KIDGE Privacy Policy

Version 2.1 — Effective Date: October 12, 2026

This English version is provided for reference only. In the event of any inconsistency, the Traditional Chinese version prevails.

KIDGE Ltd. (格界科技有限公司; "KIDGE", "the Company", "we", or "us") has adopted this Policy in accordance with the Personal Data Protection Act of the Republic of China (Taiwan) (the "PDPA") and other applicable data protection laws. It explains how we collect, process, use, and protect your personal data. This Policy applies to all users of the KIDGE service (kidge.io, app.kidge.io, related subdomains, and APIs; the "Service"), including Customers, Authorized Users, and External Participants.

1. Our Role

Personal data in the Service falls into two categories depending on its source, and the Company's role differs for each:

1.1Data for which the Company is the collector: your account data (name, email, organization, job title), billing and transaction records, usage records, and your correspondence with the Company. For this data, the Company is the "collector" under the PDPA (equivalent to a controller), and this Policy applies in full.

1.2Data for which the Company is the processor: content uploaded by Customers or generated within projects (including contracts, drawings, valuation documents, messages, Confirmed Records, and any personal data they contain, such as the names and confirmation records of Authorized Users and External Participants' personnel). For this data, the Customer is the collector, and the Company processes it on the Customer's instructions (including the Customer's settings in the Service) under the Terms of Service and the Data Processing Addendum. If you are an Authorized User or External Participant, please exercise your rights regarding your personal data within project content with the Customer that invited you; the Company will assist the Customer in responding.

2. Notice under Article 8 of the PDPA

In accordance with Article 8 of the PDPA, the Company provides the following notice when collecting your personal data:

2.1Name of the collector: KIDGE Ltd. (格界科技有限公司).

2.2Purposes of collection (by specific-purpose code published by the Ministry of Justice):

  • 069 Contracts, quasi-contracts, and other legal relationships
  • 090 Consumer and customer management and services
  • 040 Marketing
  • 104 Account management and receivables
  • 129 Accounting and related services
  • 135 Information and communication services
  • 136 Information, communication, and database management
  • 137 Information and communication security and management
  • 063 Collection, processing, and use of personal data by non-government agencies in fulfillment of legal obligations

2.3Categories of personal data:

  • C001 Identifying individuals (name, email, account identifier, IP address)
  • C011 Personal description (language preference, time zone)
  • C038 Occupation (job title, organization)
  • C101 Business activities of the data subject (actions and confirmation records within the Service)
  • C102 Agreements or contracts (subscription plan, Order Form)

2.4Period, territory, recipients, and methods of use:

  • Period: the duration of the collection purpose, the retention periods set out in this Policy, or the retention periods required by law.
  • Territory: the Republic of China (Taiwan) and the operating locations of the sub-processors described in Section 6 (primarily the Asia-Pacific region (including Japan), the United States, and Europe).
  • Recipients: the Company and the sub-processors described in Section 6; judicial or regulatory authorities where required by law.
  • Methods: collection, processing, international transfer, and use by automated or non-automated means within the scope of the purposes above.

2.5Your rights: see Section 8.

2.6Consequences of not providing data: account data (name, email, organization) is necessary to provide the Service; without it, an account cannot be created and projects cannot be accessed. Other data is optional, and not providing it does not affect basic functionality.

3. Data We Collect

3.1Data you provide: name, email, organization, and job title provided at registration; content you provide in support or other correspondence; contact and billing details provided by enterprise Customers on an Order Form.

3.2Data collected automatically: IP address, browser and device type, login times, feature usage records, and error logs. This data is used for system operation, security, and performance optimization.

3.3Transaction data: When you pay through Paddle, payment data such as card numbers and bank account details is collected and processed by Paddle; the Company neither accesses nor stores it. The Company receives transaction summaries from Paddle (transaction ID, amount, currency, plan, payer email, and country) to manage subscription status.

3.4Cookies and usage analytics: The Service's application (app.kidge.io) uses cookies necessary to maintain login sessions and security verification, and may use usage analytics tools to record feature usage and performance metrics in order to improve the Service; no advertising or cross-site tracking cookies are used within the application. The Company's marketing website (kidge.io) may use third-party analytics and advertising performance tools and provides cookie notices and choices as required by applicable law. The tools actually in use are listed in the sub-processor list, available on request.

4. How We Use Data

  • To create and manage accounts, provide Service features, and enable project collaboration.
  • To verify identities, record the time and party of each confirmation, and maintain the integrity of Confirmed Records.
  • To process subscriptions, billing, and accounts, and respond to support requests.
  • To monitor for and prevent unauthorized access, abuse, and security incidents.
  • To send service-related notices (system updates, security alerts, billing and terms changes).
  • To improve the Service using aggregated statistics that cannot identify individuals, Customers, or projects.
  • To comply with legal obligations and respond to lawful requests from judicial or regulatory authorities.
  • To send product information and event updates to business contacts who have contacted the Company or registered; you may opt out at any time via the link in each message or by contacting support@kidge.io, after which the Company will stop sending.

