1. Who we are
The Data Fiduciary (the "controller", in GDPR terms) for the personal data described here is Krenos ("we", "us"), a sole proprietorship based in India, located in Kattankulathur, Tamil Nadu, India.
- Privacy questions: privacy@krenos.co.in
- Grievance Officer: grievance@krenos.co.in (named on the Grievance Redressal page)
This notice explains what personal data we process when you use krenos.co.in, the Krenos web app, the Krenos Studio desktop application and our APIs (the "Service"), why we process it, who receives it, how long we keep it, and your rights. It does not cover apps or sites that you build with Krenos. If you collect personal data through them, you are responsible for that data.
2. The personal data we process, and why
| What | Examples | Why we use it | Basis |
|---|---|---|---|
| Account details | Name, email address, profile picture URL, sign-in method | Creating and securing your account, signing you in, contacting you about the Service | Your consent when you sign up, and performance of our agreement |
| Password | Stored only as a salted PBKDF2 hash; we never store your password in readable form | Signing you in | Your consent (a password is sensitive personal data under Indian law) |
| Sign-in provider identifiers | Your Google or GitHub account ID, plus the name, email and picture they share | Signing you in with Google or GitHub | Your consent |
| Age check | The date of birth you enter at sign-up | Checking you are old enough. We do not store the date of birth. We store only that the check passed, when it passed, and, for users aged 16–17, the date you turn 18 | Legal obligation and your consent |
| Parent or guardian details (16–17 only) | Guardian's name, email address, relationship to you, and their consent record | Getting and recording the guardian consent the law requires | Legal obligation |
| Your content | Prompts, code, files, workspaces, shared projects, and app inputs and results you choose to save | Providing the features you use, including sending requests to AI providers | Your consent and performance of our agreement |
| AI usage metadata | Feature used, AI provider and model, request status, input and output size, token counts, timestamps | Usage quotas, showing you your usage, billing, preventing abuse, keeping the Service reliable | Our agreement and legitimate uses |
| Developer credentials | AI provider keys you add (encrypted), personal access tokens (stored as hashes), Supabase connection details (management token encrypted) | Making requests on your behalf | Your consent |
| Billing records | Paddle customer ID, plan and subscription status | Giving you the plan you paid for | Our agreement |
| Messages and reports | Support requests, grievances, abuse reports, rights requests | Answering you and meeting our legal obligations | Legal obligation and your consent |
| Product analytics (only if you allow them) | Page views and product events linked to a random identifier stored in a cookie | Understanding how Krenos is used, so we can improve it | Your consent, which you can withdraw at any time |
| Security records | A keyed hash of your IP address, browser user agent, sign-ins, changes to keys and tokens, administrative actions | Protecting accounts, investigating incidents, meeting legal log-keeping duties | Legal obligation |
| Desktop application data | Your prompts, the active file, and relevant excerpts from your workspace (known secret formats are redacted and credential files are skipped); audio, if you use voice dictation | Answering your AI requests; turning speech into text | Your consent |
Without analytics consent, we record only anonymous event counts, with no identifier. If you are 16 or 17, we never use analytics or any other tracking on your account, even with consent.
The desktop application sends nothing to Krenos except the requests you make. It has no other telemetry. Voice audio is sent for transcription only, and Krenos does not store it.
3. AI processing
When you use an AI feature, the prompt and the context you include are sent to the AI provider that serves the request. The context can include files from your workspace, or excerpts from it in the desktop application. Our Sub-processors & AI Providers page lists every provider, where it processes data, how long it keeps data, and whether it may use data for training.
- Krenos never uses your content to train AI models.
- Providers that may train on inputs by default, or that process data in China, are off unless you opt in for your own account (Account → Privacy). You can withdraw that opt-in at any time.
- If you add your own provider key (BYOK), requests made with it are governed by your agreement with that provider.
- Accounts of users aged 16–17 are served only by providers whose terms permit it.
4. Who receives your data
We share personal data only as follows:
- Service providers who process it for us under contract: hosting (Netlify), database (Neon), email delivery when enabled, and the AI providers listed on the sub-processor page.
- Paddle.com, our Merchant of Record, which collects your payment details directly and acts as an independent controller for payment and tax data.
