Privacy policy

Who we are

Kakr Labs Inc. (“Kakr Labs”, “we”, “us”) provides Pteri-Auth, a cryptographic identity and authentication API for humans, devices, and AI agents.

Legal entity: Kakr Labs Inc.
Business address: 240 W Old Country Rd, Suite 1, Hicksville, NY 11801, United States
Privacy contact: privacy@kakr.ai

Scope

This policy covers personal data we process when you:

• Visit kakr.ai, gcp.pteri.org, support.kakr.ai, or phishing-race.onrender.com
• Create an account or start a trial of Pteri-Auth
• Contact our support or sales teams
• Use an application built by one of our customers on Pteri-Auth

Where a customer deploys Pteri-Auth inside their own product, that customer is the data controller for their end users and Kakr Labs acts as a data processor. Section 9 explains that relationship.

What we collect

3.1 Account and contact data

Name, work email address, company name, job title, and any information you choose to provide when contacting us.

Purpose: account administration, support, billing, and service communications.
Lawful basis: performance of a contract; our legitimate interests in operating the business.

3.2 Authentication event data

Identity references, public keys, challenge and signature verification records, timestamps, event outcomes, policy metadata, and device or agent identifiers.

We do not process the content of authenticated actions, message bodies, transaction details, payment card data, or any application data belonging to our customers.

Purpose: delivering the authentication service and producing audit records.
Lawful basis: performance of a contract; our legitimate interests in securing the service.

3.3 Technical data

IP address, browser type, device type, operating system, referring URL, pages visited, and timestamps.

Purpose: security monitoring, abuse prevention, and service performance.
Lawful basis: our legitimate interests.

3.4 Cookies and analytics

kakr.ai. With your consent, this website uses Google Analytics to measure how it is used, such as pages visited, referring site, and device and browser type. Without your consent no analytics runs and no analytics cookies are set. The site uses no advertising tools. The contact form is provided by Tally, which may use its own cookies. Details and controls are in our Cookie Policy.

Lawful basis for analytics: your consent, which you can withdraw at any time through Cookie settings.

Other KAKR sites. support.kakr.ai uses Google Analytics and wallet.pteri.org uses Google Tag Manager; the notices on those sites apply there. gcp.pteri.org and the interactive demonstrations use no analytics or tracking tools.

3.5 Interactive demonstrations

The demonstrations at phishing-race.onrender.com run in your browser and require no account.

The demonstrations set no cookies, store nothing in your browser, and use no analytics. They load fonts from Google Fonts, which receives your IP address when the page loads.

3.6 Private keys

KAKR does not hold or store customers’ private keys. Keys stay with whoever controls the identity: the user’s device, the customer’s application, or the agent or workload. Only the matching public address is registered with PTERI. If an integration uses our SignMessage endpoint, the key is sent over an encrypted connection only to create the signature and is not stored.

How we use personal data

• Providing, maintaining, and securing Pteri-Auth
• Authenticating users, devices, and agents as instructed by our customers
• Generating audit records for our customers’ compliance purposes
• Billing and account administration
• Responding to support and sales enquiries
• Detecting and preventing fraud, abuse, and security incidents
• Meeting legal and regulatory obligations

We do not use customer authentication data to train artificial intelligence or machine learning models. We do not sell personal data. We do not share personal data with advertisers.

Sharing and subprocessors

5.1 Subprocessors

Service providers who process data on our instructions:

Support requests are handled through our own support site, support.kakr.ai. We do not use third-party error-monitoring, application-logging, or support-ticketing services.

We will give customers reasonable advance notice before adding a new subprocessor.

5.2 Legal disclosure

Where required by valid legal process. We will notify affected customers unless legally prohibited from doing so.

5.3 Corporate transactions

In connection with a merger, acquisition, or sale of assets, with notice to affected individuals.

International transfers

Personal data may be transferred to and processed in the United States and the European Union.

Where personal data is transferred outside the EEA or the United Kingdom, we rely on the Standard Contractual Clauses approved by the European Commission, which are included in our service providers’ data processing terms.

Data residency: customer data is currently hosted in the United States.

Retention

When we no longer need personal data for these purposes, we delete or anonymise it, unless we must keep it to meet a legal obligation. On termination of an account, customer data is deleted as set out in the Data Processing Agreement. Customers may export their data before termination; see our Terms of Service.

Security

We maintain technical and organisational measures appropriate to the risk, including:

• Encryption in transit using TLS 1.2 and 1.3 and at rest using AES-256
• Access controls and role-based permissions
• Multi-factor authentication for internal systems
• Logging and monitoring of access to production systems
• Secure development practices including code review and dependency scanning
• Documented incident response procedures

Certification status: SOC 2 Type II is planned; KAKR Labs has not yet completed an independent audit. Current status is listed on our Security page.

Full detail is published at kakr.ai/security. Security enquiries: security@kakr.ai

Our role as controller and processor

As a controller — for personal data about our own customers, prospective customers, and website visitors, we determine the purposes and means of processing, and this policy governs.

As a processor — where a customer integrates Pteri-Auth into their own product, that customer is the controller for their end users’ personal data. We process it only on their documented instructions under a Data Processing Agreement.

Our Data Processing Agreement is available on request; see our Data processing page.

If you are an end user of a service built on Pteri-Auth, please contact that service provider to exercise your rights. We will assist them in responding.

Your rights

Depending on where you are located, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data
• Restrict or object to processing
• Receive your data in a portable format
• Withdraw consent where processing is based on consent
• Lodge a complaint with a supervisory authority

To exercise any of these rights, contact privacy@kakr.ai. We will respond within one month, as required by data protection law.

European Economic Area and United Kingdom: you may lodge a complaint with your local supervisory authority, or with the Information Commissioner’s Office in the UK.

Other locations: residents of other countries and states may have additional rights under local law. Contact privacy@kakr.ai and we will respond as that law requires.

Children

Pteri-Auth is a business product and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe we have, contact privacy@kakr.ai and we will delete it.

Changes to this policy

We may update this policy from time to time. We will post the updated version here and revise the “last updated” date. For material changes affecting customers, we will give reasonable advance notice by email.

Contact

Privacy and data protection: privacy@kakr.ai
Security: security@kakr.ai
Support: support.kakr.ai
Postal: Kakr Labs Inc., 240 W Old Country Rd, Suite 1, Hicksville, NY 11801, United States