Legal

Privacy Policy

Last updated: 5 October 2026 · Effective immediately

BlackFlag Digital (Pty) Ltd trading as KairoNull ("KairoNull", "we", "us", or "our") operates kaironull.com and the Umbra Trust Protocol evidence infrastructure. This policy explains what personal data we collect, why, how long we keep it, and what rights you have.

1. Who we are

KairoNull is the data controller for information collected through this website and newsletter. For questions about this policy, contact privacy@kaironull.com.

2. What data we collect

• Newsletter subscribers: email address only. No name required.
• Contact enquiries: email address and the content of your message.
• Access requests (API keys): name, work email, organisation, role, plan and the use case you write. Stored in our database (Supabase) and emailed to us (Resend).
• Checklist download and scorecard: your email address. For the scorecard also your score, band and dimension scores, and any campaign source in the link you came from. Sent by email (Resend).
• Booking a briefing: if you use the booking link, the details you enter are processed by Calendly under its own privacy policy.
• Network address: used briefly to limit repeated form submissions (abuse protection) and held only for the short rate-limit window; also visible to our hosting provider in routine network logs.
• Verification page: checks a synthetic sample in your browser. What you type there is not sent to us.
• Fonts: pages load fonts from Google Fonts, so Google receives your network address and browser details when a page loads.
• Analytics: Cloudflare Web Analytics. Privacy-first: no cookies, no fingerprinting, no cross-site tracking. We see aggregated page view counts only.

3. Legal basis (GDPR)

• Newsletter: consent (Article 6(1)(a)). You may withdraw at any time by clicking unsubscribe in any email.
• Contact enquiries and access requests: legitimate interest (Article 6(1)(f)), responding to business enquiries and requests you make. Abuse protection relies on the same basis.
• Analytics: Cloudflare Web Analytics does not use cookies and we receive aggregated counts only. Cloudflare still processes network addresses to deliver the site.

4. How we use your data

• Newsletter email addresses are used solely to send The Evidence Brief: regulatory updates, AI governance intelligence, and KairoNull product news. We never sell or share subscriber lists.
• Contact enquiry data is used only to respond to your message.
• Access request details are used to decide whether and how to issue an API key and to contact you about it. They are not used for marketing without your consent.

5. Data retention

• Newsletter subscribers: retained until you unsubscribe or request deletion.
• Contact messages: retained for 24 months, then deleted.
• Access requests: kept until you ask us to delete them. No automatic deletion is currently configured.
• Rate-limit records: expire automatically after the short rate-limit window.

6. Third-party processors

• Loops.so: newsletter delivery. Stores subscriber email addresses on our behalf. Loops.so privacy policy: loops.so/privacy.
• Cloudflare: website hosting, web analytics, and the short-lived rate-limit store. It handles network addresses as part of delivering the site.
• Supabase: database hosting for access requests and for evidence records customers send. The project is in the EU (Ireland).
• Resend: sends the emails described above, including the notification that contains an access request's details.
• Calendly: briefing bookings, when you use the booking link.
• Google Fonts: serves the site's fonts.
• FreeTSA (RFC 3161 timestamp authority): receives a hash of the ledger root, never a record's content or personal data.

7. Your rights

Under GDPR and UK GDPR, you have the right to: access your data, correct inaccuracies, request deletion, withdraw consent, lodge a complaint with your supervisory authority.

To exercise any right, email privacy@kaironull.com. We will respond within 30 days.

8. Cookies

We use no third-party cookies. No tracking pixels, no advertising cookies, no cross-site identifiers. Any local storage we use is limited to session state (e.g. verification UI) and never leaves your device.

9. Changes to this policy

We will post any changes here with an updated effective date. Material changes will be communicated to newsletter subscribers.

10. Contact

Privacy questions: privacy@kaironull.com
General enquiries: dane@kaironull.com