Privacy Policy

Last updated: September 30, 2026

This Privacy Policy explains how Krun Labs ("Krun", "we", "us") collects, uses and shares personal data when you visit krun.ai, use the Krun API (api.krun.ai), the Krun console (console.krun.ai), our SDKs and documentation, or otherwise interact with us (the "Services").

Controller and processor roles:

• For account, billing, website and communications data, Krun is the controller.
• For personal data contained in the inputs our customers send to the API or the console ("Customer Content"), Krun processes that data on behalf of the customer, who is the controller. Individuals whose data appears in Customer Content should contact the relevant customer.

1. Personal data we collect

Data you provide

• Access requests: email address and intended workload, submitted through the form on krun.ai.
• Account data:
  • your name, email address and profile picture, when you sign in with an email code, GitHub or Google;
  • your organizations, projects, roles and invitations.
• Customer Content:
  • the contexts, questions, options and instructions you send;
  • media assets you upload (images, documents, audio);
  • the answers we return;
  • feedback you submit on answers.
• Communications: messages you send to us, for example at contact@krun.ai.

Data collected automatically

• Usage and billing metadata: request identifiers, model, question types and counts, input token counts, latency, status and error codes, abstention and confidence summaries, credit and ledger entries. This metadata does not include the text or media of your requests.
• Technical data: IP address, user agent and approximate location derived from the IP address, used for security, rate limiting and abuse prevention.
• Cookies:
  • the console uses strictly necessary cookies to keep you signed in and to remember your selected organization;
  • krun.ai uses Google Tag Manager, which may load analytics tags that set cookies to measure website traffic.

2. How we use personal data

We use personal data to:

• provide, operate and secure the Services, including authenticating you, running decisions, storing assets for the requested period, rate limiting and preventing abuse;
• measure usage, apply quotas and credits, and bill;
• provide support and send service, security and account communications;
• monitor reliability and debug errors;
• understand and improve the website and the Services in aggregate;
• comply with legal obligations and enforce our Terms and Acceptable Use Policy.

Model training. We do not use Customer Content to train or improve our models unless your organization opts in to training data sharing in the console. The opt-in is off by default and can be turned off at any time. When it is on:

• eligible text decisions are stored encrypted, with access restricted to authorized review;
• media assets are never captured for training.

Legal bases (where the GDPR or Brazil's LGPD applies):

• performance of a contract (providing the Services);
• legitimate interests (security, fraud prevention, service improvement, B2B communications);
• compliance with legal obligations;
• consent where required, for example for non-essential cookies or training data sharing.

3. How we handle Customer Content

• Decision inputs. The text of decision requests is processed to produce the response and is not retained afterwards in our databases or logs, except for the encrypted training copies described above when your organization opts in. Our inference providers may hold request data transiently while a request is processed, for example while a job is queued or its result is awaiting retrieval, after which it expires.
• Media assets. Uploaded assets are stored so that decisions can reference them. They are deleted automatically 24 hours after upload, or earlier if you delete them through the API. Storage-level lifecycle rules remove any remaining copies within 2 days.
• Operational logs and error reports. These are designed to exclude request content, media, transcripts and credentials.

4. How we share personal data

We do not sell personal data, and we do not share it for cross-context behavioral advertising. We share personal data only as follows.

Service providers (subprocessors), which process data on our behalf under contractual obligations:

Other disclosures

• Within your organization: other members of your organization can see organization data, usage and projects according to their roles.
• Legal and safety: we may disclose data when required by law or valid legal process, or to protect the rights, safety and security of Krun, our users or others.
• Business transfers: in connection with a merger, acquisition, financing or sale of assets, subject to this Policy.

5. International transfers

We and our providers process data in the United States and other countries that may not offer the same level of protection as your country. Where required, we rely on appropriate safeguards for these transfers, such as standard contractual clauses.

6. Retention

• Account and organization data: kept while your account is active and for a reasonable period afterwards, to comply with legal, accounting and security obligations.
• Usage and billing records: kept as long as needed for billing, audit and legal purposes.
• Media assets: deleted after 24 hours as described above.
• Training copies (opt-in only): retained until they are no longer needed for model improvement or until your organization asks us to delete them.

7. Your rights

Depending on where you live, including under the GDPR and Brazil's LGPD, you may have the right to:

• confirm whether we process your personal data, and access it;
• correct inaccurate or incomplete data;
• request deletion, anonymization or blocking of unnecessary or unlawfully processed data;
• data portability;
• object to processing or restrict it;
• withdraw consent where processing is based on consent;
• obtain information about the entities with which we share data.

To exercise your rights, contact us at contact@krun.ai. We may need to verify your identity. You also have the right to lodge a complaint with your data protection authority, such as Brazil's ANPD or your local supervisory authority in the EU.

8. Security

We use technical and organizational measures designed to protect personal data, including:

• encryption in transit;
• API keys and session tokens stored only as hashes;
• short-lived signed links for media processing;
• role-based access controls;
• encryption of training data.

No system is completely secure, and we cannot guarantee absolute security.

9. Children

The Services are not directed to individuals under 18, and we do not knowingly collect their personal data. If you believe a minor has provided us personal data, contact us and we will delete it.

10. Changes to this Policy

We may update this Policy from time to time. We will post the updated version on this page with a new "Last updated" date and, for material changes, give reasonable notice by email or in the console.

11. Contact

Krun Labs. Email: contact@krun.ai.