- Services you connect, such as GitHub or Supabase, when you ask us to act there.
- The public, for content you choose to publish, such as share links.
- Authorities, when the law requires us to, for example under a court order or a lawful direction under the Information Technology Act, 2000, or to report a cyber incident to CERT-In.
- A successor, if the Service is transferred to a company set up by its founder or to a buyer, in which case this notice continues to apply.
We do not sell personal data, and we do not use it for third-party advertising.
5. Transfers outside India
Our service providers process data outside India, mainly in the United States and the European Union, and in China only for providers you have opted in to. We use providers that contractually commit to protecting the data. We will comply with any restrictions the Government of India notifies under section 16 of the Digital Personal Data Protection Act, 2023.
6. How long we keep data
| Data | Retention |
|---|---|
| Account details and your content | While your account exists. Deleted 7 days after you ask for deletion; signing in during those 7 days cancels the deletion |
| Registration record (email, name, dates) | 180 days after your account is deleted, as required by the IT Rules, 2021 |
| Records of what you accepted | Kept for 3 years after your account is deleted, identified only by a keyed hash of your email |
| Sessions | Up to 7 days (expired sessions are purged daily) |
| AI usage metadata | 13 months; monthly usage totals 25 months |
| Product analytics events | 13 months, or until you withdraw consent, when they are deleted |
| Security and audit logs | 13 months, which meets the one-year minimum under the DPDP Rules and the 180-day minimum under the CERT-In Directions |
| Content removed after a complaint | At least 180 days, as required by the IT Rules, 2021 |
| Grievances and reports | 3 years after they are closed |
| Unconfirmed accounts for ages 16–17 | Deleted if guardian consent is not given within 7 days |
| Database backups | Rolling backups held by our database provider for a short period (currently no more than 7 days) |
7. Security
We protect personal data with appropriate technical and organisational measures:
- passwords and tokens are stored only as hashes;
- provider keys are encrypted with AES-256-GCM;
- connections use TLS;
- user-published content runs in a sandbox, isolated from your account;
- access is limited to what is needed;
- security events are logged and monitored.
No system is perfectly secure. If a personal data breach affects you, we will notify you, the Data Protection Board of India and CERT-In as the law requires.
8. Your rights
You have the right to:
- access a summary of your personal data and how we process it, and the identities of those we share it with;
- correct, complete or update your data;
- erase your data, subject to the records the law requires us to keep;
- withdraw consent at any time, as easily as you gave it. Withdrawal does not affect processing that happened before it, but some features may stop working without the data they need;
- grievance redressal, through our Grievance Officer;
- nominate someone to exercise these rights for you if you die or become unable to;
- if the GDPR or UK GDPR applies to you: restriction, objection, data portability, and complaint to your data protection supervisory authority.
How to exercise them: use Account → Privacy (download your data, delete your account, manage consents, add a nominee), or email privacy@krenos.co.in. We may need to verify your identity. We respond within 15 days.
9. Children and minors
- Krenos is not for anyone under 16. We delete any account we learn belongs to someone under 16.
- Users aged 16 or 17 need verified consent from a parent or legal guardian before their account is activated. On those accounts we do not track behaviour, show targeted ads or use analytics, and AI requests go only to providers whose terms permit minors.
- A parent or guardian can ask to review or delete the account's data, or withdraw consent, by emailing privacy@krenos.co.in.
10. Cookies and browser storage
We use only the cookies the Service needs to work, plus an analytics cookie if you allow it. The Cookie Notice lists every cookie and storage item. You can change your choice at any time with "Cookie settings" in the site footer. We treat a browser's Global Privacy Control signal as a refusal of analytics.
11. Complaints
Please contact our Grievance Officer first (see Grievance Redressal). If you are not satisfied with our response, you may complain to the Data Protection Board of India. If you are in the EU or UK, you may also complain to your data protection supervisory authority.
12. Languages
This notice is available in English. You can ask for it in any language listed in the Eighth Schedule to the Constitution of India, through the grievance form or at privacy@krenos.co.in. If a translation conflicts with the English version, the English version prevails.
13. Changes
We will tell you about material changes before they take effect, and ask you to review the updated notice when you next use your account. Every version, with its date, is listed at /legal.