Kimura SCM Privacy Policy

Effective Date: July 26, 2026

This Privacy Policy describes how Kimura Software Inc. ("Kimura", "we", "our", or "us") handles personal information in connection with Kimura SCM software, the official Kimura SCM website, software downloads, and communications with Kimura.

1. Scope
This policy applies to the Kimura SCM desktop applications, command-line tools, server software, official website, software distribution channels, and support interactions.

It does not govern the independent privacy practices of customers, administrators, OpenID Connect (OIDC) providers, or other third parties.

2. No Telemetry Collection
Kimura SCM does not collect or transmit telemetry, usage analytics, crash reports, advertising identifiers, or behavioral tracking data.

3. Customer-Controlled Deployment Data
Kimura SCM is self-hosted source control software. Repository content, metadata, user and account identifiers, comments, attachments, and other information stored or transmitted through a customer-operated Kimura SCM deployment remain within systems selected and administered by that customer.

Kimura does not receive or control customer deployment data merely because the Software is used. Customers and their administrators determine what information their deployments process, who may access it, and how it is secured, retained, and deleted.

Kimura may receive deployment data only when a customer voluntarily provides it to Kimura, such as when requesting support. Customers should not provide repository content, credentials, access tokens, private keys, or other sensitive information unless it is necessary for an agreed support purpose and appropriate safeguards are in place.

4. Information Provided Directly to Kimura
When you contact Kimura, request support, or otherwise communicate with us, we may receive:

    4.1. Your name, email address, organization, and contact details.
    4.2. The content of your request and our related correspondence.
    4.3. Logs, configuration details, screenshots, or other diagnostic material that you choose to provide.

Kimura uses this information to respond to inquiries, provide support, administer its business relationship with you, protect its rights and systems, and comply with legal obligations.

5. Website and Download Information
When you visit the official Kimura SCM website or download software, Kimura and its website or distribution service providers may process limited technical information needed to deliver and secure those services. This may include an Internet Protocol address, browser or device information, request date and time, requested page or file, and security logs.

This operational website and download information is separate from the Software. The Software does not transmit it to Kimura.

6. Product Network Communications
The Software makes network requests needed for product operation only to services selected or configured by you or your administrators. These may include:

    6.1. Connections to configured Kimura servers for authentication and source control operations.
    6.2. Connections to configured file servers for file and attachment transfers.
    6.3. Connections to configured OIDC providers for sign-in, when OIDC is enabled.

Information sent to a customer-selected OIDC provider is also subject to that provider's privacy practices.

7. Local and Customer-Hosted Data
Depending on the components and features used, Kimura SCM may store workspace metadata, caches, settings, logs, protected login information, OIDC session information, and certificate references on local devices or customer-administered servers.

Kimura does not have access to this information unless it is voluntarily provided to us. You and your administrators control the applicable devices and servers, including their security, access controls, backup, retention, and deletion practices.

8. Sharing and Disclosure
Kimura does not sell or rent personal information.

Kimura may disclose personal information that it receives directly:

    8.1. To service providers that support website hosting, software distribution, email, security, or business operations, subject to appropriate confidentiality and data-protection obligations.
    8.2. To professional advisers where reasonably necessary.
    8.3. Where required by law, regulation, legal process, or a lawful government request.
    8.4. Where reasonably necessary to protect the rights, safety, and security of users, Kimura, or others.

9. Retention and Deletion
Kimura retains personal information it receives directly only for as long as reasonably necessary for the purposes described in this policy, to meet legal or accounting obligations, to resolve disputes, or to protect Kimura's rights and systems. Kimura securely deletes the information when it is no longer required.

Retention of information in customer-operated deployments and on local devices is controlled by customers, administrators, and users.

10. Security
Kimura uses reasonable administrative, technical, and organizational measures to protect personal information in its custody or control. No method of storage or transmission can be guaranteed to be completely secure.

Customers and administrators are responsible for securing the environments in which they install and operate Kimura SCM.

11. International Processing
Personal information provided directly to Kimura may be processed in Quebec or in other jurisdictions where Kimura's service providers operate. Privacy laws in those jurisdictions may differ from those in your jurisdiction. Where required, Kimura assesses such processing and uses contractual or other safeguards appropriate to the information.

Customer deployment data is stored in the locations selected by the customer and its administrators.

12. Your Privacy Rights
Subject to applicable law, you may request access to or correction of personal information Kimura holds about you. You may also ask about its use and disclosure, withdraw consent where processing is based on consent, request deletion where applicable, or request a portable copy of eligible computerized information.

You may also submit a privacy question or complaint. Kimura may need to verify your identity before completing a request.

These requests apply to personal information in Kimura's custody or control. Requests concerning a customer-operated Kimura SCM deployment should be directed to the customer or administrator responsible for that deployment.

13. Changes to This Policy
Kimura may update this Privacy Policy from time to time. Kimura will update the effective date and publish or otherwise provide notice of changes as required by applicable law. Material changes will be communicated through an appropriate channel before they take effect where required.

14. Privacy Officer and Contact
Kimura Software Inc.
Attn: Privacy Officer
Saint-Lambert, Quebec, Canada
info@kimurascm.com
