Kortyx Cloud Privacy Notice

1.1 Kortyx (“we” or “us”) is responsible for the processing for which we determine the purposes and means described in this notice. Privacy enquiries may be sent to legal@kortyx.io. See also the Legal Notice.

1.2 This notice concerns people who create or use hosted Cloud accounts, join customer organizations, contact us about Cloud or make privacy and contractual requests. Website visits and product telemetry received from distributed software are addressed in the Website Privacy and Software Telemetry Notice. An independently hosted deployment has its own operator and privacy responsibilities.

1.3 The notice distinguishes our account and operational processing from application content processed for customers. It does not ask you to consent to every activity by accepting a privacy policy. We identify the relevant purposes and legal grounds; separate permission is requested where consent is the appropriate requirement.

1.4 The Legal Notice identifies the responsible operator. No designated data protection officer or external representative is represented by the use of a generic privacy mailbox. The legal contact handles enquiries and requests and will identify an applicable representative if one is appointed.

2.1 A customer may send Cloud prompts, outputs, traces, tool events, datasets, evaluation inputs and results, and associated metadata. The customer determines the purposes of its application processing and which permitted information to submit. Kortyx processes that information as processor or subprocessor under the DPA, rather than deciding an unrelated use for the content.

2.2 We use customer content only to deliver, support and secure that customer's service. We do not sell that content, use it for advertising, train models on it or use it for unrelated product research. Information about use of Kortyx itself is subject to the separate disclosures below; calling content an “event property” does not exempt it from this restriction.

2.3 Where you interact with a customer's application, that customer's notice should explain its collection, legal grounds, integrations and choices. Contact the customer about access, deletion or other rights concerning its content. If you contact us, we will help route or handle the request as required, while protecting other people's information. Our processor role does not eliminate our own legal obligations.

2.4 The standard service is not approved for identifiable health information or other regulated categories requiring additional arrangements. The Cloud Terms set the data boundaries. These contractual restrictions do not mean that personal data cannot accidentally appear in content; minimization, secure handling and appropriate response are still necessary.

3.1 Information you provide may include your name, email address, account settings, organization details, private enquiries and optional onboarding answers. Information supplied by an organization administrator may include an invitation, membership or assigned role. We receive authentication identifiers and relevant sign-in assertions through the configured identity system.

3.2 Use of Cloud generates session and authentication identifiers, organization/project membership and role records, action timestamps, API and job outcomes, network/security metadata and contractual acceptance evidence. Necessary identity security records may include an IP address and account reference. Usage analytics has the narrower event scope in section 6; it does not receive full request bodies or customer trace content as event properties.

3.3 Optional onboarding information concerns your role, team size, intended use or goals, and how you found Kortyx. You may skip it. A referral answer does not establish that the referring person gave us permission to contact them, and free-text answers should not contain customer secrets or sensitive personal data.

3.4 Where another person supplies information about you, we use it only for the relevant purpose and provide the applicable notice, subject to lawful exceptions. We do not assume that an organization administrator can consent on your behalf to unrelated marketing or optional device tracking.

The following identifies the purposes and legal grounds for processing under the GDPR.

Activity and data	Purpose and legal ground	Effect of not providing information
Individual customer account: identity/contact details and essential settings	Perform the agreement with that individual and take requested steps before contracting	We may be unable to create or operate the requested account
Authorized user of an organization: contact details, membership, role and organization references	Legitimate interests in administering the customer's service and applying authorized access	Required membership or access functions may be unavailable
Authentication and session/security data	Appropriate legitimate interests in protecting users and the service; a specific legal obligation where actually applicable	We cannot provide requested authenticated access without essential security processing
Project and organization administration records	Deliver requested functions; contract for the individual customer or justified legitimate interests in administering an organization relationship	The affected function may not work without the relevant record
Versioned contractual acceptance and necessary evidence	Administer the agreement and pursue legitimate interests in demonstrating the agreed terms and resolving claims	Required contractual acceptance cannot be replaced by an optional privacy choice
Optional onboarding answers	Legitimate interests in understanding customer needs and tailoring onboarding, subject to assessment and objection rights	You may skip the questions without losing ordinary access
Separate marketing signup and permitted preferences	Consent to the promotional messages and personalization described at signup	No promotional subscription; core service remains available
Optional product-use events and identifiers	Consent for optional browser/device analytics where required; legitimate interests in proportionate server-side aggregate reliability measurements, subject to assessment and objection	Refusing optional analytics must not block the core service
Privacy and legal requests	Comply with applicable duties and maintain proportionate evidence of handling the request	Identity/authority details may be necessary to respond safely
Security reports and necessary service correspondence	Legitimate interests in investigation and service administration; contract or a specific duty where applicable	We may need additional facts to investigate or complete a request

