Privacy Policy

Last updated: 26 July 2026

This Privacy Policy explains how CC Conceptualise GmbH, Kolonnenstraße 8, 10827 Berlin, Germany (“kanros”, “we”, “us”) processes personal data in connection with the kanros website and platform. We are the controller for the processing described here. It is written to align with the EU General Data Protection Regulation (GDPR).

1. Privacy at a glance

• The kanros CLI runs entirely on your machine and does not phone home — it sends no telemetry, usage data, or traces to us.
• Kanros Cloud stores customer data in Microsoft Azure, Italy North (EU). Sign-in is handled by Clerk and billing by Stripe (see our Sub-processors).
• We do not sell personal data and do not use it for advertising.

2. Data we collect

Depending on how you use kanros, we may process:

• Account data — your email address, name where provided, organisation, and authentication identifiers, so we can create and secure your account.
• Traces and telemetry you send — evaluation runs, spans, model requests/responses, and metrics that you choose to upload to the hosted platform. These may contain personal data if you include it in your prompts or test data.
• Memory content — stored context, notes, and artefacts you save to the platform.
• Provider API keys — if you add your own model provider keys (e.g. OpenAI, Anthropic) to a project, we store them encrypted at rest (AES-256-GCM), use them only to make the model calls you request from the hosted platform, never show them again after saving (only their last four characters), and delete them when you remove them or delete the project or your account.
• Usage and log data — technical information such as IP address, timestamps, request metadata, and error logs generated when you use the hosted platform, used to operate and secure it.
• Billing data — where you subscribe to a paid plan, contact and transaction details processed through our payment provider (we do not store full card numbers).
• Communications — messages you send us, e.g. support requests or waitlist sign-ups.

For traces, telemetry, and memory content that constitute personal data of your own end users, we generally act as a processor on your behalf under our Data Processing Addendum; you are the controller for that data.

3. Why we process data and lawful bases

• To provide the Service (account creation, hosting your data, delivering features) — performance of a contract, Art. 6(1)(b) GDPR.
• To secure and improve the Service, prevent abuse, and maintain logs — our legitimate interests, Art. 6(1)(f) GDPR.
• To handle billing and comply with tax/accounting obligations — contract and legal obligation, Art. 6(1)(b) and (c) GDPR.
• To send service or, where permitted, product communications — legitimate interests or your consent, Art. 6(1)(f) or (a) GDPR. You can opt out at any time.

4. Where data is stored

5. Retention and deletion

We keep personal data only as long as necessary for the purposes above. Customer Data in Kanros Cloud (traces, eval results, red-team reports) is kept for the retention period of your plan and then deleted automatically:

• Free: 14 days
• Pro: 90 days
• Team: 365 days

Deleted data disappears from backups once the 30-day backup window has passed. You can delete individual runs or projects at any time, and you can ask us to delete your organisation and account by emailing support@kanros.dev; we complete such requests within 30 days, including removal from Clerk. When a subscription ends, Customer Data is deleted as described in the DPA. Billing records are kept for the periods required by German tax and commercial law (generally up to 10 years). Operational logs are kept for a limited period for security and troubleshooting.

6. Sharing and sub-processors

We share personal data with vetted service providers who process it on our behalf: Microsoft Azure (hosting, EU), Clerk (authentication) and Stripe (billing). A current list is on our Sub-processors page. We may also disclose data where required by law or to protect our rights. We do not sell personal data.

7. International transfers

We host Customer Data in the European Union (Azure, Italy North). Clerk processes account identity data in the USA, and Stripe may process billing data in the USA. Where a sub-processor processes data outside the EU/EEA, we rely on an adequacy decision or on the European Commission’s Standard Contractual Clauses (SCCs) together with supplementary measures, as referenced in our Data Processing Addendum.

8. Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict, and port your personal data, and to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time without affecting prior processing. To exercise these rights, contact us at support@kanros.dev. If your personal data is held by us as a processor on behalf of a customer, we will refer your request to that customer. You also have the right to lodge a complaint with a supervisory authority, such as the Berlin Commissioner for Data Protection and Freedom of Information.

9. Cookies

The website uses only strictly-necessary cookies and local storage required to operate the site and remember your cookie choice. We do not use advertising or cross-site tracking cookies. If we introduce any analytics in future, we will request consent first.

10. Security

We apply technical and organisational measures to protect personal data, including encryption in transit and at rest, access controls, and tenant isolation. See our Security overview for details.

11. Changes

We may update this Policy from time to time; the “Last updated” date above reflects the current version. Material changes will be communicated through the Service or by email.

12. Contact

CC Conceptualise GmbH
Kolonnenstraße 8, 10827 Berlin, Germany
Privacy enquiries: support@kanros.dev
Company / legal: mbrahim@conceptualise.de