Legal
Privacy Policy
How we collect, use, and protect your personal data
Correction, 21 September 2026. The processor table in §6 previously gave our Google Cloud hosting location as "EU (europe-west1) and US (us-central1)". That was wrong. We have never operated any European Union region. Our infrastructure has been entirely in the United States throughout, which is what §7.2 has always said; the §6 table row contradicted it and was the error. We have corrected §6 and §7.2 to state the regions we actually use. This correction describes practice that has not changed — it grants us no new permission and removes no protection — so it takes effect immediately rather than on notice, because we will not leave a statement we know to be false in place for a notice period. It does not alter the 4 October 2026 effective date below. Details are in Change history.
The substantive v1.2 changes take effect on 4 October 2026. Version 1.1 (effective 19 July 2026) remains in force until then. We are publishing v1.2 in advance because it materially narrows a commitment in §2.4, and §12 of this policy commits us to thirty days' notice before such a change takes effect. Registered account holders have been notified by email. What changed, and why, is set out in Change history.
Your privacy matters. Kongen Labs is committed to protecting your personal data in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Norwegian Personal Data Act (personopplysningsloven), and other applicable data protection legislation. This Privacy Policy explains what data we collect, why we collect it, how we use it, and what rights you have.
1. Data Controller
Kongen Labs is the data controller responsible for the personal data collected through the Service. You can contact us regarding data protection matters at:
- Data Protection Contact: [email protected]
- General Contact: [email protected]
- Postal Address: Kongen Labs, 11160 South Lakes Drive, Reston, VA 20191, USA
- Website: kongenlabs.life
If you believe we have not adequately addressed your data protection concerns, you have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) at datatilsynet.no, or with the supervisory authority in your EU/EEA member state of residence.
2. Data We Collect
2.1 Account Information
When you register for the Service, we collect:
- Email address — used for authentication, billing notifications, and service communications.
- Name or organisation name — used for account identification and billing.
- Password — stored in hashed form only; we never store plaintext passwords.
- Account creation date and plan selection.
2.2 Billing Data
When you subscribe to a paid Plan, our payment processor Stripe collects:
- Credit card or payment method details (held by Stripe, not by us).
- Billing address.
- Transaction history and invoice records.
Kongen Labs receives from Stripe: a token representing your payment method, the last four digits of your card, card brand, expiry date, billing address, and transaction status. We do not receive or store your full card number, CVV, or banking credentials.
2.3 API Usage Metadata
When you make API requests, we collect the following metadata:
- Timestamp of each request.
- API endpoint called (e.g.,
/v1/logic/score). - Token cost of the request.
- HTTP response status code.
- Response latency (milliseconds).
- API key identifier (hashed).
- IP address of the request origin.
- User-Agent header.
2.4 What we keep, and what we don't
We don't store your prompts or your code. We do receive them — we have to, to score a request — and we process them in memory and drop them. They are never written to a database, a cache, a log, a trace, or an error report. Paths you list in .kongenignore are never sent to us at all.
Where your code goes, plainly. To route a request we receive the text of your prompt — and in an agent loop, a prompt often contains code. That happens on every model call, which makes routing the place where most of your content reaches us. Checking your changes works differently: the check calls your AI provider directly from your machine, under your own key, the findings are put together there, and what reaches us is the summary described below. Your provider key never leaves your machine at any point.
What we keep is counts. When a check runs, we record which model ran, what kind of task it was, whether the check passed, what category of finding came up, how many retries it took, and what it cost. Every field comes from a fixed list we publish. There is no free-text field in it, and we test that in our build rather than just saying it here — so your code cannot end up in that record, even by accident.
We don't train models on your content. Not on your prompts, not on your code. We use the counts above, pooled across customers, to get better at picking the right model for the job — and you get the benefit of everyone else's counts the same way. You can switch it off, and the product works the same.
We do store some things about you — just not your work. Your account details, your billing records, and usage metadata for every API call: what it cost, when, which endpoint, the status code. That is what your bill is made of. Sections 2.1 to 2.3 list those field by field, and section 8 says how long we keep each one.
2.5 Website Analytics Data
When you visit our website (kongenlabs.life), we may collect:
- Pages visited and navigation path.
- Referring URL.
- Browser type and version.
- Device type and screen resolution.
- Geographic location (country/region level, derived from IP address).
- Session duration.
2.6 Communications Data
If you contact us via email, support forms, or other channels, we retain the content of those communications for the purpose of responding to your inquiry and improving our Service.