Where we rely on legitimate interests, we must consider your rights and reasonable expectations and apply appropriate safeguards. You may object as described below. We do not treat every useful business activity as automatically necessary to perform a contract.

5.1 Onboarding answers are optional and account-linked. We use them within the disclosed purpose of understanding needs and personalizing onboarding. If you separately opt into marketing and the signup explains this personalization, we may also use the permitted answers to make promotional messages relevant.

5.2 Completing a survey, joining an organization or accepting Cloud Terms does not subscribe you to marketing. You may withdraw the marketing choice through the unsubscribe mechanism or private privacy contact. Withdrawal stops consent-based promotional sending and associated personalization; any continued non-marketing use must have its own disclosed and valid justification.

5.3 Necessary account, security, contractual, subprocessor and legal notices are handled separately. You may still receive them when required for the service or law even if you do not subscribe to promotional messages. We will not disguise advertising as an essential security or contractual notice.

5.4 Minimal suppression information may be retained to honor an opt-out, subject to the completed retention schedule. We do not need to retain the full promotional profile merely to avoid sending to an unsubscribed address.

6.1 PostHog Cloud EU is the provider selected for Cloud usage events and aggregate product measurements. The launch scope measures fixed operation and feature categories, outcomes, duration buckets, release versions and approved technical classifications. Random browser or installation/process identifiers are pseudonymous; they are not named account profiles or cross-device identity links. Staging and production use separate destinations. Processing remains subject to the optional-analytics controls in this section.

6.2 Analytics excludes customer prompts, outputs, trace contents, account or organization identifiers, credentials, custom resource names, full URLs, raw errors and stack traces. There is no session replay or automatic page-content capture. Capture requests omit browser cookies/referrers and request no person-profile or geolocation enrichment. Network services still receive a source IP; this is not a claim of complete anonymity.

6.3 Where optional analytics require consent, they must remain disabled until the relevant choice, and withdrawal must stop subsequent collection within that scope. Essential session/security processing has a separate purpose and assessment. The Cookies and Storage Notice will identify actual browser mechanisms and controls.

6.4 Website tracking preferences, Cloud contractual acceptance, optional onboarding and promotional permission are distinct. A change to one does not silently alter another. Server-held contract evidence is not erased simply because a browser preference cookie is deleted.

7.1 Authorized Kortyx personnel may access information only for assigned duties. Customer-content access is limited to necessary support, service operation or recovery, and security/abuse investigation. Internal Admin uses granular permissions and multifactor authentication, and records administrative actions and exports. Customer-realm identity events are also recorded. These controls are not a claim that every operator database read is recorded per content item. Internal staff access for this release is from the EU.

7.2 Authorized organization members can see the profile, membership, role, project and activity information made available to their permissions. Administration of one organization does not authorize disclosure of unrelated organizations, private correspondence or another person’s credentials.

7.3 The service providers and roles are set out below. Their access is limited to the relevant purpose and contractual safeguards. Using self-hosted Keycloak or c15t does not by itself make the software vendor a recipient of your information.

Provider	Function and information	Location context
Hetzner Online GmbH	Hosting of Cloud, databases, authentication and consent systems; includes account records and Customer Content	Core systems hosted in Helsinki, Finland
Cloudflare, Inc.	DNS, encrypted off-site recovery storage and edge processing for proxied internal administration; access/security metadata and data in the affected services	Recovery storage uses the EU R2 jurisdiction; edge and support processing must not be assumed EU-only
Plus Five Five, Inc. (Resend)	Transactional authentication, security and service email; recipient addresses, message contents and delivery metadata	Provider identifies primary processing in the United States; not the customer trace store
PostHog, Inc.	Bounded product telemetry under section 6; pseudonymous identifiers and approved usage measurements	EU Cloud ingestion/storage region; provider support and onward access assessed separately
Google Workspace	Private legal/security mailbox handling; addresses, message contents, attachments supplied by correspondents and delivery metadata	No EU-only Workspace data-region commitment is made for this account

The Workspace service is purchased through Name.com. Reseller and Google account-administration information is distinct from access to Cloud traces. Account-specific legal entities and transfer arrangements must match the operative provider agreements. Do not include unnecessary customer content in email; substantial exports use a separately authorized protected delivery method.

