Introduction
Kurral ("we", "us", "our") respects your privacy. This policy explains how we collect, use, and protect your information when you use our AI proxy and security testing platform ("the Service").
Information we collect
Account information
When you create an account, we collect your name, email address, and authentication data through our provider Clerk. We do not store passwords directly.
Usage data
We collect metadata about your API proxy usage including: model names, token counts (input/output), request latency, timestamps, cost calculations, and HTTP status codes.
Request content
Depending on your retention settings, we may log full request and response content for observability purposes. You can configure your retention mode to control what content is stored. When retention is disabled, only metadata is logged.
Security scan data
When you run security scans, we store scan configurations, results, and evidence (including tool call payloads and responses) in your account.
Information we do not collect
We do not store your AI provider API keys. When you use the proxy, your provider keys are used only for the duration of the request and are never persisted on our servers.
How we use your information
- To provide and maintain the Service.
- To display usage analytics and cost dashboards.
- To generate security scan reports.
- To communicate with you about your account and service updates.
- To detect and prevent abuse of the Service.
Data sharing
We do not sell your personal information. We share data only with the following third-party services that are essential to operating the Service:
- Clerk — authentication and user management.
- Neon — database hosting (stores your usage data and scan results).
- Render — backend API hosting (processes proxy requests).
- Vercel — frontend hosting (serves the web application).
- SendGrid — transactional email (welcome and report delivery).
We may also disclose information if required by law or to protect the rights and safety of our users.
Data retention
Account information is retained for the duration of your account. Usage metadata is retained according to your plan's retention period. You can delete your account and all associated data at any time. Upon account deletion, all data is removed within 30 days.
Data security
We implement industry-standard security measures to protect your data, including encryption in transit (TLS) and at rest. Access to production systems is restricted and monitored.
Your rights
You have the right to:
- Access the personal data we hold about you.
- Request correction of inaccurate data.
- Request deletion of your data and account.
- Export your usage data and scan results.
- Opt out of non-essential communications.
Cookies
We use the following categories of cookies:
Essential cookies
Required for the service to function (authentication, session management, security). These cannot be disabled.
Analytics cookies
We use Google Analytics to understand aggregate usage patterns and improve the product. These cookies are only set after you explicitly consent. You can withdraw consent at any time via the cookie preferences link in the footer.
Preference cookies
Used to remember your settings (e.g., light/dark theme) across visits. Only set after you consent to preference cookies.
You can review and change your consent choices at any time by clicking Cookie preferences in the site footer.
Changes to this policy
We may update this policy from time to time. We will notify you of material changes via email or through the Service.
Contact
For privacy-related questions, contact us at support@kurral.com.