Privacy Policy & Data Rights

This Privacy Policy explains how Akaitto ("we", "us", "our") collects, uses, stores, and protects personal data when you use our platform. We apply data minimization and describe the product behavior currently implemented in the Service.

1. Data We Collect

1.1 Account and Organization Data

Name, email address, username, and organization information provided during registration or account administration. If you use social login (Google or GitHub), we receive the profile information permitted by that provider. We also process organization memberships, roles, two-factor authentication settings, sessions, and notification preferences.

1.2 Workflow, Agent, and Deployment Data

Workflow and agent configurations, nodes, edges, triggers, prompts, deployment settings, schedules, API endpoint metadata, tool permissions, and execution status. Depending on your configuration, execution and agent records may include input/output metadata, messages, tool-call logs, traces, spans, errors, costs, and performance data.

1.3 Knowledge Base and File Data

Documents and files you upload to Knowledge Bases or other platform features are stored and may be parsed, chunked, embedded as vectors, and indexed to provide search and retrieval. The original content may be retained with the associated records until you delete it or the applicable retention policy removes it. You are responsible for ensuring uploaded data complies with your organization's data-handling policies.

1.4 AI Interaction, Evaluation, and Training Data

When you run a workflow, agent, evaluation, or training job, data is processed according to the model, provider, tool, and deployment configuration you select. We process the prompts, files, parameters, datasets, feedback, evaluation results, model metadata, and operational records required to provide those features.

We do not use customer data to train Sinaps-owned general models without your direction. If you explicitly use Training or Fine-Tuning features, the selected data is processed for that job and may be sent to the configured provider or infrastructure. Provider terms, retention, and logging behavior may differ by provider.

1.5 Governance and Compliance Data

The Compliance module may store organization-scoped questionnaires, framework applicability results, controls, findings, remediation information, safe evidence references, decision history, and related actor and timestamp metadata. It is designed for operational review and does not replace legal advice or certification.

1.6 Technical, Security, and Audit Data

IP address, browser and device information, request identifiers, session information, and security telemetry used for authentication, rate limiting, abuse prevention, reliability, and platform stability. Audit records may include the actor, organization, action, resource, timestamp, IP address, user agent, and request identifier.

1.7 Billing and Payment Data

Billing details are processed by Stripe or the payment service identified at checkout. We do not store full payment-card numbers on our application servers. We store subscription, plan, seat, credit, usage, invoice, and payment-event references needed to administer billing and quotas.

1.8 Product Analytics Data

When analytics consent is enabled and the relevant environment variables are configured, we collect product analytics such as page views, referrers, browser information, country, event names, route metadata, request timing, and coarse error information through Google Analytics 4. Private session recording and replay may be enabled through OpenReplay in private mode, subject to consent, configuration, and the provider's processing terms. Analytics is optional and is not required to use the Service.

2. How We Use Your Data

We use your data to:

Provide and maintain the platform, including workflows, agents, Knowledge Bases, deployments, evaluations, and training features
Authenticate users, manage sessions, organizations, roles, and permissions
Route AI requests and connected-service actions that your organization authorizes
Process payments, credits, usage records, and plan quotas
Send transactional emails such as verification, password reset, invitations, and billing notifications
Monitor platform health, detect abuse, enforce rate limits, and investigate security events
Generate organization-scoped observability, evaluation, cost, and performance views
Operate governance, compliance, export, deletion, and retention workflows
Improve the Service using aggregated or appropriately minimized product analytics

We do not sell your data, use customer data to train Sinaps-owned general models without your direction, or share data with advertisers or data brokers.

3. Cookies and Tracking

3.1 Necessary Cookies and Preferences

The Service uses cookies needed for authentication, security, consent, and basic preferences:

Authentication cookies (access_token and refresh_token): HttpOnly, Secure where enabled, SameSite=Lax cookies used for authenticated sessions. The refresh token is scoped to the refresh endpoint.
CSRF cookie (csrf_token, or the configured name): readable by browser code by design and used with the double-submit CSRF protection mechanism.
Cookie consent (cookie_consent): stores your necessary, analytics, and marketing preferences for up to 365 days.
Locale preference (sinapsis_locale): stores the selected public language preference for up to one year.

Authentication and security cookies are strictly necessary. Preference cookies can be removed through browser controls or the available cookie settings.

3.2 Analytics

When you allow analytics and a measurement ID is configured, the Service may load Google Analytics 4 from Google and start private OpenReplay session recording when that integration is configured. Google Analytics 4 processes analytics data under Google’s applicable processing terms and the configured property settings. OpenReplay is configured with private mode and Do Not Track respect, but no online service can guarantee that all provider-side processing is identical across environments.

You can reject analytics or withdraw analytics consent through the cookie settings. Withdrawal stops the product analytics runtime for subsequent activity, subject to data already processed before withdrawal.

3.3 Marketing Cookies

We do not currently use marketing or advertising cookies, sell personal data, or run advertising pixels. If that changes, we will update this Policy and request consent where required.

