This policy explains what personal data we process when you use
kailabs.cc (the homepage, blog, /stats and these legal pages),
the KAI Terminal (the web app at terminal.kailabs.cc, the desktop app and
the API at api.kailabs.cc) and the emails we send — together, the
“Service”. It says why we process each kind of data, on what
legal basis, who else receives it, how long we keep it, and what rights
you have. Whichever country you live in, we apply GDPR-grade protections
by default.
KAI Labs (“we”, “us”) runs the Service and decides how and why personal data is processed for it. KAI Labs is not yet registered as a company. When it is, this section will name the legal entity, its jurisdiction and its registered address. Until then, use the contacts below for anything concerning your data.
EU/UK representative (GDPR Art. 27, UK GDPR Art. 27): not appointed. EU and UK residents can send any request to the privacy contact above; it will be handled the same way and within the same statutory deadlines.
The table lists every category of personal data the Service processes. “Recipients” names who else receives the data; §6 describes each of them. “Retention” is how long the data stays in our live systems; after deletion, a copy can remain in our encrypted backups for up to 30 more days (see “Backups” below).
| Data | When | Purpose | Legal basis (GDPR Art. 6) | Retention | Recipients |
|---|---|---|---|---|---|
| Visiting kailabs.cc or the terminal | |||||
| Connection data: IP address, browser user agent, the address requested, the referring page | Every request | Deliver the site, the terminal and the API; protect them from attacks and abuse | Legitimate interest in running a secure service (Art. 6(1)(f)) | We keep no log of your visits beyond the rows below (analytics, product-updates signup, sign-in alerts, server logs) | Cloudflare; Google (fonts on the legal pages and in the terminal) |
| Usage analytics (§4): pages viewed, interface events, campaign (UTM) tags, the referring site; a session identifier, approximate location (country, region, city), device and browser type derived from your IP address and user agent | Visits to the homepage and the terminal; account and payment milestones (§4). The blog, /stats and the legal pages run no analytics |
See which pages and steps work; measure the path from first visit to sign-up and payment | Legitimate interest in understanding and improving the Service (Art. 6(1)(f)) | No automatic expiry at present | None — our self-hosted analytics; it runs on our server (hosting provider) and is reached through Cloudflare |
| Storage on your device (§5) | Visits; Google sign-in; staying signed in to the terminal | Remember campaign tags, keep the homepage A/B variant stable, keep you signed in, protect Google sign-in | Legitimate interest (Art. 6(1)(f)); contract (Art. 6(1)(b)) for signing in | See §5 | Stays in your browser; campaign tags and the A/B variant are recorded by our analytics |
| Product updates (the email form at the bottom of kailabs.cc) | |||||
| Email address, signup date, and the versions of the Terms and this policy you accepted | When you subscribe | Send the confirmation and occasional product updates; keep a record of what you agreed to | Consent (Art. 6(1)(a)); the record of your consent: legitimate interest in being able to prove it (Art. 6(1)(f)) | Until you unsubscribe (the link in every email deletes your entry) or ask us to delete it | Resend |
| IP address, user agent, and the full address of the page you came from (referrer) | When you subscribe | Limit abuse (at most 5 signups per IP address in 10 minutes); keep a record of the signup; tell our team where signups come from | Legitimate interest in preventing abuse and documenting consent (Art. 6(1)(f)) | Stored with your entry and deleted with it | Resend (our team gets a notification email with your email address, referrer and IP address) |
| Campaign (UTM) tags from the link you arrived with | When you subscribe | Measure which campaigns bring subscribers | Legitimate interest (Art. 6(1)(f)) | Sent with the form but not stored by our server; utm_source and utm_campaign are recorded as analytics event properties (§4) |
None |
| Your KAI Terminal account | |||||
| Account: email address; password, stored only as a one-way hash; whether your email is verified; your new address while an email change is pending; one-time verification and password-reset tokens; account creation date; onboarding progress | Sign-up and use of the terminal | Create your account, sign you in, send service emails | Contract (Art. 6(1)(b)) | Until you delete your account | Resend |
| Record of your acceptance of the Terms: the Terms and Privacy Policy versions, the time, your IP address and browser user agent, and how you accepted (sign-up or the acceptance screen) | When you create an account with email, and when you accept the Terms on the screen shown after sign-in | Keep proof of which Terms you agreed to; ask you to accept again when the Terms change | Contract (Art. 6(1)(b)); our legitimate interest in being able to show what was agreed (Art. 6(1)(f)) | Until you delete your account | None |
| Google sign-in: your Google account ID and email address. Google also sends your name and profile picture; we do not store them | When you sign up or sign in with Google, or connect Google to your account | Sign you in with Google | Contract (Art. 6(1)(b)) | Until you disconnect Google or delete your account* | |
| Two-factor authentication: the authenticator secret (encrypted, AES-256-GCM) and backup codes (stored only as salted hashes) | When you turn on 2FA | Protect your account with a second factor | Contract (Art. 6(1)(b)) | Until you turn 2FA off or delete your account | None |
| Security alerts: the IP address and browser of each new sign-in; notices of password, email and 2FA changes | Each sign-in and each security change | Let you spot access or changes you did not make | Legitimate interest in protecting your account (Art. 6(1)(f)) | Kept in your in-app inbox, which holds your 200 most recent account notifications; older ones are deleted automatically* | Resend; your browser’s push service, if push is on |
