Privacy Policy

1. About this policy

Kernel Service Pty Ltd (ABN pending) ("we", "us", "Kernel Service") operates the Kernel Service platform — an AI agent orchestration platform that enables businesses to deploy AI agents across their connected software systems.

This policy describes how we collect, use, store, and share personal information through our website (kernelservice.com), web application (app.kernelservice.com), and API. It applies to all users, including website visitors, trial users, and paying customers.

We are based in Queensland, Australia and comply with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth), the UK and EU General Data Protection Regulation (GDPR), and applicable data protection laws in the jurisdictions where we operate.

2. Information we collect

Account information

Name, email address, business name, and password (stored as a cryptographic hash — we never store plaintext passwords). If you sign in via Google or Microsoft OAuth, we receive your name and email from those providers.

Billing information

Payment processing is handled entirely by Stripe. We do not store credit card numbers, CVVs, or bank account details. We retain your Stripe customer ID, subscription status, and invoice history for account management.

Integration credentials

When you connect third-party services (such as Gmail, Xero, Google Calendar, or Slack), we store OAuth access and refresh tokens encrypted at rest. These tokens are scoped to the permissions you authorise and are used solely to perform actions on your behalf through your AI agents.

Agent activity data

When your AI agents perform tasks, we log: task inputs and outputs, reasoning traces, tool calls and their results, model provider used, token consumption, cost, and latency. This audit trail is essential for transparency, debugging, and compliance. It is stored within your tenant and is not shared with other tenants.

Communication data

If your agents send or receive emails, SMS messages, or other communications through connected integrations, the content of those communications is processed and logged within your tenant's audit trail.

Website analytics

Our website collects analytics data subject to your consent preference (see Section 5). This may include: session identifier, pages visited, scroll depth, button clicks, UTM campaign parameters, referring URL, user agent string, and country (derived from Cloudflare headers — we never store IP addresses).

3. How we use your information

• Provide the Service — operate the platform, execute agent tasks, maintain integrations, and deliver the features you use.
• Process tasks through AI models — send task data to third-party LLM providers for processing (see Section 4).
• Billing and account management — process payments via Stripe, track credit consumption, manage subscriptions.
• Website analytics — understand how visitors interact with our website, subject to your consent preference.
• Security and fraud prevention — monitor for unauthorised access, abuse, and security threats.
• Communications — send transactional emails (OTP codes, password resets, account notifications). We will only send marketing communications with your explicit consent.
• Legal compliance — meet our obligations under applicable laws, including tax reporting and regulatory requirements.

4. AI and third-party model providers

Kernel Service processes AI agent tasks by sending data to third-party large language model (LLM) providers. This is a core part of how the Service works and we want to be transparent about it.

Providers we use

We currently route tasks to Anthropic (Claude), OpenAI (GPT), Google (Gemini), and xAI (Grok). The specific model and provider used depends on the task type and our intelligent routing system.

What data is sent

Task prompts, conversation context, tool call inputs and outputs, and agent system prompts. This data is sent via API and is necessary for the models to generate responses and take actions.

What data is NOT sent

OAuth credentials, API keys, billing details, plaintext passwords, or data belonging to other tenants. Cross-tenant data is never included in any prompt.

Training and data use

We access all LLM providers via their commercial API tiers. Under their respective API terms, none of these providers use API data to train their models. We encourage you to review each provider's data policies:

• Anthropic Privacy Policy
• OpenAI Privacy Policy
• Google Privacy Policy
• xAI Privacy Policy

Audit trail

Every LLM call is logged with the model used, tokens consumed, cost, and latency. This is visible to you in your tenant's audit trail.

5. Cookies and tracking

Our website uses a consent-based tracking system with three levels. You choose your preference via the consent banner shown on your first visit.

We use localStorage to store your consent preference and session/visitor identifiers. We do not use third-party advertising trackers, Facebook Pixel, or Google Ads tags.

Country is derived from a Cloudflare request header. We never store IP addresses.

6. Data sharing and third parties

We share personal information only with the following categories of service providers, and only to the extent necessary to operate the Service:

We do not sell personal information. We do not share data with advertisers. We do not use your data for purposes unrelated to providing the Service.

We may disclose information when required by law, regulation, legal process, or enforceable government request.

7. Google API Services User Data Policy

Our use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We access Google user data (Gmail, Google Calendar) only to provide the features you request — such as sending emails on your behalf or reading your calendar for scheduling.
• We do not use Google user data for advertising or to build user profiles for advertising purposes.
• We do not share Google user data with third parties except as necessary to provide the Service (e.g., LLM providers for task processing) or as required by law.
• We do not use Google user data to train AI or machine learning models.

8. International data transfers

Our primary infrastructure is hosted in AWS ap-southeast-2 (Sydney, Australia). However, data may be transferred to other jurisdictions in the following circumstances:

• LLM providers — Anthropic, OpenAI, Google, and xAI may process data in the United States or other regions where their infrastructure operates.
• Stripe — payment data may be processed in the United States.

For transfers from Australia, we rely on the Attorney-General's adequacy determinations where available. For transfers from the UK/EU, we rely on Standard Contractual Clauses and the provider's applicable Data Processing Addendum.

We are building region-specific infrastructure and plan to offer data residency options (including EU/UK hosting) as the platform scales. During beta, all tenant data is hosted in Australia with the safeguards described above.

9. Data retention

After the retention period, data is deleted or anonymised from active systems and backups, subject to any legal holds or statutory obligations.

10. Security

We take the security of your data seriously. Our measures include encryption in transit (TLS 1.3) and at rest (AES-256), tenant-level data isolation, role-based access controls, and a complete audit trail of all agent actions.

For full details, see our Security page.

No online service can guarantee absolute security. If you become aware of any security issue, please contact us immediately at [email protected].

11. Your rights

Depending on your jurisdiction, you have the right to:

• Access — request a copy of the personal information we hold about you.
• Correction — request that we correct inaccurate or incomplete information.
• Deletion — request that we delete your personal information, subject to legal obligations.
• Portability — receive your data in a structured, commonly used format.
• Objection — object to specific processing activities.
• Restriction — request that we restrict certain processing of your data.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

Complaints

If you are unsatisfied with our response, you may lodge a complaint with the relevant supervisory authority:

• Australia: Office of the Australian Information Commissioner (OAIC) — oaic.gov.au
• United Kingdom: Information Commissioner's Office (ICO) — ico.org.uk
• European Union: Your national data protection authority

12. Data breach response

In the event of a data breach that is likely to result in serious harm, we will:

• Assess the breach within 30 days per the OAIC Notifiable Data Breach (NDB) scheme.
• Notify the OAIC and affected individuals as required under Australian law.
• For UK/EU data subjects, notify the relevant supervisory authority within 72 hours per GDPR requirements.
• Take steps to contain the breach and prevent recurrence.

Report suspected breaches to [email protected].

13. Children

Kernel Service is designed for businesses and is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will delete it promptly.

14. Changes to this policy

We may update this policy from time to time. For material changes, we will notify you by email or through a notice on our website at least 14 days before the changes take effect. Your continued use of the Service after changes become effective constitutes acceptance of the updated policy.

15. Contact

If you have questions about this policy or our data practices, contact us: