What we hold, and why.

Account data: the name, work email and organisation you give us when you create an account, plus authentication records so we can keep you signed in.

Workspace data: the sources you upload, the standards and checks you configure, the deliverables produced, and the approvals recorded against them.

Operational data: logs of requests, errors and runs, used to keep the service working and to investigate problems. These include timestamps, IP address and browser details.

Site analytics: on this website we count page views and clicks on calls to action. We store the page, the campaign tag or referring site, and the country. We do not use cookies or visitor identifiers for this, our analytics records do not include IP addresses, and we respect Do Not Track.

The guided brief tool keeps your notes in the browser. The requirements review reads PDF, DOCX, TXT and Markdown files locally on your device. After you preview the text and consent, that text is sent to Cloudflare Workers AI. Kryterea does not persist your file, submitted text or AI report. We count tool events without the working text, answers or findings. Browser extensions and input services are outside our control.

The free requirements review verifies your email using a six-digit code delivered by our marketing email provider, Resend. This does not create a product account or subscribe you to marketing. The review service stores a keyed, pseudonymous identifier derived from your email, a consumed-review counter, and temporary verification and request metadata. It does not store your raw email address. These records enforce three total free reviews per verified email.

We do not collect special category data, and the product is not designed to hold it. If your material contains it, tell us before a pilot begins.

Uploaded sources and produced deliverables belong to you. We process them to run the product on your instruction, and for no other purpose.

Each customer's workspaces, sources and deliverables are separated. A run cannot read material outside the project it belongs to.

Our staff do not read your content as a matter of routine. Access happens only where you ask for support that requires it, or where we are legally compelled, and it is logged.

We do not train models on your content. We do not permit our model providers to train on it either, and we contract for that explicitly.

Checking runs send the relevant material to a model provider for the duration of the run. That material is not retained by the provider for training and is not used to improve their models.

Where we improve our own checks and prompts, we work from aggregate signals and from material we have written ourselves, not from your deliverables.

Connecting Google Drive is optional. When you connect it, Kryterea asks for one permission: access to the files you choose in the Google file picker or that Kryterea creates for you (the drive.file scope). It cannot see the rest of your Drive.

We read the files you pick so they can become sources in your project, and we create files in Drive when you save or export a document there. We store an encrypted refresh token so the connection keeps working, along with the names and IDs of the files you linked.

We use Google user data only to provide these features. We do not sell it, use it for advertising, or use it to train or improve AI models. People at Kryterea do not read it except as described under Your content.

You can disconnect Drive from Integrations at any time. Disconnecting revokes Kryterea's access with Google and deletes the stored token. You can also remove access from your Google Account permissions page.

Kryterea's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use a small number of third parties to run the service. Each is bound by a data processing agreement. This list is current as of the date above and we will update it here before adding to it.

Cloud hosting, for the application, database and file storage.

A model provider, for checking and drafting runs, contracted not to train on your content. Cloudflare Workers AI processes requirements that you choose to submit from the free tool.

Error monitoring, for diagnostics and uptime, which receives no workspace content.

Email delivery, for sign-in links and service notices.

We keep workspace content for as long as the workspace exists. You can export and delete a workspace and its contents at any time, and deletion removes the material rather than hiding it.

Deleted material clears from backups within 30 days. Operational logs are kept for 90 days.

Approval records are kept for the life of the workspace, because an audit trail that can be quietly edited is not an audit trail. Deleting the workspace deletes them with it.

For the free review, verification codes expire after 10 minutes and sessions after seven days. Removing verification clears the code and invalidates your sessions. The minimal pseudonymous allowance record remains while this free offer is available, so removal does not reset the three-review limit. Contact us to request access or deletion of that remaining record. Email delivery providers process verification messages under their retention terms.

You can ask for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, or object to how we are processing it. Write to us and we will respond within 30 days.

Where Kryterea processes material on behalf of your organisation, your organisation is the controller and we act on its instructions. If you are an end user of a customer workspace, raise the request with them first and we will support it.

The product sets a session cookie so you stay signed in, and stores your theme preference locally. Neither is used for advertising.

We use privacy-preserving analytics on the marketing site to count page views. It does not set tracking cookies and does not build a profile of you.

The free requirements tool sets an essential secure session cookie on review.kryterea.com after email verification. It lasts seven days and is separate from product login. Signing out clears it. No requirement text or report is stored in browser storage by this tool.

When this policy changes materially we will say what changed and when, rather than only moving the date at the top. Customers on an active agreement will be told directly.

Questions about this policy, or about how your material is handled, go to the contact page.