marrakech, Morocco
Publication director : Othmane El Ouarzazi
Privacy contact : contact@kepaio.com