2.7 Flow — Local-First Storage and Prompt Transmission
Flow is a local-first application: your conversation history — your prompts and the answers you receive — is stored on your device, not on Kongen Labs servers. We do not hold a copy of your Flow conversations.
Local-first storage does not mean your prompts never leave your device. To route each request and produce an answer, the text of a prompt is transmitted over the network at the moment you send it, to two recipients:
- To Kongen Labs — routing and scoring. The prompt text is sent to our routing endpoint (
/v1/logic/score) so we can assess the reasoning depth it calls for and recommend an appropriate model and token budget. This scoring is performed by pattern-based routing that runs transiently, in-process, in memory: the prompt text is analysed to produce the routing decision and is then discarded. We do not log, store, cache, retain, or train on the content of your Flow prompts (see §2.4). What we retain is routing metadata only — for example the detected reasoning regime, a confidence value, and the model selected — together with the standard API usage metadata described in §2.3 (timestamp, endpoint, token cost, response status, latency, hashed key identifier, request-origin IP address, and User-Agent). Routing metadata does not contain your prompt text. - To the AI provider whose key you supplied — answer generation. To generate the answer, your Flow app sends your prompt directly to the third-party AI provider you have configured with your own API key. That provider receives your prompt under your own key and account and handles it as an independent controller, under its own privacy policy and terms. Kongen Labs does not route this call and does not control, and is not responsible for, how a provider you configure retains or uses prompts sent under your key. You should review the privacy policy of any AI provider before connecting it. See §6.2.
2.8 Free grants and key minting — fraud- and abuse-prevention identifiers
When you mint a Flow key or claim a free grant of Kongen Tokens — whether or not a referral is involved — we derive and store hashed technical identifiers to detect and prevent abuse of our free tiers (for example automated or bulk key creation, or claiming the same free grant more than once) and, where a referral is involved, self-referral, where a person attempts to earn referral rewards by inviting themselves.
At the moment a Flow key is minted, we compute and store one-way hashed (SHA-256) identifiers rather than the underlying values, on the Flow key record:
- A hash of the request-origin IP address (
mint_ip_hash). - Where your client provides one, a hash of an optional device identifier (
mint_device_id_hash). This identifier is optional; minting functions without it.
We store only the hashes — we do not retain the raw IP address or device identifier alongside them, and a hash cannot be reversed back to the original value. These mint-time hashes are used solely for fraud and abuse prevention and are retained as described in §8.
If you participate in the Flow referral program, the mint-time hashes of the inviter and the invitee are additionally recorded on the referral record (inviter_mint_ip_hash, invitee_mint_ip_hash, and, where available, inviter_device_id_hash, invitee_device_id_hash) and compared to decide whether a referral reward may be released: if an invitee's hashed IP or device identifier matches the inviter's, the reward is blocked as a suspected self-referral. The legal basis for all of the above processing is our legitimate interest in preventing fraud and abuse (GDPR Art. 6(1)(f); see §3).
2.9 Kongen Loop
What is transmitted. To route a request, the text of your prompt is sent to our routing endpoint. Both it and anything else you send us are processed transiently in memory and are not stored — we do not log, cache, or retain them, and they never enter our logs, traces, or error reports. Paths you list in .kongenignore are never transmitted at all.
The check runs on your machine. Kongen Loop calls your AI provider from your own machine, using your own API key. Your change goes to that provider directly, under your own account and their terms — not through us. We never receive your provider keys. The findings are assembled on your machine, and what is sent to us is the outcome summary below.
What is retained, and why. When a check completes we record its outcome: the class of task, a complexity bucket, which model produced the change, the programming language, a size bucket, whether the check passed, the categories of any findings, how many retries were needed, cost and latency. It contains no code, no file names, no identifiers, and no text taken from your repository. Every field is drawn from a fixed list we publish; there is no free-text field in the record, and we test that property in our build rather than merely asserting it here.
We use those records, pooled across customers, to improve model selection — which model actually produces changes that pass verification, for which kind of task. You benefit from every other customer's outcomes the same way. You can turn this off at any time in the command-line tool, in your dashboard, or by asking us; the product works the same either way.
Contributing an example. Occasionally a failure does not fit any category we have a name for. We will sometimes ask whether you want to send us that specific change so we can define one. That is off by default, always a separate question about a specific artifact, and never a condition of using Loop. If you contribute one and later revoke it, we delete it — but if it has already informed a category definition, deleting it does not remove that definition. That is why we ask rather than assume.
