kopair / Legal

Privacy Policy

Last updated: 24 October 2026 · Version: 2026-10-24

This Privacy Policy explains how kopair ("kopair", "we", "us" or "our") processes personal data in connection with kopair.com, our dashboard, public Sandbox, website experimentation software, SDK and related support (the "Services"). Our privacy contact is info@kopair.com.

This Policy is a notice about our practices. Acknowledging it does not constitute consent to optional analytics, marketing, or every processing activity described below. Where consent is required, it must be obtained separately.

1. Our role and scope

kopair determines the purposes and means of processing account, service administration, billing, support and security information for its own operations and acts as controller for that information where that concept applies. When a customer uses the Services to collect and analyse information about visitors to its website, the customer determines the purposes of that processing and ordinarily acts as controller; kopair processes that customer data on the customer's instructions as processor or service provider, subject to applicable law and any required data processing agreement.

If you visit a customer's website, contact that website's operator first about its experiments, cookies, legal bases and your choices. We assist customers with requests concerning data we process on their behalf. This Policy does not replace their privacy notices. Before submitting personal data on behalf of others, customers must establish the necessary notices, permissions and contractual arrangements, including a data processing agreement where required.

2. Information we process

• Account and authentication information: email address, verification status, user and workspace identifiers, membership and access permissions, authentication challenge records, session records, and the document versions and timestamps associated with acceptance of our Terms and acknowledgment of this Policy. One-time codes are verified using cryptographic hashes rather than stored in readable form.
• Customer configuration and content: website addresses, experiment names and hypotheses, goals, selectors, variation rules, revisions, schedules, reports, configuration choices, and content you submit to the editor or support.
• Experiment and technical information: pseudonymous visitor identifiers, experiment and variant assignments, impressions, configured conversion events, timestamps, page origin and path, assignment context and delivery status. The SDK's normal event payload omits URL query strings and fragments. Information intentionally or accidentally placed in page paths, custom event names, identifiers, or submitted content may nevertheless identify a person. Pseudonymous data is not necessarily anonymous.
• Sandbox information: the public page you request, rendered page content and screenshots, selected elements, commands and preview changes. A browser operated by our renderer retrieves the page and its resources. Those resources and third-party websites may receive network requests from the renderer. Do not open confidential or personal-data-heavy pages in the public demo.
• AI information: prompts, a limited recent conversation history, element structure, style information, and selected or limited page text used to answer a request. Some page-text signals are masked or limited, but this does not guarantee removal of all personal data. Do not submit passwords, authentication tokens, payment credentials, special-category data or information you are not permitted to disclose.
• Support, billing and security information: correspondence, purchase requests, credit grants and usage records, payment or invoice details you provide, and necessary connection and security information. Servers and service providers receive IP addresses when establishing connections. Rate-limit records may use hashed identifiers. We do not claim that hashing makes these records anonymous. If payments are handled by a separate provider, its own notice applies to information it collects directly; do not send card details to our support email.
• Page delivery: some pages request fonts from Google Fonts. The font provider receives the connection information needed to deliver those files, including an IP address and browser request headers.
• Website measurement information: the kopair.com landing page loads Google Analytics and our own experimentation software, which may process browser, device, visit and interaction information as explained in section 4. Their loading is independent of account registration and acceptance of our legal documents.

Device width, browser language, campaign parameters or referrer-host signals may be used locally by the SDK to determine eligibility for an experiment. A customer's integrations or the content it supplies can affect the data processed. Customers must avoid placing personal data in URLs, selectors, event names or experiment content unless lawful and necessary.

3. Purposes and legal bases

Where data protection law requires a legal basis, we rely on the basis appropriate to the activity:

• Contract and steps requested before a contract: creating and securing accounts, providing requested previews and experiments, delivering authentication and service messages, administering credits and responding to service requests.
• Legitimate interests, where available and balanced against your rights: preventing abuse and fraud, protecting systems, diagnosing failures, managing business relationships, and establishing or defending legal claims. Where the customer is an organisation, administration of its users may rely on these interests rather than a contract with each individual.
• Legal obligations: complying with applicable accounting, regulatory, lawful disclosure and data protection requirements.
• Consent: activities for which applicable law requires consent. Where such consent is required, acceptance of our Terms or acknowledgment of this Policy does not replace it.

Providing an email and required authentication information is necessary to create an email-based account. Without it, we cannot provide that account. Acceptance of the Terms is not consent to marketing. For customer website data, the customer must determine and communicate the applicable legal basis and obtain visitor consent where necessary.

4. Cookies, local storage and website measurement

We use browser storage for authentication, security and requested functionality. The kp_session cookie supports dashboard sessions for up to 30 days and can be renewed during authenticated use. The kp_demo cookie identifies a public demo and has a 10-minute browser lifetime. Language preferences may be held in local storage. Their storage duration differs from the lifetime of server-side records.

