Privacy Policy

1. Introduction

kōdōkalabs (“we,” “our,” or “us”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or engage our services.

We operate globally. If you are located in the European Economic Area (EEA), we process data in compliance with the General Data Protection Regulation (GDPR). If you are a resident of California, we process data in compliance with the California Consumer Privacy Act (CCPA) and CPRA.

Effective Date: 07.10.2024 Last Updated: 05.11.2026

2. Controller Information (GDPR)

The Data Controller responsible for the processing of your data is:

kōdōkalabs LLC

30 N Gould St, Suite N, Sheridan, WY 82801, United States

Email: privacy@kodokalabs.com

3. Data We Collect

We may collect the following categories of personal data:

A. Information You Provide to Us

• Identity Data: Name, username, or similar identifier.
• Contact Data: Billing address, email address, telephone numbers.
• Business Data: Company name, job title, website URL.
• Content Data: Text input, strategy documents, or briefs you upload for our AI services.

B. Information Collected Automatically

• Technical Data: IP address, browser type and version, time zone setting, browser plug-in types, operating system, and platform.
• Usage Data: Information about how you use our website, products, and services (via Cookies).

4. How We Use Your Data & Legal Basis (GDPR)

5. Data Storage, Hosting, and International Transfers

Our website and digital infrastructure are hosted on secure, professional servers located exclusively in Germany (European Union).

What this means for our users:

• High Data Protection Standards: Personal data collected through this website (such as IP addresses and contact form entries) is stored and processed on our servers within the European Union. This ensures that your data is handled in strict compliance with the European General Data Protection Regulation (GDPR), which provides some of the highest privacy standards globally.
• Website Hosting in the EU: The website itself, its server logs and the form submissions it receives are hosted on our servers in Germany, not on US cloud infrastructure.
• Security Infrastructure: The data centers we utilize in Germany maintain top-tier industry certifications (including ISO 27001), ensuring maximum physical and digital security against unauthorized access.
• Third-Party Services Outside the EU: Some services we use are provided by companies based in the United States and may process personal data there: Google Analytics 4 and Google reCAPTCHA (Google), Kit (newsletter), and the tools we use to deliver our services (e.g., OpenAI, Google Workspace, AWS). Google Analytics only runs after you consent in the cookie banner. reCAPTCHA is loaded only on pages with a form, when you start using the form. Our CRM, HubSpot, stores our data in its EU data center.

By using our services or contacting us through this website, you acknowledge that your data will be processed on these German-based servers. Where we transfer data to third-party providers outside the EU (such as the services listed above, global payment processors or scheduling software), we ensure that appropriate safeguards, such as the EU-U.S. Data Privacy Framework or Standard Contractual Clauses (SCCs), are strictly in place.

6. Contact and Booking Forms

Data. First name, last name, email address, company (required in the booking form, otherwise optional), role (booking form), enquiry type, subject and comments (contact form), current AI adoption stage and message (booking form, optional), and, if you tick the box, your wish to receive the newsletter. You must tick a privacy checkbox before you can send a form. When your submission is accepted, we record the time of that confirmation (the consent timestamp) together with your enquiry.

Purpose and legal basis. We use the data to answer your enquiry or booking request and to prepare a possible engagement: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR). Keeping the enquiry and the consent timestamp in our CRM, so that we can follow up and show what you confirmed, is our legitimate interest in organised business communication (Art. 6(1)(f) GDPR). The optional newsletter subscription is based on your consent (Art. 6(1)(a) GDPR, see section 7).

How it is processed. Your browser sends the form to our website server in Germany. After the spam checks (an invisible honeypot field, Google reCAPTCHA as described in section 5, and a rate limit, see section 11), the server forwards the submission, digitally signed, to our workflow automation n8n. n8n runs on our own servers in Germany and is connected to the website server over an encrypted private network; it is not reachable from the public internet. If that connection is temporarily unavailable, the website server holds your submission in a temporary buffer until it can be delivered; the buffer is lost when the server restarts. From n8n:

• HubSpot CRM: n8n creates or updates a contact (first name, last name, email address, company) and a deal for your enquiry, and stores the consent timestamp with the contact. HubSpot stores this data in its EU data center. HubSpot is our processor; we have signed a data processing agreement with HubSpot, and where HubSpot or its group companies access data from outside the EU, the safeguards described in section 5 (EU-U.S. Data Privacy Framework or Standard Contractual Clauses) apply.
• Notification to us: n8n informs us by email and by Telegram message that a new submission has been made. These notifications do not contain the content of your submission. The mail service runs on our own server in Germany (Host Europe) and also sends the notification emails and, for the assessment, the PDF report. Telegram is a messaging service operated outside our own infrastructure.
• Newsletter: if you ticked the newsletter box, n8n passes your email address to Kit (section 7).

