Who controls the data depends on why it is processed.
For website visits, business contacts, account administration, security, support, billing, and our own legal obligations, KernelWright Systems LLC acts as the controller or “business.” For Customer Content processed through the Services, Kernelwright generally acts as a processor or service provider on the customer’s documented instructions.
If your data was submitted through a Kernelwright customer’s application, direct your request to that customer first. We will assist the customer as required by applicable law and our agreement. A customer agreement or data processing addendum controls if it provides stronger or more specific terms.
What we may process.
The data depends on how you interact with the Services. We collect it directly from you, from the organization that authorizes your use, automatically from service activity, from integration or marketplace partners, and from service providers supporting the relationship.
Business and account data
Name, business email, company, role, account or project identifiers, permissions, and API credential identifiers when issued.
Customer content
Prompts, input data, tool definitions or results, and generated outputs submitted through an inference request. Customers decide what they submit.
Service metadata
Model and endpoint identifiers, timestamps, request size and shape, token counts, latency, status, error class, retries, rate-limit events, and accounting identifiers.
Connection and security data
IP address, user agent, requested URL, authentication events, and signals needed to deliver, defend, and troubleshoot the Services.
Commercial data
Service-plan, order, invoice, billing-contact, and transaction records when a customer purchases Services.
Communications
Sales, support, privacy, and security correspondence, including information and attachments a person chooses to provide.
Why we process personal data.
We use personal data to deliver and route inference requests; authenticate and administer access; measure performance, capacity, reliability, and usage; enforce limits and terms; prevent fraud and abuse; provide support; bill customers; communicate about the Services; comply with law; and establish or defend legal claims.
Contract
Provide the Services, administer access, support users, measure usage, and manage billing.
Legitimate interests
Secure and operate the Services, prevent abuse, improve reliability, support customers, and manage business relationships.
Legal obligation
Meet tax, accounting, regulatory, lawful-process, and recordkeeping requirements.
Consent
Send optional marketing or use non-essential technologies if we introduce them and consent is required. Consent can be withdrawn at any time.
Where Kernelwright acts as a processor, the customer determines the lawful basis and we process the data under its instructions.
Customer content is not our training corpus.
Kernelwright processes Customer Content to provide the requested inference response and related customer-directed functions. We do not use Customer Content to train or fine-tune models, build advertising profiles, or market to individuals. Customer Content is not retained by default or included in operational telemetry.
If a customer expressly enables a feature that requires storage, submits content to support, or instructs us to perform another persistent operation, that processing is limited to the instruction and governed by the customer agreement.
The Services generate model outputs in response to customer-directed requests. Kernelwright does not use personal data about website visitors or customer users to make solely automated decisions that produce legal or similarly significant effects. Customers control how they use model outputs.
Limited recipients, limited purposes.
We may disclose personal data to infrastructure, hosting, networking, security, observability, communications, billing, support, and professional service providers that need it to perform services for us; to the customer organization controlling the relevant account or request; to advisers subject to confidentiality duties; when law or safety requires it; or in a corporate transaction subject to appropriate protections.
Service providers and subprocessors are restricted by contract to authorized purposes. We do not sell personal data for money or other valuable consideration, share it for cross-context behavioral advertising, or use it for targeted advertising. We do not offer financial incentives tied to personal data.
Keep less. Keep it for less time.
We retain personal data only as long as reasonably necessary for the purpose collected, considering its sensitivity, contractual commitments, security needs, and legal obligations.
Not stored by default. It is processed for the duration needed to complete the request and is not placed in operational telemetry. Customer-directed storage or support submissions are governed by the applicable agreement and instruction.
Kept only for the period reasonably necessary to operate, secure, troubleshoot, meter, and defend the Services, then deleted or de-identified.
Kept while the relationship is active and afterward only as needed for contractual, tax, accounting, dispute, and legal obligations.
Kept until the matter is resolved and for a limited period afterward to document the response, protect rights, and meet legal requirements.
Removed through normal backup-expiration cycles after the source data is deleted, unless law requires preservation.
Protection follows the data.
Kernelwright and its service providers may process personal data in countries other than the country where it was collected. Where applicable law requires a transfer safeguard, we use a recognized mechanism such as an adequacy decision, the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum or Agreement, or another valid mechanism.
