kōdōkalabs
Privacy Policy

Effective Date: 07.10.2024
Last Updated: 03.11.2025

1. Introduction

kōdōkalabs (“we,” “our,” or “us”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or engage our services.

We operate globally. If you are located in the European Economic Area (EEA), we process data in compliance with the General Data Protection Regulation (GDPR). If you are a resident of California, we process data in compliance with the California Consumer Privacy Act (CCPA) and CPRA.

2. Controller Information (GDPR)

The Data Controller responsible for the processing of your data is:

kōdōkalabs
[Street Address]
[City, Zip, Country]
Email: privacy@kodokalabs.com

3. Data We Collect

We may collect the following categories of personal data:

A. Information You Provide to Us

Identity Data: Name, username, or similar identifier.
Contact Data: Billing address, email address, telephone numbers.
Business Data: Company name, job title, website URL.
Content Data: Text input, strategy documents, or briefs you upload for our AI services.

B. Information Collected Automatically

Technical Data: IP address, browser type and version, time zone setting, browser plug-in types, operating system, and platform.
Usage Data: Information about how you use our website, products, and services (via Cookies).

4. How We Use Your Data & Legal Basis (GDPR)

Purpose/Activity

Type of Data

Legal Basis for Processing

To register you
as a new client

Identity, Contact

Performance of a Contract (Art. 6(1)(b) GDPR)

To provide AI
consulting services

Identity, Business, Content

Performance of a Contract (Art. 6(1)(b) GDPR)

To manage our relationship (invoicing, support)

Identity, Contact, Financial

Performance of a Contract, Legal Obligation

To administer and protect
our business (site security)

Technical, Usage

Legitimate Interests (Art. 6(1)(f) GDPR)

To send the "Pilot Program" Newsletter

Contact, Identity

Consent (Art. 6(1)(a) GDPR)

5. International Data Transfers

As a modern agency, we use third-party tools (e.g., OpenAI, Google Workspace, AWS) that may process data in the United States.

EU-US Data Privacy Framework: Where applicable, we rely on the adequacy decision for the EU-US Data Privacy Framework.
Standard Contractual Clauses (SCCs): For providers not under the Framework, we implement European Commission-approved SCCs to ensure the safety of your data during transfer.

6. Your Rights (GDPR)

If you are an EEA resident, you have the right to:

Access: Request copies of your personal data.
Correction: Request correction of inaccurate data.
Erasure: Request deletion of your data (“Right to be Forgotten”).
Restriction: Request restriction of processing.
Portability: Request transfer of your data to another entity.
Withdraw Consent: Withdraw consent at any time (e.g., for newsletters).

To exercise these rights, email privacy@kodokalabs.com.

7. Notice to California Residents (CCPA/CPRA)

This section applies solely to visitors, users, and others who reside in the State of California.

A. Categories of Personal Information Collected (Last 12 Months)

Identifiers: Real name, IP address, email address.
Commercial Information: Records of products/services purchased.
Internet Activity: Browsing history, search history, interaction with our website.
Professional Data: Job title, employer info (B2B context).

B. Your Rights Under CCPA

Right to Know: You may request disclosure of the specific pieces of personal information we have collected.
Right to Delete: You may request the deletion of your personal information (subject to certain exceptions).
Right to Opt-Out of Sale/Sharing: We do not sell your personal information for monetary value. However, we use cookies for analytics which may be considered “sharing” under CCPA. You may opt-out via our Cookie Settings.
Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
“Do Not Sell My Personal Information”: To exercise your opt-out rights, please click the “Cookie Preferences” link in the footer or email us.

8. AI & Data Retention

Client Input Data: We do not use your proprietary business data or content inputs to train public AI models. Data processed via API (OpenAI/Anthropic) is subject to strict data retention policies (typically deleted after 30 days by the provider) and is contractually opted-out of training.
General Retention: We retain personal data only as long as necessary to fulfill the purposes we collected it for, including legal, accounting, or reporting requirements.

9. Contact Us

For any privacy-related questions:
Email: privacy@kodokalabs.com
Address: [Street Address, City, Germany]