Privacy Policy

Kytona Limited is the controller for website analytics, waitlist, account, billing and direct communications data. Our registered address is 171 Duke Street, St. Helens, England, WA10 2JH. Contact us at info@kytona.com.

When a customer sends employee or contractor coding-agent telemetry to Kytona, the customer normally decides why that monitoring occurs and acts as controller; Kytona acts as its processor under the customer agreement and data-processing terms. The customer must give its users an appropriate notice and establish a lawful basis for that monitoring.

• Waitlist and account data, including name, work email, organisation, role and preferences.
• Technical website data, including page views, referral and UTM parameters, browser data and abuse-prevention identifiers.
• Coding-agent metadata, including user identity, repository, model, session and prompt identifiers, timestamps, token and estimated list-price cost metrics, tool names, permission decisions and policy findings.
• When an organisation explicitly enables full capture, redacted command, prompt, response or tool content selected by its capture policy.
• Administrative records, including memberships, settings changes, sign-ins, exports, acknowledgement decisions and deletion requests.

Customers can preview the capture fields, use metadata-only mode, disable rules and configure retention. Kytona filters recognised secrets before content is queued, but customers should not intentionally submit credentials.

We use controller data to provide requested services and accounts (contract or steps before contract), secure and improve the service and prevent abuse (legitimate interests), administer billing and legal records (contract and legal obligation), and send requested product communications (consent or legitimate interests where permitted).

Customer telemetry is processed only to provide ingestion, retention, risk detection, session review, fleet reporting, support, security and deletion functions under the customer's documented instructions.

We use service providers for hosting, databases, email delivery, authentication, product analytics and support. We do not sell personal data. A current sub-processor list and applicable transfer safeguards are available from info@kytona.com.

Production location and any restricted transfer mechanism are stated in the customer agreement. Where information is transferred outside the UK, we use an applicable adequacy regulation or contractual safeguards and carry out any required transfer assessment.

Coding-agent data follows the organisation's configured retention periods. The initial defaults are 7 days for captured prompt, response and raw content; 30 days for command text; and 90 days for metadata and metrics. Deletion removes active data from PostgreSQL and ClickHouse, with encrypted backups expiring within 30 days unless a legal hold applies.

Waitlist records are kept until you withdraw or they are no longer needed. Account, billing and audit records are kept for the relationship and then only as required for security, disputes, tax or legal obligations.

We use access controls, tenant-scoped queries, encryption in transit, secret filtering, role-based administration and append-only administrative audit records. No internet service can guarantee absolute security.

Risk findings are deterministic policy matches intended to support human review. They do not make employment decisions or automatically discipline, rank or evaluate individuals.

Depending on the processing and lawful basis, you may have rights to access, rectification, erasure, restriction, portability and objection, and to withdraw consent. To exercise a right, contact info@kytona.com. If your request concerns customer-controlled telemetry, we may refer it to that customer.

You may complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint. Your right to object to processing based on legitimate interests is specifically brought to your attention.

We use essential storage for sign-in and service operation. Optional analytics run only when configured. Referral parameters are retained in session storage so a signup can be attributed to its source.

We may update this notice as the service changes. Material changes will be identified on this page and, where appropriate, communicated to account administrators.