3. Legal Basis for Processing
Under GDPR Article 6, we process your personal data on the following legal bases:
| Data Category | Legal Basis | GDPR Article |
|---|---|---|
| Account information | Contract performance | Art. 6(1)(b) |
| Billing data | Contract performance | Art. 6(1)(b) |
| API usage metadata | Legitimate interest (service operation, billing, abuse prevention) | Art. 6(1)(f) |
| Tax and accounting records | Legal obligation | Art. 6(1)(c) |
| Website analytics | Legitimate interest (service improvement) | Art. 6(1)(f) |
| Onboarding and product-lifecycle emails | Legitimate interest — opt-out link in every message | Art. 6(1)(f) |
| Marketing communications | Consent | Art. 6(1)(a) |
| Security logs (IP, User-Agent) | Legitimate interest (security, fraud prevention) | Art. 6(1)(f) |
| Flow mint & referral fraud-prevention identifiers (hashed IP/device) | Legitimate interest (Flow key-minting abuse and self-referral prevention) | Art. 6(1)(f) |
Where we rely on legitimate interest, we have conducted balancing tests to ensure our interests do not override your fundamental rights and freedoms. You may request a copy of our legitimate interest assessments by contacting [email protected].
4. How We Use Your Data
We use the personal data we collect for the following purposes:
- Service delivery: Authenticating your requests, metering token usage, enforcing rate limits, and providing API responses.
- Routing and model selection: Analysing the text of a prompt transiently, in memory, to detect the reasoning depth it calls for and recommend an appropriate model and token budget. The prompt content is discarded after the routing decision is made; only routing metadata is retained (see §2.7).
- Billing: Processing payments, generating invoices, managing subscriptions, and handling refunds.
- Service communications: Sending transactional emails (billing receipts, account alerts, security notifications, API deprecation notices).
- Security and abuse prevention: Detecting and preventing fraudulent use, unauthorized access, denial-of-service attacks, abuse of the free Flow key tier (such as automated or bulk key minting), self-referral and other abuse of our referral program, and violations of our Terms of Service and Acceptable Use Policy.
- Service improvement: Analysing aggregate usage patterns to improve performance, reliability, and features. This analysis uses anonymised and aggregated data wherever possible.
- Legal compliance: Maintaining tax records, responding to lawful requests from competent authorities, and fulfilling our legal obligations.
- Marketing: With your explicit consent, sending product updates, feature announcements, and promotional communications. You may withdraw consent at any time.
5. Cookies and Tracking Technologies
5.1 Cookies We Use
We categorise cookies as Essential (required for the Service to function, including the consent cookie itself), Analytics (site performance, A/B tests), and Advertising / Sale & Sharing of Personal Information (retargeting, cross-context behavioral advertising).
| Cookie | Purpose | Category | Duration |
|---|---|---|---|
| Session cookie | Dashboard authentication | Essential | Session |
| CSRF token | Cross-site request forgery protection | Essential | Session |
kongen_consent |
First-party cookie that stores your consent decision (accepted / rejected / custom) | Essential | 12 months |
_ga |
Google Analytics — distinguishes users | Analytics | 13 months |
_ga_G-MKQPHJ7WH8 |
Google Analytics — persists session state | Analytics | 13 months |
| Advertising / retargeting cookies (first- and third-party, set only after consent) | Cross-context behavioral advertising, retargeting, paid acquisition measurement | Advertising / Sale & Sharing of Personal Information | Up to 12 months (first-party); third-party retention varies by provider |
_gcl_au |
Google Ads conversion linker (first-party) — tracks conversion events for paid acquisition measurement | Advertising / Sale & Sharing of Personal Information | 90 days |
_gcl_aw |
Google Ads click tracking (first-party) — persists ad click identifier for attribution | Advertising / Sale & Sharing of Personal Information | 90 days |
_gcl_dc |
Google Ads display tracking (first-party) — display campaign attribution | Advertising / Sale & Sharing of Personal Information | 90 days |
5.2 Cookie Consent
Essential cookies are set without consent as they are required for the Service to function. For Analytics and Advertising cookies, we request your consent via a cookie banner when you first visit the website. You can manage your preferences at any time via the Privacy Settings link in the website footer, or by clearing your kongen_consent cookie in your browser settings.
5.3 Consent Governance
Analytics and Advertising consent is governed by the cookie banner shown on your first visit and by the Privacy Settings link in the website footer. You may update or withdraw your preferences at any time using either mechanism.
