Cloud Privacy Notice

This draft notice covers the Kortyx Cloud staging beta operated by Kortyx S.L. (operator name supplied; registration not verified). It is not a production-approved privacy notice. Business/contact address, registration and tax details, and a working private legal/privacy contact are pending confirmation. Use synthetic or non-sensitive test data only. Website browser preferences are described separately at https://kortyx.io/privacy and https://kortyx.io/cookies. Independently operated SDK applications and self-hosted Studio deployments follow their operators’ data practices.

Cloud processes account identity and authentication information, sessions, organization and project metadata, access credentials, and application telemetry and evaluation configuration/results that you submit. Telemetry can include prompts, outputs and traces. Minimize what you send and do not submit credentials or personal or confidential customer data during this staging beta. Account/service operation and security are distinct from optional product research and marketing.

The proposed bases for account/service functions are performance of the requested service agreement, legitimate interests in proportionate security and abuse prevention, and legal obligations where applicable. Operator review must confirm these bases and any necessary balancing assessment. Customer application personal data requires an approved processor agreement and documented instructions. Terms acceptance records a contractual decision; it is not marketing consent, website cookie consent, or blanket consent to processing.

You may choose to provide your professional role, team size, intended use and how you found Kortyx. These self-reported answers are associated with your account for setup personalization and understanding product use. Every question may be skipped without preventing product access. Answers do not change access permissions or subscribe you to marketing email. Their final purposes, legal bases and retention need review. Publicity permission is addressed in the applicable Terms, separately from optional answers and marketing consent.

Cloud uses service providers to deliver the requested service. The public subprocessor schedule at https://kortyx.io/cloud/subprocessors is a draft awaiting verified legal entities, processing scope, locations and transfer safeguards. Customer-selected evaluation endpoints and model integrations have their own data practices. No EU-only processing promise or certification is made by this draft.

Retention periods for account data, telemetry, security records, acceptance evidence and backups require confirmation before production publication. Cloud account/workspace controls and the applicable Terms describe staging deletion and recovery. Acceptance evidence remains separate from workspace deletion to preserve the version accepted; its lawful retention period requires review. Do not infer immediate deletion from every backup copy or an approved production retention schedule.

Depending on applicable law you may have rights of access, correction, erasure, restriction, portability and objection, and to complain to the competent supervisory authority. Where processing relies on consent, withdrawal does not invalidate earlier lawful processing. A verified private privacy-request channel must be supplied before production publication. Do not post personal data in public GitHub discussions or issues. Operator information and contact status are available at https://kortyx.io/legal and https://kortyx.io/contact#private-contact.

Each release has a permanent version URL and content hash. The convenient current URL may point to a later draft. Viewing a notice never records acceptance. Material changes to purposes, recipients or retention require a new reviewed release and any independently required user choices.