The Company does not sell your personal data, does not use your data for third-party marketing, and does not use project content or the personal data within it to train machine-learning models.

5. Data Security

5.1Technical measures: encryption of data in transit and at rest; database Row Level Security to isolate data between Customers; regular encrypted backups.

5.2Access control: Company personnel access to customer data follows the principle of least privilege; user data is accessed only where necessary, such as for technical support, security audits, or legal requirements, and access is logged.

5.3Your responsibilities: You are responsible for safeguarding your login credentials. Customers are additionally responsible for managing the permission settings of their Authorized Users and External Participants.

5.4Security incident notification: Upon ascertaining a personal data breach or unauthorized access incident, the Company will promptly notify affected data subjects by appropriate means in accordance with Article 12 of the PDPA. For project content processed on behalf of Customers, the Company will notify the Customer to assist it in fulfilling its notification obligations.

6. Sub-processors

The Company engages service providers for cloud infrastructure, application deployment, payment processing, AI model inference, and email delivery to process data. Each provider undertakes, under its commercial terms, protection obligations no less stringent than this Policy, and their primary operating regions are the Asia-Pacific region (including Japan), the United States, and Europe. The named list is available to Customers on request.

The Company may add or replace sub-processors as needed for functionality (for example, additional AI model providers, usage analytics, or error monitoring tools) and will update the sub-processor list.

AI model providers or other third-party services that a Customer connects itself under the Terms of Service are not sub-processors of the Company; their data processing is governed by the agreement between the Customer and that provider.

7. Data Retention and Deletion

7.1During the subscription: The Company retains project content and account data for the duration of the Customer's subscription.

7.2After termination: Under the Terms of Service, the thirty days following subscription termination is an export period. After the export period, the Company deletes project content from production systems within thirty days. Residual data in backups is deleted in accordance with the Company's backup retention cycle.

7.3Account deletion: You may request deletion of your account. The Company will remove your login credentials and account data and de-identify non-essential personal data.

7.4Names in Confirmed Records: Your name, confirmation times, and confirmed content within locked Confirmed Records form part of the Customer's project records and audit trail. To maintain record integrity and fulfill the Company's contractual and legal retention obligations, this data is retained for as long as the project records exist and is not subject to deletion requests; it is deleted together with the project records under Section 7.2.

7.5Billing records: Transaction and billing data is retained for the periods required by the Business Entity Accounting Act and tax law.

7.6Legally required retention: The minimum records required by law or necessary to evidence contract performance (for example, hash values and timestamps of Confirmed Records, excluding their content) may be retained for the statutory period.

8. Your Rights

Under Article 3 of the PDPA, you may exercise the following rights regarding personal data held by the Company as collector:

  • Inquire about or request access to your data.
  • Request a copy.
  • Request supplementation or correction.
  • Request that collection, processing, or use cease.
  • Request deletion (subject to the retention exceptions in Sections 7.4 to 7.6).

Please submit requests by email to support@kidge.io. After verifying your identity, the Company will respond within thirty days; where necessary, this may be extended by thirty days, with written notice of the reason. A reasonable cost-based fee may be charged for copies. Under Articles 10 and 11 of the PDPA, the Company may decline a request where necessary for the performance of its business or during a statutory retention period, and will state its reasons.

For personal data within project content, please submit requests to the Customer that invited you; the Company will assist in accordance with the Customer's instructions.

9. International Transfers

The Service uses infrastructure located outside the Republic of China (Taiwan) (see Section 6). By using the Service, you acknowledge that your data may be transferred to and processed in those regions. The Company ensures that such transfers comply with Article 21 of the PDPA and other applicable data protection laws.

10. Disclosure Required by Law

Upon receipt of a request from a judicial or regulatory authority made through lawful procedures, the Company may provide the relevant data to the extent required by law. Unless prohibited by law, the Company will notify the affected Customer before disclosure.

11. Minors

The Service is intended solely for business and professional use and is not offered to persons under eighteen years of age. The Company does not knowingly collect personal data from persons under eighteen; if it becomes aware of such collection, it will delete the data.

12. Changes to This Policy

The Company may amend this Policy. For amendments that materially affect your rights, the Company will provide notice by email or within the Service at least thirty days before they take effect. Amended versions are posted on the Company's website with their effective date.

13. Contact

KIDGE Ltd. (格界科技有限公司)

Personal data protection contact: support@kidge.io

All terms and policies← Back to home