We do not sell the contents of your form and do not use them to build advertising profiles.

Retention. If your enquiry leads to a contract, we keep it and the related CRM records for the duration of the contractual relationship plus 10 years. If it does not lead to a contract, we delete it after 12 months.

7. Newsletter (Kit)

Data. Your email address and the language of the page on which you subscribed, whether you subscribe through a signup block on the website or through the newsletter checkbox of a form.

Purpose and legal basis. To send you our newsletter, based on your consent (Art. 6(1)(a) GDPR). We use a double opt-in procedure: after you sign up, Kit sends you an email with a confirmation link, and you are subscribed only after you click it. Each newsletter contains an unsubscribe link.

Recipient and transfer. Kit, a provider based in the United States, acts as our processor and stores the subscriber list. Your signup reaches Kit through n8n on our own infrastructure. We use a separate Kit form for each language (English, German, Spanish). Because Kit is based in the United States, the transfer safeguards described in section 5 apply: we have signed a data processing agreement with Kit, and the transfer rests on the EU-U.S. Data Privacy Framework or Standard Contractual Clauses.

Withdrawal. You can withdraw your consent at any time with the unsubscribe link in any newsletter or by email to privacy@kodokalabs.com. We then remove you from the subscriber list. When you unsubscribe, your address is removed from the list; Kit does this automatically. Otherwise we keep the subscription for the duration of the contractual relationship plus 10 years.

8. AI Marketing Maturity Assessment

Data. Your answers to the 28 questions of the assessment, the version of the questionnaire, your first name and email address and, if you choose to provide them, your last name, company and role. You must tick a privacy checkbox before you can submit the assessment, and we record the time of that confirmation (the consent timestamp) with your submission. If you tick the newsletter box, we also subscribe you to the newsletter (section 7).

Purpose and legal basis. To calculate your maturity score, write your personalised evaluation and send you the result as a PDF report by email: performance of the service you requested (Art. 6(1)(b) GDPR), with the privacy confirmation described above. Storing your contact details and result as a lead in our CRM, so that we can follow up on your assessment in a business context, is our legitimate interest (Art. 6(1)(f) GDPR). You may object to this at any time (section 12).

How it is processed.

• Scoring and narrative: The score is calculated by a fixed, versioned scoring rule. The explanatory text is generated by a language model that we run ourselves on our own servers in Germany. Your answers are not sent to any external AI provider, and we do not use them to train models. The external AI services mentioned in sections 5 and 14 relate to our consulting work for clients, not to this assessment.
• PDF and email: n8n creates the PDF report with a document service on our own servers in Germany and emails it to the address you entered, using our own mail service (Host Europe, Germany).
• Transmission: As with the forms, your submission goes from the website server to n8n over an encrypted private network, after the spam checks described in sections 5 and 11.
• HubSpot: n8n creates or updates your contact and a deal for the assessment in HubSpot (EU data center), as described in section 6.

Retention. We keep your answers and result for the duration of the contractual relationship plus 10 years.

9. Consent Management and Cookie Preferences

When you first visit the website, a consent banner (CookieConsent, an open-source tool that we host ourselves) asks you to accept or reject the optional categories Analytics and Marketing. Strictly necessary functions are always on. You can change your choice at any time through “Cookie Settings” in the footer.

• Consent cookie: Your choice is stored in the first-party cookie kdk_consent in your browser. It holds an anonymous random consent identifier, your choice per category and the version of the consent text. It expires after 182 days, after which we ask you again. Your language and theme settings are stored locally in your browser.
• Consent log: To be able to show which choice was made, each decision (the first choice and every later change) is sent to our website server and recorded as one entry: the random consent identifier, the time, the version of the consent text, your choice per category and the page language. The log does not contain your IP address or browser details, so we cannot connect an entry to you. Entries are written to a file on our own server in Germany and deleted after 12 months: when a new monthly log file is started, files older than 12 months are removed automatically.
• Legal basis: Storing the cookie is necessary for the technical operation of the consent function (§ 25(2) TDDDG). The log is based on our legitimate interest in being able to demonstrate valid consent (Art. 6(1)(f) and Art. 7(1) GDPR).
• Withdrawal: You can withdraw consent at any time with effect for the future. When you withdraw a category, the related cookies are deleted and the page reloads.

