This Privacy Policy explains how Kordi Lab (“Kordi,” “we,” “us,” or “our”) handles information when you use the Kordi website, desktop and mobile applications, and Kordi-operated hosted services (together, the “Services”).
A self-hosted Kordi deployment is operated by the person or organization running it. Their privacy practices, not this policy, govern information handled within that deployment.
1. Information we handle
Information you provide
Depending on how you use Kordi, you may provide:
- Account details such as your name, email address, and authentication information.
- Beta application details such as your name, email address, and optional affiliation.
- Academia credit requests such as your name, email address, and, for applications, your research topic.
- Messages, prompts, files, group details, agent settings, and other collaboration content.
- Feedback, support requests, and other communications you send to us.
Information generated through use
Kordi-operated Services may generate technical records such as IP address, device and operating-system information, access times, feature activity, error reports, and security or performance logs.
2. How we use information
We use information as needed to:
- Provide accounts, contacts, conversations, synchronization, and agent execution.
- Authenticate users and protect the safety and integrity of the Services.
- Diagnose failures, maintain reliability, and improve the Kordi experience.
- Respond to support requests and communicate important service updates.
- Review beta applications and send application- or invitation-related emails.
- Comply with applicable law and enforce our terms and policies.
3. Self-hosted Kordi
When you operate Kordi on infrastructure you control, conversation data, agent execution, and related records are handled according to your own configuration. Kordi Lab does not receive that information simply because you installed the open-source software.
If a self-hosted deployment connects to an external model, hosting, or infrastructure provider, that provider’s terms and privacy practices also apply.
4. Hosted agents and service providers
To perform an action you request, Kordi may send the relevant prompt, conversation context, files, or tool inputs to model and infrastructure providers used by the hosted service. We may also use providers for hosting, authentication, storage, monitoring, and support.
These providers may process information only to deliver their services to us and are subject to their own contractual and legal obligations.
5. Connected accounts and Google user data
You can choose to connect third-party accounts, such as Google Calendar, Gmail, GitHub, and Slack, so that your agents can work with them. Connecting an account is optional, and Kordi asks only for the permissions shown on the provider’s consent screen.
What Kordi accesses
- Google Calendar: your events and free or busy times, and, when you allow agents to act, creating or updating events and replying to invitations.
- Gmail: reading and searching your messages, and, when you allow agents to act, sending email on your behalf.
- GitHub: your profile, notifications, and pull requests, and, when you allow agents to act, commenting in repositories you can reach.
- Slack: message history in channels you belong to, and, when you allow agents to act, posting messages as you.
How Kordi uses it
Kordi uses data from a connected account only to provide the features you see in the product: answering your requests, carrying out actions you or your agent start, and showing you what was done. An agent reads from a connected account when a request needs it, and an action that changes something in your account requires your approval unless you have chosen otherwise in settings.
To answer a request, the relevant content may be sent to the AI model provider that runs your agent, as described in section 4. Kordi does not sell data from connected accounts, does not use it for advertising, and does not use it to develop, improve, or train generalized AI or machine learning models. People at Kordi do not read this data unless you ask us to for support, it is needed to investigate abuse or a security incident, or the law requires it.
Kordi’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Storage and removal
Access credentials for connected accounts are encrypted when stored. Content an agent retrieves becomes part of the conversation where it was used, and a record of connector activity is kept for a limited period so that you can review it. You can disconnect an account at any time in Kordi settings, which revokes Kordi’s access and deletes the stored credentials. You can also remove Kordi’s access from the provider’s own account settings, and you can ask us to delete data associated with your Kordi account using the contact address below.
6. Cookies and analytics
The kordi.ai website stores only what it needs to work, such as your cookie choice, in your browser. This storage is always on.
With your permission, the website also uses Google Analytics to count visits
and see which pages are used. Google Analytics receives the pages you view,
your browser and device type, an approximate location derived from your IP
address, and how you reached the site, and it sets cookies named
_ga and _ga_<ID> on kordi.ai. We do not use
advertising cookies, and analytics does not load until you allow it.
You can change your choice at any time with Cookie settings at the bottom of the home page. Turning analytics off removes its cookies from kordi.ai. The Kordi apps do not use this website's analytics.
7. How we share information
We do not sell personal information. We may disclose information to service providers supporting Kordi; when required by law or legal process; to protect users, Kordi, or others; or as part of a merger, financing, acquisition, or transfer of the project or its assets.
8. Retention and security
We keep information for as long as reasonably necessary to provide the Services, protect their integrity, resolve disputes, and meet legal obligations. Retention may vary by data type and by whether you use hosted or self-hosted Kordi.
We use reasonable technical and organizational safeguards, but no networked service or storage system can guarantee absolute security.
9. Your choices and rights
Depending on your location, you may have rights to access, correct, delete, export, object to, or restrict the processing of personal information. You may also be able to manage or delete information directly through Kordi.
To make a privacy request, contact us using the address below. We may need to verify your identity before completing the request.
10. Children and international processing
Kordi is not directed to children under 13 or any higher minimum age required by local law. Information may be processed in countries where Kordi Lab or its service providers operate, which may have different data-protection rules.
11. Changes to this policy
We may update this policy as Kordi develops. The current version will be published here with a revised “Last updated” date. Material changes may also be communicated through the Services or other appropriate channels.
12. Contact
Questions or privacy requests can be sent to team@kordi.ai.