| Notifications: in-app inbox items (signals, trades, orders, price alerts, billing and security events) and your notification preferences. If you turn on push: the push address issued by your browser, its encryption keys and a description of your browser | As events happen; push only after you allow it | Tell you about your strategies, account and payments | Contract (Art. 6(1)(b)) | Inbox: the 200 most recent items per strategy and per account*. Push address: until you turn push off or your browser’s push service reports it expired* | Resend; your browser’s push service (push messages are end-to-end encrypted) |
| Strategies, trading and AI analysis | |||||
| Strategy content: names and descriptions, settings and risk limits, the prompts you write and the full history of your prompt edits, strategy rules and insights, the X (Twitter) accounts you follow and the searches you run to find them | When you set up and edit strategies | Run your strategy; the prompt history is a record that you authored your strategy | Contract (Art. 6(1)(b)); prompt history: legitimate interest in showing that strategies are user-authored (Art. 6(1)(f)) | Until you delete your account*. Prompt history is kept when you delete a strategy* | The AI model provider you select; MiniMax (market briefing); twitterapi.io (account names and search text) |
| Trading activity: signals your strategy produced (with the model’s reasoning), orders, positions and trades (paper and live), profit-and-loss and equity snapshots, risk-limit events*, trade notes (yours and the model’s), price alerts*, post-trade insights; a journal of changes to your trades (entry price, size, leverage, stop-loss, take-profit and its ladder, status, close price, profit and loss, fees), with the time of each change and whether the stop-loss and take-profit were set at entry, after a limit order filled, by the Service’s automatic exits, by a model review or by you | While your strategies run and when you act on them | Provide the trading functions you use and show you their history | Contract (Art. 6(1)(b)) | Until you delete your account*. Resetting the paper account clears paper trades but not the journal of trade changes | The AI model provider you select (as context for each analysis); the exchange you connect (live orders) |
| Chart Lab: your questions, the model’s answers, chart drawings, trade proposals and strategy test runs | When you use Chart Lab | Provide the Chart Lab chat and strategy tests | Contract (Art. 6(1)(b)) | Until you delete the chat or your account* | The AI model provider you select |
| AI usage records: model, tokens, credit cost, time and strategy of each AI request (not its content) | Each AI request | Charge credits and apply your daily credit limits | Contract (Art. 6(1)(b)) | Until you delete your account | None |
| Live trading | |||||
| Exchange connection: API key (stored as entered); API secret, passphrase and Hyperliquid agent-wallet key (encrypted, AES-256-GCM); wallet address; exchange and network (demo or real); your confirmation that you are eligible to trade crypto derivatives and understand the leverage and liquidation risk, and the version of the eligibility statement you confirmed; the country Cloudflare derives from your IP address when you connect | When you connect an exchange to a strategy | Place and manage the orders your strategy makes; read balances, positions and the account’s trading fee rates; apply geographic restrictions on derivatives trading | Contract (Art. 6(1)(b)); country: legitimate interest in complying with restrictions on who may trade derivatives (Art. 6(1)(f)) | Until you disconnect the exchange, delete the strategy or delete your account | The exchange you connect |
| Payments | |||||
| Orders and payments: plan or credit pack, price, coin and amount, the one-time deposit address CryptAPI creates for your order, blockchain transaction IDs, status and dates, and repeat payments that need a manual review. We do not ask for your name or card details and do not record the wallet address you pay from | When you buy a plan or credits | Take payment, grant your plan or credits, resolve payment problems, keep accounting records | Contract (Art. 6(1)(b)); legal obligation to keep accounting records, where one applies (Art. 6(1)(c)) | Unpaid invoices expire after 24 hours and are deleted 30 days later. Other payment records: until you delete your account | CryptAPI; the public blockchain |
| Credits and plan: balance, credit ledger (charges and grants), plan periods, promo codes redeemed* | While you use the Service | Run your plan and credit balance | Contract (Art. 6(1)(b)) | Until you delete your account* | None |
| Running the Service | |||||
| Server logs: technical events; some lines contain email addresses, IP addresses or payment references | Continuously | Operate and debug the Service; investigate security incidents | Legitimate interest in operating a reliable, secure service (Art. 6(1)(f)) | Rolling: the logs are capped in size and the oldest part is overwritten, roughly after two weeks | Hosting provider |
| Backups: encrypted copies of our database and of our analytics database | Every night | Restore the Service after a failure | Legitimate interest in not losing your data (Art. 6(1)(f)) | 7 days on our server, 30 days in Cloudflare R2; deleted data stays in backups until they rotate out | Cloudflare (stores the encrypted files and cannot read them) |
| Your messages to us (privacy@, hello@) and our replies | When you write to us | Answer you; handle your data protection requests | Legitimate interest (Art. 6(1)(f)); legal obligation for rights requests (Art. 6(1)(c)) | As long as needed to handle the request and keep a record of it | Cloudflare (forwards mail for kailabs.cc to our team’s mailbox) |
* Deleting your account in the terminal does not yet remove the Google sign-in link, push addresses, the notification inbox and preferences, Chart Lab chats and strategy tests, price alerts, risk-limit events, the prompt history and promo-code redemptions. Until it does, email [email protected] after deleting your account and we will delete them by hand.
