Kortyx Website Privacy and Software Telemetry Notice

1.1 Kortyx (“we” or “us”) is responsible for the website information and software telemetry it receives for the purposes described here. Privacy contact: legal@kortyx.io.

1.2 This notice covers visitors to the Kortyx website, people contacting us or subscribing to optional communications, and users of distributed software where that software sends product telemetry to Kortyx or its appointed provider. It covers received information, not every processing operation occurring inside a user's independently operated application.

1.3 Hosted Cloud account processing is described in the Cloud Privacy Notice. Personal data in customer application content is governed by the applicable DPA. The operator of a self-hosted Studio or application is responsible for its own processing and notices. Installing an SDK does not, by itself, mean Kortyx receives every prompt or trace produced by that application.

1.4 Privacy rights and purposes cannot be determined by an open-source label alone. Software licensing, optional product telemetry, browser storage and hosted-service acceptance are separate matters and may have different controls.

2.1 The website and its hosting systems process connection/request information to return pages, maintain availability and investigate abuse. This can include the source network address, requested resource, request time, protocol/browser information and response outcome. We limit retained operational information to the delivery, security and investigation purpose; application content is not collected merely because you read Documentation.

2.2 Do not place passwords, authentication tokens or sensitive application data in website URLs or public search fields. Security processing is distinct from optional website analytics. We do not use technical logs as an undisclosed substitute for marketing tracking.

2.3 The basis for proportionate website delivery and security processing is legitimate interests in making the site available and protecting it, subject to assessment and applicable terminal-storage rules. A server log and a browser tracking identifier require separate analysis; use of a first-party domain does not itself make tracking essential.

3.1 When you contact us, we receive the information you choose to include and the metadata needed to deliver and manage the communication. We use it to respond, investigate the issue and keep appropriate records. Do not include passwords, one-time codes or customer information unnecessary for the request.

3.2 The legal basis depends on the request: requested steps before entering a contract, performance of a contract with you, compliance with a particular duty, or legitimate interests in handling ordinary enquiries and protecting the service. We do not use one general contact permission to justify unrelated promotional sending.

3.3 Community discussions, public issues and contributions on a third-party platform are governed by that platform's practices. Public contributions can be visible to others and indexed independently. Contact legal@kortyx.io for private privacy matters and security@kortyx.io for security reports. Community-only product support does not make those private channels unavailable.

3.4 If someone supplies information about you in an enquiry or referral, we assess the relevant purpose and notice duties. Mentioning a person in correspondence does not authorize enrolling them in marketing.

4.1 The current public website uses necessary privacy-choice and requested display/navigation storage. Optional PostHog website events and funnels are planned but are not represented as currently enabled by this notice. Before optional collection begins, we will identify its actual event scope, identifiers, provider, retention and controls and obtain any required permission.

4.2 The selected scope is understanding website use and journeys, such as how visitors find information and move between relevant pages. Session replay is deferred. Customer prompts, outputs, traces, credentials and other sensitive payloads are excluded from the intended analytics scope; collection must be checked beyond manually declared events, including URLs and automatically captured properties.

4.3 Where consent is required, optional collection must stay disabled until the visitor chooses it. Refusing or withdrawing optional analytics must not prevent access to ordinary public content. The published Cookies and Storage Notice and verified preference control must explain how to change the choice.

4.4 No Google Analytics or session-replay integration is included in this website release. Search-management tools do not automatically place tracking software in a visitor’s browser; any future visitor-facing integration will be assessed and disclosed before collection.

5.1 Kortyx SDK, CLI and self-hosted Studio versions that include the usage-telemetry helper send bounded product-operation and feature measurements to PostHog Cloud EU by default unless disabled. The software version and its included documentation identify coverage. This collection helps understand adoption, feature use and reliability and is separate from the application traces a developer chooses to send to an observability endpoint.

5.2 Collected fields are fixed operation/feature names, success/failure/cancellation classifications, coarse duration and status buckets, approved provider/storage/transport categories and release information. Random installation or browser identifiers distinguish observations. Prompts, outputs, messages, schemas, customer IDs, workflow/tool names, URLs, credentials, raw errors and stack traces are excluded from the approved payload. Aggregation does not make every underlying record anonymous; network infrastructure still receives a source IP.