When you decline cookies, Kongen Labs still sends Google a small, redacted ping containing no personal identifiers or precise location data. Google uses this aggregate signal to model overall measurement quality without identifying you individually. This is the standard pattern Google designed ("Consent Mode v2 Advanced") for sites operating under GDPR / CCPA. This redacted ping does not constitute Sale or Sharing of Personal Information under the CCPA/CPRA because it contains no personal identifiers and is not used for cross-context behavioral advertising.
5.4 Notice of Right to Opt Out of Sale/Sharing
California residents have the right to opt out of the sale or sharing of personal information for cross-context behavioral advertising under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). To exercise this right, click the Do Not Sell or Share My Personal Information link in the website footer, or click Reject All in the cookie banner. Either action will stop all non-essential tracking, including any sharing of personal information with advertising partners. This opt-out applies to Advertising cookies. Analytics consent is governed separately under §5.2.
6. Third-Party Data Processors
We share personal data with the following third-party processors, each of whom processes data on our behalf under written data processing agreements:
| Processor | Purpose | Data Shared | Location |
|---|---|---|---|
| Stripe, Inc. | Payment processing | Billing data, payment method, transaction details | USA (EU SCCs) |
| Google Cloud Platform | Infrastructure hosting | Account data, usage metadata (encrypted at rest and in transit) | USA only — us-central1 (compute and primary storage) and us-east1 (additional storage). No European Union region is in use. (EU SCCs) |
| Cloudflare, Inc. | CDN, DDoS protection, DNS | IP addresses, request headers (transient processing) | Global — requests are transiently processed at the point of presence nearest the visitor, which may be inside or outside the EEA (EU SCCs) |
We do not sell, rent, or trade your personal data to any third party. We do not share personal data with third parties for their own marketing purposes.
6.1 Sub-Processor Updates
We maintain an up-to-date list of our sub-processors. If we engage a new sub-processor, we will update this Privacy Policy and, for Enterprise customers with a DPA, provide advance notice as specified in their agreement.
6.2 AI Providers You Configure (Bring-Your-Own-Key)
When you use Flow with your own AI provider API key, the AI provider you select is not a Kongen Labs sub-processor. Your Flow app sends your prompt directly to that provider under your own key and account, and the provider acts as an independent controller of the data you send it, under its own privacy policy and terms. The sub-processors listed in the table above are those who process data on our behalf; AI providers you configure are not among them, and we do not control how they retain or use prompts sent under your key. We encourage you to review the privacy policy of any AI provider before connecting it. See §2.7 for how prompt text is transmitted.
The same applies to Kongen Loop. The AI provider that performs a Loop check is not a Kongen Labs sub-processor: Loop calls it from your own machine using your own API key, so that provider receives your content under your own account as an independent controller, under its own terms. We do not route that call and do not control how a provider you configure retains or uses what you send it. See §2.9.
7. International Data Transfers
7.1 Transfer Mechanisms
Some of our third-party processors are located outside the European Economic Area (EEA). Where personal data is transferred to countries not deemed to provide an adequate level of data protection by the European Commission, we ensure appropriate safeguards are in place:
- Standard Contractual Clauses (SCCs): We use the European Commission's approved SCCs with processors in the United States (Stripe, Google Cloud, Cloudflare).
- EU-U.S. Data Privacy Framework: Where processors are certified under the EU-U.S. Data Privacy Framework, we rely on that certification as an additional safeguard.
- Supplementary measures: We implement additional technical measures (encryption in transit and at rest, pseudonymisation, access controls) to supplement transfer mechanisms.
7.2 GCP Data Residency
Our primary infrastructure runs on Google Cloud Platform, entirely within the United States. Compute and primary storage are in the us-central1 region; some storage buckets are in us-east1. Account data and usage metadata are encrypted at rest using Google-managed keys. We do not operate any European Union region today, and we do not currently offer EU-only data residency. We are evaluating it for customers who require it. Contact [email protected] if EU data residency is a requirement for your organisation.
The same region applies to content we process rather than store: content transmitted to our API — for example prompt text sent to the routing endpoint — is processed in us-central1 and is not stored (see §2.4 and §8). If we introduce processing in another region we will update this section. Kongen Loop checks call your AI provider from your own machine, so where that processing happens is determined by the provider you configure, not by us.
8. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:
| Data Category | Retention Period | Reason |
|---|---|---|
| Account information | Duration of account + 30 days after deletion | Service delivery + grace period for reactivation |
| Fraud- and abuse-prevention identifiers (keyed pseudonymised email hash) | Up to 12 months after account deletion | Duplicate-signup, free-tier re-grant, and ban-evasion prevention (legitimate interest, Art. 6(1)(f)) |
| Billing and transaction records | 7 years after the transaction | Norwegian Bookkeeping Act (bokforingsloven) tax obligations |
| API usage metadata | 12 months | Billing reconciliation, abuse detection, service improvement |
| Security logs (IP, User-Agent) | 90 days | Security incident investigation |
| Flow mint fraud-prevention identifiers (hashed IP/device, on the Flow key record) | Life of the Flow key record | Flow key-minting abuse prevention (legitimate interest, Art. 6(1)(f)) |
| Referral fraud-prevention identifiers (hashed IP/device, on the referral record) | Life of the referral record | Self-referral and referral-abuse prevention (legitimate interest, Art. 6(1)(f)) |
| Website analytics | 12 months (anonymised) | Service improvement |
Consent decision cookie (kongen_consent) |
12 months | Record of consent (accountability) and to avoid re-prompting on every visit |
| Advertising / retargeting cookies | Up to 12 months (first-party); third-party retention varies by provider | Cross-context behavioral advertising, retargeting (only set after consent) |
| Support communications | 2 years after resolution | Quality assurance, dispute resolution |
| Marketing consent records | Duration of consent + 3 years | Proof of consent (accountability) |
| API request content (prompts, source code, diffs) | Not stored | Received and processed transiently in memory; never written to storage, logs, traces or error reports |
| Check outcome records (counts only; published closed schema, no content) | 12 months at event level; indefinite once aggregated and no longer attributable to an account | Improving model selection (legitimate interest, Art. 6(1)(f)) |
| Operational and error logs | 30 days, payload-free by design | Reliability and incident investigation |
| Contributed samples (opt-in only) | Until you revoke | Defining new finding categories (consent, Art. 6(1)(a)) |
| Free-grant fraud-prevention identifiers (hashed IP/device) | Life of the grant record | Free-tier abuse prevention (legitimate interest, Art. 6(1)(f)) |
After the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with you.
9. Your Rights Under GDPR
As a data subject, you have the following rights under the GDPR. To exercise any of these rights, contact us at [email protected]. We will respond to your request within thirty (30) days, or inform you if an extension is needed.
9.1 Right of Access (Art. 15)
You have the right to obtain confirmation of whether we process your personal data, and if so, to receive a copy of that data along with information about the processing (purposes, categories of data, recipients, retention periods).
9.2 Right to Rectification (Art. 16)
You have the right to request correction of inaccurate personal data and completion of incomplete personal data. You can update most account information directly through the dashboard.
9.3 Right to Erasure (Art. 17)
You have the right to request deletion of your personal data when: (a) the data is no longer necessary for the purpose it was collected; (b) you withdraw consent (where consent is the legal basis); (c) you object to processing and there are no overriding legitimate grounds; (d) the data was unlawfully processed. We may retain data where we have a legal obligation to do so (e.g., tax records for 7 years).
9.4 Right to Restriction of Processing (Art. 18)
You have the right to request that we restrict processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or have objected to processing pending verification of our legitimate grounds.
9.5 Right to Data Portability (Art. 20)
You have the right to receive your personal data in a structured, commonly used, and machine-readable format (JSON), and to transmit that data to another controller. This right applies to data processed on the basis of consent or contract performance through automated means. You can export your usage data via the dashboard or by request.
9.6 Right to Object (Art. 21)
You have the right to object to processing based on legitimate interest, including profiling. Upon objection, we will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms. You have an absolute right to object to processing for direct marketing purposes.
9.7 Right to Withdraw Consent (Art. 7(3))
Where we process data based on your consent (e.g., marketing communications), you may withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing performed before withdrawal. You can withdraw consent by clicking the unsubscribe link in any marketing email, updating your preferences in the dashboard, or contacting us directly.
You may withdraw cookie consent at any time via the Privacy Settings link in the website footer, or by clearing your kongen_consent cookie in your browser settings.
9.8 Right to Lodge a Complaint
You have the right to lodge a complaint with a supervisory authority. The lead supervisory authority for Kongen Labs is the Norwegian Data Protection Authority (Datatilsynet). You may also lodge a complaint with the supervisory authority in your EU/EEA member state of habitual residence or place of work.