What AI model providers receive. Each AI request contains your strategy prompt, market data and the parts of your trading context listed above. It carries no email address, name or account ID. For entry and position-management decisions, this context also includes your account’s trading fee rates (for a live account, read from the exchange with your key) and portfolio risk figures: balance, equity, margin in use, exposure, the loss to your stop-losses, pending orders and the room left under your risk limits; the market data includes the order book, funding and open interest. In Chart Lab, the model can also look up your trades, trade notes and the journal of trade changes. New strategies use MiniMax models until you choose another model, and the market briefing built from the X accounts you follow is always written by a MiniMax model. Each provider handles requests under its own API terms: Anthropic’s terms do not allow it to train models on them, while DeepSeek’s and MiniMax’s terms allow them to use request content to improve their services.
Public statistics. We do not publish your strategies or
trades. The public /stats page shows only paper trades of
KAI’s own showcase account.
kailabs.cc sets no cookies, and our analytics is cookieless (§4). The
terminal sets one cookie, kai_oauth_bind, only while you sign
in with Google: it ties the sign-in to the browser that started it and
expires after 5 minutes. If Cloudflare shows you a security check, it may
set its own strictly necessary cookie to remember that you passed it.
We run no advertising, retargeting, session-replay or social-media scripts. The only third-party resource your browser loads directly is Google Fonts, on the legal pages and in the terminal (see §6). Microsoft Clarity, which earlier versions of this policy described, was removed on 18 September 2026.
We use Umami, an open-source analytics tool, self-hosted on our own server at analytics.kailabs.cc. It uses no cookies, and no analytics data goes to any third party.
kai_utm (kailabs.cc, localStorage) —
the campaign (UTM) tags of the last link you arrived with. Expires
after 30 days; read when you submit the product-updates form.kai_ab_pricing (kailabs.cc, localStorage)
— which variant of the homepage pricing section you see, so it
stays the same between visits. Kept until you clear your browser
storage.auth_token (terminal, localStorage) —
your sign-in session. Removed when you sign out; without it you could
not stay signed in. The desktop app keeps the same token in its local
settings.kai_oauth_bind (terminal, cookie) — see
§3.You can delete these values at any time in your browser settings.
Service providers that process data for us (processors):
| Recipient | What they do for us | Data | Location |
|---|---|---|---|
| ITGLOBAL | Hosts the virtual server that runs the Service, its database and our analytics | Everything in §2 that we store | Dubai, United Arab Emirates |
| Cloudflare, Inc. | Serves kailabs.cc (Pages), DNS, TLS, the encrypted tunnel to our server, security checks, access control for our admin tools, forwarding of email sent to kailabs.cc, storage of encrypted backups (R2) | All traffic to the Service, including IP addresses and content in transit; the country derived from your IP address; your emails to us; encrypted backups | United States; global edge network |
| Resend (Plus Five Five, Inc.) | Sends our emails | Your email address and the content of each email (including the IP address and browser in sign-in alerts); internal notifications to our team about product-update signups (email, referrer, IP address) and payment problems (email, transaction ID, amount) | United States |
| Anthropic, PBC | Claude models, when you select one | AI request content (§2) | United States |
| Google LLC | Gemini models, when you select one; Google sign-in, when you use it; Google Fonts | AI request content (§2); the sign-in request; your IP address and user agent when a page loads fonts | United States |
| DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.) | DeepSeek models, when you select one | AI request content (§2) | China |
| MiniMax | MiniMax models: the default for new strategies, and always used for the market briefing | AI request content (§2); public posts from the X accounts you follow | Singapore (Nanonoble Pte. Ltd., MiniMax’s API company); data centre in the United States |
| CryptAPI | Creates a one-time deposit address for each order and forwards the payment to us | A random order reference and the amount; it also sees your blockchain transaction, including the address you pay from | Panama (CryptAPI Inc.) |
| twitterapi.io | Fetches public X (Twitter) posts for the market briefing | The X account names you follow and the text you search for | United States (Prism Digital, LLC) |
| Your browser’s push service (Google, Mozilla, Apple or Microsoft, depending on your browser) | Delivers push notifications, if you turn them on | Your push address and the encrypted message, which it cannot read | Depends on your browser’s vendor |
Recipients that act on their own account (independent controllers):
We do not sell your personal data or share it for advertising. We disclose data to authorities only where the law requires it.