5.3 In a Node installation, a random identifier is created lazily in ~/.config/kortyx/usage-id, with an in-memory fallback where storage is unavailable. Studio browsers use local storage at kortyx.usage.id, with an in-memory fallback. Browser and server identifiers are separate. The implementation does not join them into an authenticated person profile or cross-device customer funnel, and does not include session replay or automatic content capture.

5.4 Set KORTYX_USAGE_TELEMETRY_DISABLED=1 (or true) in the relevant SDK process or self-hosted Studio deployment to stop collection, identity creation and delivery; restart the affected processes/containers and reload Studio browsers. Website privacy settings do not control that installation. Clearing the local identifier resets future identification after restart/reload but does not itself request deletion of data already received. The debug setting described with the software uses approved local records without sending them.

5.5 The relevant controller purpose is proportionate product adoption/reliability analysis, subject to a documented legitimate-interest assessment and any device-access consent required for the collection method and jurisdiction. A deployment operator must not treat an environment setting as blanket consent from all browser users. Where permission is required, collection must wait for that permission. Contact legal@kortyx.io to object or seek deletion of information we can identify without collecting unnecessary additional data.

5.6 PostHog receives the approved telemetry through its EU ingestion service. Capture requests omit cookies/referrers and request no person-profile or geolocation enrichment; that configuration is not a guarantee that providers keep no connection logs. Reports aggregate observations and can omit offline, disabled or terminated processes. The data is not used as a record of your acceptance of Cloud Terms, a marketing subscription or the contents of your application.

6.1 If you separately subscribe, we use the supplied contact details to send the promotional messages described at signup. The policy is optional consent with an accessible unsubscribe mechanism. Reading Documentation, downloading software or joining a community is not a subscription.

6.2 If you have a Cloud account, optional onboarding answers may inform marketing only where the separate signup explains and permits that use. Answering role, team-size, goal or referral questions alone does not authorize promotion. We do not use customer prompts, outputs or trace content to personalize advertising or messages.

6.3 You may unsubscribe through the message mechanism or privacy contact. Withdrawal stops promotional sending and associated consent-based personalization. We may retain minimal suppression information to honor the request and appropriate evidence of the choice under the completed schedule. Necessary service and legal messages are separate.

6.4 Promotional collection is optional and separate from ordinary enquiries and service messages. A future campaign must identify the sender and provide an effective unsubscribe mechanism before sending. Permission for messages is not a blanket authorization for undisclosed open tracking or link profiling; any such technology requires its own assessment and disclosure.

7.1 Hetzner Online GmbH hosts the website. Cloudflare provides DNS and relevant infrastructure services, including protected staging/preview access; this is not a claim that all public website traffic passes through a Cloudflare proxy. PostHog, Inc. receives the SDK/OSS telemetry described in section 5. Google Workspace handles private legal/security correspondence and its metadata; the account is purchased through Name.com. GitHub operates public community and contribution services under its own terms. Transactional service messages may use Plus Five Five, Inc. (Resend). These providers have different roles and data, and are not all customer-content subprocessors.

7.2 A self-hosted identity, consent or operational component does not create a separate external recipient merely because it has a product name. Conversely, a provider outside the application repository may still receive personal information through delivery, logging, backup or communications.

7.3 We may make a limited disclosure where required by a valid legal duty or necessary and lawful to protect rights, investigate abuse or handle claims. A proposed business transfer must be assessed separately, with appropriate confidentiality, minimization and notice. Neither scenario creates a general right to sell customer application content or use it for unrelated marketing.

7.4 Do not send private customer traces to GitHub discussions or ordinary email. If information is needed for a private investigation, we will agree the minimum necessary scope and a protected method. A disclosure through a customer-selected external link is distinct from processing by a provider appointed by Kortyx.

8.1 Core website hosting is in Finland. SDK/OSS telemetry uses PostHog’s EU region. That regional selection does not restrict all provider support, account administration or onward processing to the EU. Resend identifies primary processing in the United States. Google Workspace email and Cloudflare’s relevant edge/support operations are not represented as EU-only.