The kopair.com landing page loads Google Analytics (measurement identifier G-6TZ5X4ZD4L) and kopair's website experimentation script when the page is opened. These scripts are not enabled or disabled by accepting the Terms or acknowledging this Policy during registration. This description does not treat your visit or acceptance of legal documents as consent where a separate consent is required by law.

On customer websites, the SDK may use a first-party _kp_uid cookie with a maximum lifetime of one year, local storage for event delivery and enrolment, and session storage for editor, preview or eligibility state. The customer's operator is responsible for classifying these technologies and preventing their use until consent has been obtained where required. Installing kopair does not itself provide a consent management platform or establish a lawful basis.

Read Google's explanation of information collected through partner sites. Browser controls can also restrict cookies and storage, which may affect functionality. We do not sell personal data for money. Google measurement may be treated as sharing or targeted advertising under certain laws depending on its use and configuration. Browser or extension controls can block measurement requests and restrict related cookies or storage; availability of those controls does not replace any consent or other obligations imposed by applicable law.

5. Recipients, AI providers and international processing

We disclose information only as reasonably necessary to provide and protect the Services, comply with law, or undertake the activities described here. Recipients can include hosting and infrastructure providers, email delivery providers, AI providers, support and professional advisers, and providers handling authorised billing arrangements. Authorised workspace members may access that workspace's information. Customer-configured webhooks, email notifications or Telegram integrations deliver selected information to the destinations the customer chooses.

The current AI integration uses DeepSeek. When you request AI assistance, relevant inputs described in section 2 are sent through its API. Its services may process information in China. Provider-specific retention, training restrictions and transfer arrangements depend on the applicable API agreement and configuration; this Policy does not promise that provider inputs are never retained or used for improvement. The provider's platform privacy information is additional information, not a substitute for our obligations or a customer data processing agreement.

Information may be processed outside your country. Where a transfer is subject to restrictions, the applicable adequacy decision, contractual safeguards or other legally available mechanism must be in place before that transfer. A checkbox acknowledging this Policy is not a blanket authorisation to bypass those requirements. Contact us for the providers, processing locations and transfer arrangements applicable to your intended use before submitting regulated or sensitive data.

We may also disclose information to competent authorities where legally required, to protect rights or safety, or in connection with a proposed merger, financing or transfer of business, subject to applicable safeguards. We do not grant unrestricted public access to customer data.

6. Retention and deletion

We retain personal data for as long as reasonably necessary for the purpose for which it was collected, taking account of account status, the customer's instructions, legal retention duties, security needs, billing reconciliation, dispute periods and the nature of the data. Account and experiment records can remain while a workspace is active. Contract-acceptance and billing records may need to remain longer to meet legal obligations or establish or defend claims.

Authentication codes expire after 10 minutes; expiry prevents their use but is not a promise that the associated database record is automatically deleted at that instant. Public demo sessions have a 10-minute maximum lifetime and are released on closure or expiry; draft edits and conversation state in the public demo are temporary. Copies sent to AI or other providers are subject to their applicable processing arrangements.

You may request account or customer-data deletion at info@kopair.com. We verify authority, assess applicable exceptions, and communicate the action taken. Information may remain in restricted backups until their normal replacement cycle, or longer where a legal hold applies. Closing an editor, removing the SDK, or allowing a cookie to expire does not itself delete stored account or experiment records.

7. Security

We use measures intended to limit unauthorised access, including access controls, session protections and cryptographic verification of sign-in codes. Customers must protect their email accounts, workspace access, API credentials and integration destinations. No transmission, storage system or software can be guaranteed completely secure. Where applicable law requires notification of a personal data breach, we will make the notifications required of us.

8. Your rights and requests

Depending on your location and the applicable law, you may have rights to access, correct, delete, restrict processing of, or receive a portable copy of your personal data; object to processing based on legitimate interests; withdraw consent without affecting the lawfulness of earlier processing; and complain to the competent data protection authority. Certain rights are subject to statutory conditions and exceptions. We do not use account data to make solely automated decisions producing legal or similarly significant effects about you.

Send requests to info@kopair.com. We may request proportionate information to verify your identity or authority, and respond within the period required by applicable law. Where we act for a customer, we will refer the request to that customer or assist it as required. We do not discriminate against individuals for exercising rights protected by applicable law.

9. Children

The Services are intended for adults using them for business or professional purposes, not for children. Do not submit information about children to the public demo or AI features. If you believe a child has supplied personal data to us without a lawful basis, contact us so that we can investigate and take appropriate action.

10. Changes and contact

We may update this Policy to reflect changes in the Services or legal requirements. The version and last-updated date identify the applicable text. We will provide additional notice where required and seek new consent where a change requires it. For privacy, security, rights requests or questions, contact info@kopair.com.