9.9 Automated Decision-Making
The Service performs automated scoring and pattern analysis. These automated processes produce Output (scores, classifications, recommendations) but do not make decisions that produce legal effects or similarly significant effects on you. The Output is informational and is intended to inform your own decision-making. If you believe automated processing is affecting you in a significant way, you may contact us to request human review.
10. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:
- Encryption in transit: All data transmitted between your systems and the Service uses TLS 1.2 or higher.
- Encryption at rest: Data stored in our databases and cloud infrastructure is encrypted using AES-256.
- Access controls: Access to personal data is restricted to authorised personnel on a need-to-know basis, with multi-factor authentication required.
- Infrastructure security: Our GCP infrastructure uses IAP-only SSH access, firewalled networks, and container isolation.
- API key hashing: API keys are stored in hashed form; the plaintext key is shown only once at creation time.
- Payment data isolation: Credit card and banking details are handled exclusively by Stripe and never touch our servers.
- Regular review: We periodically review our security measures and update them to address new threats.
Despite these measures, no method of electronic transmission or storage is 100% secure. If you discover a security vulnerability, please report it to [email protected].
11. Children's Privacy
The Service is not directed at children under the age of sixteen (16). We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16 without verifiable parental consent, we will take steps to delete that data promptly. If you believe a child under 16 has provided us with personal data, please contact us at [email protected].
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes:
- We will update the version number and effective date at the top of this document.
- We will notify registered users via email at least thirty (30) days before material changes take effect.
- We will post a prominent notice on the dashboard.
We encourage you to review this Privacy Policy periodically. Previous versions are available upon request.
Change history
Version 1.2.1 — published 21 September 2026, effective on publication. Correction of fact.
The third-party processor table in §6 gave our Google Cloud Platform location as "EU (europe-west1) and US (us-central1)". No European Union region has ever been used to host this Service. The statement was inaccurate from the moment it was published, and we are recording that plainly rather than quietly amending the row.
The same document said the opposite in §7.2, which has consistently described our hosting as us-central1. The policy's intent was therefore accurate; one table cell was not, and the internal contradiction is how the error was eventually found. We have corrected §6 to name the regions actually in use — us-central1 for compute and primary storage, us-east1 for additional storage — and expanded §7.2 to state explicitly that we operate no European Union region and do not currently offer EU-only data residency. We have also replaced the Cloudflare row's "Global (EU-proxied)" description, which asserted a European processing restriction we do not have, with a plain description of how a global content delivery network handles a request.
Nothing about where your data is held has changed as a result of this correction, and nothing we are permitted to do with it has changed. If the location of processing matters to your organisation, and you relied on the previous wording, please contact [email protected] and we will address it directly.
Version 1.2 — published 4 September 2026, effective 4 October 2026.
Version 1.1 said, in §2.4: "We do not use your API request content for any purpose other than fulfilling your specific request." That sentence was written for our scoring endpoints, but it was not scoped, so it read as a promise about the whole service. It also appeared a second time in the §8 retention table as "API request content — Not retained."
We are building a product, Kongen Loop, in which the outcome of a code check — which model ran, whether it passed, what category of problem came up — feeds back into which model we recommend next. No code is retained to do that, but it is a use of information derived from a request beyond fulfilling that one request. So the v1.1 sentence would have become false the moment Loop processed anyone's work.
We changed the wording before shipping the product rather than after. §2.4 has been rewritten to say what we keep instead of listing what we do not, because a promise about a published list of fields can be checked and a promise about everything we will never do cannot. §8 has been corrected to match. We also disclosed two things v1.1 omitted: our operational and error logs, and the fraud-prevention identifiers attached to free token grants (v1.1 covered only Flow keys). §2.9 is new and describes Loop in full; §6.2 and §7.2 were extended to cover it.
Nothing in v1.2 permits us to store your prompts or your source code, and nothing in it permits training a model on your content. Both remain excluded.
13. Data Protection Officer
Given our current scale of operations, we have not appointed a formal Data Protection Officer (DPO) under GDPR Article 37. However, all data protection inquiries are handled by our dedicated privacy team. As our operations grow and if appointment becomes mandatory, we will designate a DPO and update this section accordingly.
For all data protection inquiries, please contact:
- Privacy Team: [email protected]
- Response time: We aim to acknowledge all privacy inquiries within 48 hours and provide a substantive response within 30 days.
Contact
If you have questions or concerns about this Privacy Policy or our data practices, please contact us:
- Privacy inquiries: [email protected]
- Security reports: [email protected]
- General inquiries: [email protected]
- Website: kongenlabs.life