Our server is in the United Arab Emirates. Cloudflare, Resend, Anthropic, Google and twitterapi.io are in the United States; DeepSeek is in China; MiniMax’s API is run by a company in Singapore from a data centre in the United States; CryptAPI is in Panama. The EU and the UK have not recognised the UAE, China, Singapore or Panama as providing adequate protection, and the EU–US Data Privacy Framework covers only certified US companies.
Where GDPR or UK GDPR applies to our processing, you have the right to:
Some of this you can do yourself in the terminal: change your email or password, turn 2FA on or off, disconnect Google or an exchange, change notification settings, export your closed trades as CSV from the History tab, and delete your account in the Security settings (see the note under §2 for what deletion does not remove yet). For anything else — including a full copy of your data — email [email protected]. We respond within one month (extendable by two further months for complex requests, GDPR Art. 12(3)). Requests are free of charge unless manifestly unfounded or excessive.
If you are a California resident and the California Consumer Privacy Act (CCPA), as amended by the CPRA, applies to us, you have the right to:
Categories of personal information we collect (CCPA categories): identifiers (email address, IP address, Google account ID, exchange API key); commercial information (plans and credits purchased, payment records); internet or network activity (page views and interface events, sign-in alerts); approximate location (country, region and city derived from your IP address); and the content you create in the Service (prompts, Chart Lab chats, trade notes). The sources are you, your browser and, if you use Google sign-in, Google. Purposes, recipients and retention are described in §2 and §6.
Sensitive personal information. Your login with its password and your exchange API credentials count as sensitive personal information under the CPRA. We use them only to provide the Service you asked for and to keep it secure, and never to infer characteristics about you, so they are not subject to the right to limit (Cal. Code Regs. tit. 11, § 7027(m)).
To exercise CCPA rights email [email protected] with subject “CCPA Request”. You may designate an authorised agent in accordance with Cal. Civ. Code § 1798.135.
The Service runs the strategy you write: the AI model you choose reads your prompts and market data and produces trading signals. By default you approve each signal yourself; if you switch on auto-approval, the Service places the orders your strategy produces within the limits you set. Live orders go to an exchange account you control, on capital you allocate, and you can pause a strategy, switch back to manual approval or disconnect the exchange at any time. These decisions are about your trades, not decisions about you with legal or similarly significant effects within the meaning of GDPR Art. 22. We do not profile you for marketing.
The Service is for adults only: the Terms require you to be at least 18 years old (or the age of majority where you live, if higher). We do not knowingly collect personal data from anyone younger. If you believe a minor has given us personal data, contact [email protected] and we will delete it.
Paid plans and credit packs are paid in cryptocurrency only, through CryptAPI. For each order we record the plan or pack, the price, the coin and amount, the deposit address created for the order, the blockchain transaction IDs, the status and the dates. We do not record the wallet address you pay from, but a blockchain is a public ledger: anyone who knows the deposit address or a transaction ID can see the sending address and the amount, permanently. We do not control the blockchain and cannot delete anything from it.
Traffic is encrypted with TLS between your browser and Cloudflare and travels through an encrypted tunnel to our server, which accepts no other inbound connections except administrative SSH. Passwords and 2FA backup codes are stored only as one-way hashes (PBKDF2). Exchange API secrets, passphrases, wallet keys and 2FA secrets are encrypted with AES-256-GCM under a key kept outside the database. Backups are encrypted before they leave the server, and the decryption key is not kept on it. Our log viewer sits behind Cloudflare Access. The rest of the database, including your email address, prompts and trading history, is not encrypted at the application level; it is protected by access controls on our server.
No system is perfectly secure. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the affected users without undue delay, and the supervisory authorities within 72 hours where GDPR requires it.
Each version is published on this page with its date and version number. When you subscribe to product updates, we record which version you accepted. When a change materially affects how we use data we already hold, we will tell account holders by email before it takes effect.
Privacy questions and data subject requests: [email protected]. General contact: [email protected].