Privacy policy

KolaOS provides development workstations and team tools. In this policy, "we" and "us" mean KolaOS. The policy covers personal information handled through our website, sales conversations and service.

For account administration and our own business operations, KolaOS determines how personal information is used. For content your organization puts into the service, your organization determines its use, and KolaOS processes it to provide the service. The data processing addendum sets the terms when incorporated into your organization's agreement.

Contact hello@usekolaos.com with privacy questions or requests. If you use KolaOS through an employer or another organization, its admins also control your membership and workspace settings.

• Account and organization information, including names, email addresses, memberships, roles and sign-in records.
• Service information, including workstation settings, resource usage, connection records, audit events and billing references. Stripe handles payment card entry.
• Customer content needed for the features you use, including repositories, files, agent sessions, prompts and model responses.
• Information you give us when you request a demo or support, including your contact details, booking answers and correspondence.

We use information to provide and administer KolaOS, authenticate users, apply your organization's settings, bill for usage, answer requests and investigate failures or misuse.

Where applicable law requires a legal basis, processing supports our contract with you, our legitimate interests in operating and protecting the service, or a legal obligation. Where we rely on consent, you can withdraw it by contacting us.

Your deployment determines where workstation files and session content are processed. AI requests send the content needed for the request to the configured model provider. The provider's terms and data practices also apply.

Requests routed through the AI gateway are recorded, including prompts and model responses, and recording cannot currently be turned off. Organization admins can read prompt records and choose a retention period of 7, 30, 90 or 365 days. The default is 30 days.

For KolaOS Cloud and customer AWS deployments, gateway prompt records currently use KolaOS regional storage. On your own servers, prompt text stays in the AI gateway's local store and is fetched through the API when an admin opens a record. The hosted control plane stores the record index.

After you accept optional analytics, the public website can use PostHog for anonymous usage events, performance measurements and error types. Website analytics use memory storage and cookieless mode, with session recording and automatic interaction capture disabled. Demo contact fields are not included in those events. Use Change cookies in the footer to withdraw consent. The cookie policy lists the storage and controls, including Google Analytics, which runs alongside PostHog after you accept.

Product telemetry uses a separate organization setting controlled by admins. Standard customer telemetry includes operational metadata rather than source code, prompts or session transcripts. Read the telemetry page for the fields, defaults and controls.

Sign-in and third-party services may use cookies or similar storage for their own functions. The Cal.com calendar loads after you select Load calendar at the scheduling step of the demo form, and receives the name, work email and domain you entered.

We use service providers for hosting, identity, payments, scheduling and telemetry. They include Cloudflare, Microsoft Azure, Amazon Web Services, Hetzner, WorkOS, Stripe, Resend, Cal.com and PostHog, depending on the service and deployment. AI requests also go to the providers configured for your organization.

Information may be processed in countries outside your own. A workstation's region does not mean that all account, billing, telemetry or support information stays there. Product telemetry currently uses the US PostHog project unless the EU project is configured.

We may disclose information where required by law or necessary to investigate abuse and protect the service. Contact us for the processing locations, provider details and transfer terms that apply to your deployment.

Retention depends on the type of information, your organization's settings and the applicable agreement. Account, billing and security records may need to remain for service administration, legal obligations or disputes.

Prompt record deletion follows the admin's retention setting. Deletion runs in batches and retries failed storage operations, so a backlog or an unavailable server can delay removal. Turning telemetry off stops new sharing and does not delete information already sent.

Ask us for deletion or the retention details for a particular category of information. Your organization may need to authorize a request involving its content.

Depending on the law that applies, you may have rights to access, correct, delete, restrict or object to the use of your personal information, or receive a portable copy. You may also withdraw consent where consent is the basis for processing and complain to your local data protection authority.

Send requests to hello@usekolaos.com. We may verify your identity and coordinate with your organization before acting. For information your organization controls, contact its admin as well.

We will update the date on this page when the policy changes. Where a change requires notice or consent under applicable law or your agreement, we will follow those requirements.