7.4 Customer-appointed application endpoints and model providers receive information according to the customer's configuration. Their independent processing is governed by the customer's arrangements. Where Kortyx appoints a provider for customer-content processing, the DPA and Subprocessor List apply instead.

7.5 We may disclose information where a valid legal duty requires it or where necessary and lawful to protect rights, investigate abuse or establish or defend claims. We assess the request and limit disclosure appropriately; this is not a general permission to disclose entire accounts on informal demand.

7.6 If a proposed business transfer requires disclosure or transfer of personal information, it must have a lawful basis, appropriate confidentiality and minimization safeguards, and the required notice. A sale or reorganization does not automatically authorize incompatible reuse of customer content.

8.1 Core Cloud hosting, databases, identity and consent stores are in Finland, and encrypted off-site backups use Cloudflare R2’s EU jurisdiction. Internal staff access is from the EU for this release. Transactional email uses Resend, whose primary processing is in the United States. Google Workspace and Cloudflare edge/support processing do not have a verified blanket EU-only restriction. PostHog uses its EU region. These distinctions apply to the relevant data categories, rather than relocating every Cloud trace to every listed provider.

8.2 A restricted transfer requires an applicable legal safeguard, such as a relevant adequacy decision or the appropriate contractual safeguards. We assess the actual recipient, covered processing and onward access before relying on a mechanism. You may request information about the applicable safeguards and a copy where required, subject to necessary redactions. No provider certification is represented as certification of Kortyx.

8.3 Customer-directed exports and integrations must be evaluated in their actual context. We must not describe every external model provider as a Kortyx subprocessor or assume that the customer's selection removes any obligations applicable to our transmission.

9.1 We retain information for the purposes for which it is processed and applicable legal obligations. The period depends on the information, active relationship, deletion instructions, security needs and justified claims or recordkeeping requirements. Data should not remain available for ordinary product use merely because a limited evidential record needs to be kept.

9.2 The following schedule distinguishes active data, residual records and recovery copies. A limited record retained for one purpose is not available for unrelated reuse.

Information	Retention and removal criteria
Customer Content	Kept for the active workspace and instructed service, without automatic age-based trace expiry in this release. Archive permits recovery for 30 days and then background purge; separately saved datasets and evaluation records must be included in an appropriate deletion request. DPA Annex 1 and Cloud Terms Schedule B govern exit and residual copies.
Accounts, memberships and closure	Active relationship and authorized organization administration. Closure disables access, removes sessions and optional onboarding answers, and queues identity deletion. Limited pseudonymized attribution and closure records are retained only to resolve remaining organization duties, security incidents or applicable claims.
Optional onboarding answers	Used while relevant to onboarding and understanding the active customer relationship. They are removed through account deletion, or assessed on an earlier deletion/objection request. Separate marketing withdrawal stops marketing use.
Product analytics	Pseudonymous event records are retained only for release/adoption and reliability comparisons, then deleted or reduced to non-identifying statistics. Disabling future collection does not erase earlier events; an identifiable record may be addressed through the privacy-request process. The enabled project’s actual retention setting must remain consistent with this purpose.
Identity authentication/administrative events	30-day configured retention, apart from a separately justified incident or claim record.
Operational container logs	Rotated by size and file count: up to five approximately 10 MB files per container under the current configuration. This limits volume rather than guaranteeing a fixed number of days; separate investigation extracts have their own documented purpose and retention review.
Contractual acceptance and necessary audit evidence	Minimum identity reference, accepted version/hash, act and relevant timestamps while needed to administer the agreement and resolve claims within applicable limitation periods. This does not justify keeping unrelated content or a complete marketing profile. A documented legal hold is reviewed when the matter ends.
Privacy/security correspondence	Kept through handling and any necessary follow-up, complaint or claim; unnecessary identity evidence and attachments are removed when no longer needed for that work.
Marketing signup and suppression	Subscription information while the subscription continues; minimum choice/withdrawal evidence and suppression identifiers as needed to honor the opt-out and demonstrate the choice. No continued promotional profile is needed merely to suppress sending.
Backup copies	Encrypted recovery points retained as 14 daily, 8 weekly and 6 monthly snapshots, with scheduled weekly forgetting/pruning and integrity checks. The policy is based on recovery points, not a guaranteed elapsed-time maximum. Restricted restoration must take account of deletion and restriction instructions.

