Privacy policy

Last updated: October 2026

K8 HQ ("we") provides business email and related communication services. This policy explains what we collect, why, and the choices you have. Questions: privacy@k8hq.com.

What we store

• Account data: the passkey public keys you sign in with, an optional display name (yours or whatever you'd like to call the account), your project and inbox settings, and the people you add. We don't require your real name or a personal email address.
• Optional contact methods: if you add an email address or phone number, we use it only for account notices (such as low balance, paused sending or security alerts) and recovery. Without one, notices appear in the app and, once your domain is set up, in your K8 HQ inbox.
• Messages: email you send and receive through K8 HQ. Message content is encrypted at rest with a separate key for each message; header details (such as sender, recipients, subject and date) are stored so your mail apps can list messages.
• Billing data: credit balances and usage records. Payments are handled by our payment processor, which collects what it needs to process payments, prevent fraud and calculate tax (typically a billing name, email address and country). We don't store card numbers.
• Logs: security and delivery events (sign-ins, sending results, errors) used to run the service, troubleshoot problems and prevent abuse.

How we use it

• To deliver, store and send your email and provide the features you turn on.
• To protect you and other users: incoming and outgoing messages are scanned automatically for spam and malware while they are processed. Scan results are kept; message content is not kept by the scanner.
• To bill usage and keep accounts in good standing.
• We do not sell your data, show ads, or use your messages to train AI models.

AI features

AI features are optional. When you turn them on, the content needed for that feature is processed by an AI model run through Amazon Web Services under terms that prohibit using it for model training. You can see and change which rules use AI at any time.

Service providers

We use Amazon Web Services (hosting, storage, email delivery, AI models) and a payment processor for billing. They process data only to provide services to us.

Retention and deletion

We keep your data while your account is active. If a project's balance stays unpaid, its sending is blocked, then incoming mail is deferred, then the project is frozen for about 12 months with export available, then deleted. Deletion destroys the keys that protect your messages; encrypted copies in backups expire within 35 days. You can export or delete your data at any time.

Account recovery

Because you sign in with passkeys and we don't require an email address, we can't send a reset link. Keep the recovery kit you download when you create your account somewhere safe; it's how you regain access if you lose your devices.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data and to object to certain processing. Contact privacy@k8hq.com and we'll respond within 30 days.

Security

Data is encrypted in transit and at rest. Access to production systems is limited and logged.

Changes

We'll post changes here and, for material changes, notify account owners by email.