8.2 Where a restricted international transfer occurs, identify the applicable adequacy basis or safeguards and provide a way to obtain further information, subject to appropriate redaction. A future intended region must not be presented as a verified current location.

8.3 The provider agreement applicable to each activity governs its processing obligations. We assess the relevant legal entity, data flow and safeguards before relying on a restricted-transfer mechanism. Details and copies of applicable safeguards can be requested through the privacy contact, with necessary redactions.

9.1 Information is retained for the disclosed purpose and applicable obligations. An inactive account or disabled software setting does not automatically establish that previously received events have been deleted; the retention and request procedures below apply to previously received records.

Information	Retention and review criteria
Website delivery/security logs	Size-bounded container log rotation, rather than a fixed elapsed-time period; investigation extracts retained only for the identified incident or claim and reviewed at closure.
Optional website analytics	Not enabled as part of the current website disclosure; retention and controls must be disclosed before activation.
SDK/OSS telemetry	Pseudonymous events needed for release/adoption and reliability comparisons, then deletion or non-identifying statistics. Provider project settings and deletion requests must implement that purpose; opt-out stops future capture rather than erasing earlier events.
Ordinary enquiries	Resolution and necessary follow-up; unrelated attachments are removed when no longer needed. Dispute material is limited to the relevant claim period.
Privacy/security requests	Evidence needed to handle the request, demonstrate the response and resolve a complaint or security incident, with unnecessary identity evidence minimized.
Marketing	Active subscription and necessary evidence of the choice; minimum suppression information to honor withdrawal, without preserving an unnecessary promotional profile.
Recovery copies	Where covered by infrastructure backup, encrypted 14 daily / 8 weekly / 6 monthly recovery points with weekly maintenance, rather than a fixed maximum age; restricted to recovery/lawful retention.

9.2 A narrowly justified residual record is access-restricted and cannot be reused for an unrelated purpose. Restoration must respect applicable deletion instructions. The lifespan of a browser identifier is different from the retention of a received record; the Cookies and Storage Notice describes browser persistence.

10.1 Your applicable data-protection rights depend on the processing, its legal basis and your jurisdiction. They can include access, correction, erasure, restriction, portability, objection and withdrawal of consent. Marketing objections and withdrawal must be honored within their applicable scope. The request procedure and GDPR timing are described in Cloud Privacy, section 11, and are equally available for this notice's processing without a Cloud account.

10.2 Send a private request to the privacy contact, identifying the relevant website interaction, software telemetry or communication. Do not send credentials or unnecessary identity documents. If an event is linked only to a particular identifier, we may need appropriate information to locate it without collecting more personal data than necessary.

10.3 We will explain a lawful restriction on a request and available remedies where required. You may complain directly to a competent authority, including the Spanish Data Protection Agency where appropriate. Prior contact with us is not a condition of that right.

10.4 If your local law grants additional request, appeal or authorized-agent rights, contact legal@kortyx.io. We will explain the applicable procedure and any lawful limitation without requiring a Cloud subscription. This notice does not remove stronger mandatory protections.

11.1 Website information and received telemetry require proportionate access restrictions, secure handling and incident procedures. Any specific certification or security promise must be supported by verified evidence. An absolute-security guarantee is not offered.

11.2 Cloud account holders must be 18 or older. Public Documentation can be accessed without creating a Cloud account; this does not mean we knowingly seek children's information for marketing. If an issue involving a child is reported, we will assess applicable obligations and appropriate action without requesting unnecessary sensitive evidence.

11.3 Product measurements and aggregate reporting are used to understand software use, not to make solely automated employment, credit or comparable consequential decisions about visitors. Customer-built agents have their own operators and purposes. A reported account or security restriction can be raised through the private contact.

12.1 Published notices will carry versions and dates. Changes must reflect actual processing and be communicated appropriately, with additional permission obtained before a new optional purpose where required. A policy update is not a substitute for consent.

12.2 Read the Cookies and Storage Notice for browser mechanisms, the Cloud Privacy Notice for hosted accounts, and the Legal Notice for operator information. Contact legal@kortyx.io for this notice's privacy matters.