4. Data Storage and Security

Your data is stored in PostgreSQL and associated storage systems, including pgvector for Knowledge Base embeddings. Security measures include:

Encryption in transit: TLS is used for browser, API, and configured service connections
Encryption at rest: Sensitive secrets such as SSO credentials, integration credentials, and deployment credentials are encrypted before storage; API keys are hashed where the product only needs verification
Authentication: JWT cookies, optional TOTP two-factor authentication, OAuth login, and API-key authentication
CSRF protection: Double-submit cookies with constant-time comparisons
Rate limiting: Redis-backed limits and plan-based quotas on sensitive and resource-intensive endpoints
PII masking: Optional masking of supported identifiers before data is sent to external AI providers
Tenant isolation: Organization-scoped access checks and permissions throughout the product
Audit logging: Security and administrative activity is recorded for operational review
SSRF protection: User-provided URLs are validated against private ranges, cloud metadata endpoints, and dangerous ports with DNS pinning where applicable
Sandboxing: User-submitted code is executed in a bounded, network-disabled, container-isolated runtime when the sandbox is enabled

For self-hosted deployments, you control the infrastructure, storage location, backup strategy, and many security settings.

5. Third-Party Services and Transfers

We disclose data only as needed to provide the Service, enforce security, or comply with law. Categories include:

Stripe or the configured payment processor — Payment processing, subscriptions, invoices, and usage-related billing events
Configured email provider — Transactional email delivery, including recipient address and message content
Configured model providers or inference infrastructure — Prompts, files, parameters, datasets, or other inference data required by the workflow, evaluation, or training configuration
Configured integrations — Data exchanged with external services when your organization authorizes a connection or action
Google Analytics 4 and OpenReplay, when enabled and consented — Product analytics and private session telemetry
Hosting, storage, database, and operational providers — Infrastructure needed to run the selected cloud deployment

For the current cloud-hosted service, primary platform infrastructure is hosted in the European Union, currently in the Netherlands. If your organization routes data to a provider outside the EU or European Economic Area, or if a service provider processes data elsewhere, the transfer may be governed by an adequacy decision, Standard Contractual Clauses, or another applicable safeguard. Self-hosted deployments are governed by the customer's chosen infrastructure and providers.

We do not share data with advertisers or data brokers.

6. Data Retention

The following are current default retention periods for the cloud Service. Organization administrators can configure supported retention policies, and a contract, legal hold, security need, backup, or provider policy may require a different period.

Data type, Default retention or lifecycle
Data type	Default retention or lifecycle
User account data	While the account is active; deletion of the user record occurs after an accepted deletion request, while organization-owned records may remain under their own policies
Workflow and agent configurations	While the organization retains them, or until an administrator deletes them
Workflow executions	90 days by default; configurable per organization
AI conversations	90 days by default; configurable per organization
AI runtime execution traces	30 days by default; configurable per organization
Observability spans	30 days by default; configurable per organization, with a 30-day minimum in the current worker
Observability rollups	Hourly: 7 days; daily: 90 days; monthly: 365 days by default
Audit logs	365 days by default; configurable per organization and subject to legal or security requirements
Data imports	180 days by default, with associated storage cleaned up by the retention worker
Generated data exports	Downloadable export files expire after 7 days; export records follow the applicable export retention policy, 30 days by default
Notifications	90 days by default
Product analytics	Retained according to the configured Google Analytics 4/OpenReplay deployment and consented analytics settings
Sessions	Expire according to the configured access, refresh, and CSRF token lifetimes

Data export is available through Settings > Security & Data > Privacy and is rate-limited to one request per 7 days. The current self-service export covers the categories supported by the export service, including account and membership data, conversations, notifications, user-attributed audit events, user-created agents, Knowledge Bases and workflows, API-key and connection metadata, and feedback. It does not include secrets and may not include every organization-owned record or every product domain. Contact us for a broader request where required by applicable law. Account deletion is subject to subscription, ownership, and organization checks; it does not automatically erase records that belong to an organization, a provider, a legal hold, or a backup lifecycle.

7. Your Rights

Under GDPR and other applicable privacy laws, you may have the right to:

Access — Request or review personal data held about you through Settings > Security & Data > Privacy where available
Rectification — Correct inaccurate data through Settings > Personal > Profile or by contacting us
Erasure — Request deletion of your account and personal data, subject to applicable exceptions
Portability — Request a machine-readable export of the categories currently supported by the Service where the right applies
Restriction — Ask us to limit processing in the circumstances provided by law
Objection — Object to processing based on legitimate interests in the circumstances provided by law
Withdraw consent — Withdraw consent where processing is based on consent, without affecting prior lawful processing
Lodge a complaint — Contact your local data protection authority

To exercise these rights, use the platform settings or contact hola@akaitto.com. We will respond without undue delay and normally within one month of a verified request, subject to lawful extensions and identity verification requirements.

Privacy Policy