10. Analytics and Marketing Tracking

Neither tool below is loaded, and no data is sent to its provider, before you have accepted the matching category. If you reject the category or do not decide, nothing is loaded.

A. Google Analytics 4 (Analytics category). Provider: Google. We use it to understand how the website is used (for example pages visited, session length, traffic sources) so that we can improve it. It uses cookies and similar technologies and sends usage data, including your IP address, to Google, which may process it in the United States (see section 5). We have signed a data processing agreement with Google, and the transfer rests on the EU-U.S. Data Privacy Framework or Standard Contractual Clauses. We use Google Consent Mode v2: all signals are denied by default, and only the analytics storage signal is granted when you accept Analytics. The advertising signals (ad storage, ad user data, ad personalization) are always denied, because we do not use Google advertising products. Legal basis: your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG).

B. HubSpot tracking (Marketing category). Provider: HubSpot (EU data center). We use the HubSpot tracking code to recognise returning visitors and to connect enquiries you send us with the pages you visited before. It sets the cookies hubspotutk, __hstc, __hssc and __hssrc. Legal basis: your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG).

You can withdraw your consent for either tool at any time through “Cookie Settings”. Details on the cookies are in our Cookie Policy.

11. Server Logs and Abuse Prevention

When you visit the website, our web server and the proxy in front of it process technical data such as your IP address, the date and time, the requested page and the browser type, to deliver the website and keep it secure. Legal basis: legitimate interests (Art. 6(1)(f) GDPR) in a stable and secure website. We delete server logs after 12 months.

For the forms, the newsletter signup, the assessment and the consent function we also use a rate limit that prevents automated misuse. For this, your IP address is processed transiently in the working memory of the website server, only to count requests within a short time window. It is not written to disk, and the counter is cleared when the server restarts. Our application logs contain technical error messages only, not the contents of your submissions and not your contact details. Legal basis: legitimate interests (Art. 6(1)(f) GDPR) in preventing abuse.

The editing area of the website is available to our editors only and does not process visitor data.

12. Your Rights (GDPR)

If you are an EEA resident, you have the right to:

• Access: Request copies of your personal data.
• Correction: Request correction of inaccurate data.
• Erasure: Request deletion of your data (“Right to be Forgotten”).
• Restriction: Request restriction of processing.
• Portability: Request transfer of your data to another entity.
• Withdraw Consent: Withdraw consent at any time (e.g., for newsletters).

To exercise these rights, email privacy@kodokalabs.com.

13. Notice to California Residents (CCPA/CPRA)

This section applies solely to visitors, users, and others who reside in the State of California.

A. Categories of Personal Information Collected (Last 12 Months)

• Identifiers: Real name, IP address, email address.
• Commercial Information: Records of products/services purchased.
• Internet Activity: Browsing history, search history, interaction with our website.
• Professional Data: Job title, employer info (B2B context).

B. Your Rights Under CCPA

• Right to Know: You may request disclosure of the specific pieces of personal information we have collected.
• Right to Delete: You may request the deletion of your personal information (subject to certain exceptions).
• Right to Opt-Out of Sale/Sharing: We do not sell your personal information for monetary value. However, we use cookies for analytics which may be considered “sharing” under CCPA. You may opt-out via our Cookie Settings.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
• “Do Not Sell My Personal Information”: To exercise your opt-out rights, please click the “Cookie Preferences” link in the footer or email us.

14. AI & Data Retention

• Client Input Data: We do not use your proprietary business data or content inputs to train public AI models. Data processed via API (OpenAI/Anthropic) is subject to strict data retention policies (typically deleted after 30 days by the provider) and is contractually opted-out of training.
• General Retention: We retain personal data only as long as necessary to fulfill the purposes we collected it for, including legal, accounting, or reporting requirements.

15. Contact Us

For any privacy-related questions: Email: privacy@kodokalabs.com Address: kōdōkalabs LLC | 30 N Gould St, Suite N, Sheridan, WY 82801, United States