You may request information about an applicable transfer safeguard at privacy@kernelwright.dev, subject to lawful redactions.
Security supports minimization.
We use administrative, technical, and organizational safeguards designed for the nature and sensitivity of the data processed. These include access restrictions, service isolation, secure communications, secrets controls, monitoring, and incident-response practices appropriate to the Services. No system or transmission method can guarantee absolute security.
Report suspected vulnerabilities or security incidents to security@kernelwright.dev.
One request channel, rights recognized globally.
Depending on your location and subject to legal exceptions, you may have the following rights:
- Access or obtain a copy of personal data
- Correct inaccurate personal data
- Delete personal data
- Restrict or object to processing
- Receive portable data where applicable
- Withdraw consent where consent is the basis
- Opt out of sale, sharing, targeted advertising, or qualifying profiling
- Limit qualifying uses of sensitive personal data
- Appeal a refusal to act on a request
- Receive equal service without unlawful discrimination
Email privacy@kernelwright.dev with your request and relationship to Kernelwright. We may request information reasonably necessary to verify identity and authority and will use it only to process the request. Authorized agents may submit requests where permitted. To appeal a decision, use the subject “Privacy Appeal.”
If we process the data solely for a customer, we may direct the request to that customer or assist it in responding. Individuals in the EEA or UK may also complain to the supervisory authority where they live, work, or believe a violation occurred.
California and other state privacy rights.
Where an applicable U.S. state privacy law covers Kernelwright, residents may exercise the rights described above. The following notice describes categories processed during the preceding 12 months and also serves as our California notice at collection. “Sold or shared” uses the broad meanings assigned by California law.
| Category | Examples | Source | Purpose | Recipient categories | Sold/shared |
|---|---|---|---|---|---|
| Identifiers | Business contact details, IP address, account and project identifiers | Directly from you or automatically from use | Service delivery, security, support, account administration | Infrastructure, security, communications, and support providers | No |
| Customer records | Contact, account, invoice, and billing-contact information | Directly from you or your organization | Contract administration, support, billing, compliance | Billing, professional, and support providers | No |
| Commercial information | Services purchased, usage, invoices, and transaction records | Directly from you and service activity | Service delivery, accounting, customer administration | Billing and professional providers | No |
| Internet or network activity | Device, browser, endpoint, request, performance, and security metadata | Automatically from use | Delivery, reliability, capacity, fraud and abuse prevention | Infrastructure, observability, and security providers | No |
| Professional information | Employer, role, and business relationship | Directly from you, your organization, or professional sources | Sales, support, contracting, relationship management | Communications and professional providers | No |
| Communications and submitted content | Support messages and Customer Content a customer chooses to submit | Directly from you or a customer | Responding to requests and providing customer-directed inference | Infrastructure and support providers as necessary | No |
| Sensitive personal information | Only if a customer chooses to include it in Customer Content or credentials qualify under applicable law | Directly from you or a customer | Providing the requested service, authentication, security | Infrastructure and security providers as necessary | No |
We do not knowingly sell or share personal data of people under 16. Because we do not sell or share personal data or use it for targeted advertising, a “Do Not Sell or Share” link is not required for our current practices. We honor legally recognized opt-out preference signals where applicable to processing that is subject to opt-out.
No behavioral advertising layer.
Our website and edge providers may use strictly necessary technologies to deliver pages, balance traffic, prevent abuse, and maintain security. We do not use advertising pixels or third-party technologies for cross-site behavioral profiles. If we introduce non-essential analytics or similar technologies, we will update this Policy and provide any consent or choice required by law.
Browser “Do Not Track” signals are not governed by a uniform standard. We respond to legally recognized opt-out preference signals where required.
Built for organizations, not children.
The Services are intended for business users and are not directed to children under 13. We do not knowingly collect personal data directly from children under 13. If you believe a child submitted personal data in a context requiring parental consent, contact us so we can investigate and take appropriate action.
Connected systems have their own rules.
The Services may link to or interoperate with applications, tools, data sources, and destinations controlled by customers or third parties. Their privacy practices are governed by their own notices. Customers are responsible for the systems they connect to the Services and the instructions they provide.
Material changes will be visible.
We may update this Policy as our Services, practices, or legal obligations change. We will post the revised version at kernelwright.dev/privacy and update the date above. Where law requires it, we will provide additional notice before a material change takes effect.