9.3 Account closure, workspace archive and statutory erasure are separate. Other authorized members may retain a lawful interest in shared organization content. We will assess a request according to the relevant roles and duties rather than treating every personal-account deletion as deletion of an entire organization.

9.4 Where a legal hold or duty justifies limited retention, the retained information must remain restricted and be reviewed when the justification ends. Backup expiry is distinct from ordinary access, and restoration must take account of applicable deletion instructions. Product access windows must not be described as proof of physical deletion.

10.1 We maintain risk-appropriate technical and organizational measures described in DPA Annex 2, including authenticated access, tenant-scoped authorization, protected network connections, designated secret encryption and encrypted recovery copies. No blanket claim of encryption of every active trace field or every host volume is made. Confidentiality and incident handling apply regardless of the absence of a contractual uptime SLA.

10.2 No internet service can promise absolute protection against every event. That observation does not reduce our legal duties or excuse a failure to apply agreed safeguards. Do not send passwords, authentication codes or unnecessary sensitive content to public community channels when requesting help.

10.3 Report a suspected security issue to security@kortyx.io. Privacy requests may use the private legal contact regardless of your support plan.

11.1 Subject to the applicable law and circumstances, you may request access to your information, correction, erasure, restriction, or portability, and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. You may object to direct marketing and related profiling at any time.

11.2 Contact the privacy channel and identify the relevant account or processing without sending credentials. We may ask for proportionate information where needed to confirm identity or authority. An organization administrator's authority over shared content is distinct from an individual's rights over their own information.

11.3 For GDPR requests, the ordinary response period is one month; a permitted extension requires timely explanation. Requests are normally free, subject to the limited statutory rules for manifestly unfounded or excessive requests. If we cannot grant a request, we will explain the reason and available complaint routes as required.

11.4 You may complain to a competent supervisory authority, including the Spanish Data Protection Agency where appropriate, without first contacting us. Judicial remedies remain available. Requests about customer-controlled content may require cooperation with the customer; we will not use that distinction to ignore our own obligations.

11.5 Where your local law grants additional privacy rights, including an authorized-agent or appeal procedure, contact legal@kortyx.io and identify the right you seek to exercise. We will explain the applicable procedure and any lawful limits. We do not sell customer application content or use it for advertising. A general rights description does not waive stronger protections applicable in your jurisdiction.

12.1 We do not use customer application content to make automated eligibility, employment, credit or comparable consequential decisions about Cloud account holders. Authentication and security controls can automatically reject a session or request. You may contact us to dispute an account restriction. Decisions made by customer-built agents are the customer’s separate processing; Cloud analytics does not authorize that processing.

12.2 Optional audience segmentation for promotional relevance must stay within the disclosed marketing choice. It must not be presented as authorization to analyze customer application content. Security controls also need review where their operation has significant consequences for an individual.

12.3 Cloud account holders must be 18 or older. If we learn that an account does not meet that requirement, we will assess appropriate action and applicable data duties. This account rule is not proof that customers' application content can never concern minors; customers remain responsible for that processing within the agreed scope.

13.1 Each published notice will carry a version and date. We will communicate material changes through appropriate channels before a new purpose begins where required. Updating a notice is not itself consent to optional analytics, marketing or a new incompatible purpose.

13.2 Contractual changes, DPA changes, subprocessor notices and optional consent requests may require different procedures. Historical notices remain available to explain earlier disclosures; the current notice must describe actual current processing rather than hiding a change in a historic file.

13.3 Privacy contact: legal@kortyx.io. Operator and postal details: Legal Notice. For purely technical free-tier questions, use the identified community support channel; private privacy or security concerns do not need to be posted publicly.