Privacy Policy

Last updated: 15 November 2026 (draft).

1. Who is responsible

Alberto Ferrer operates Kosken and decides how personal data is used. Contact: alberto@kosken.ai.

When a workspace owner connects machines, the owner decides what data from those machines Kosken reads. For that data we act for the owner.

2. What we collect

Account data

Your name, your email address, how you sign in (password, passkey, or single sign-on), your role in each workspace, and the time of your sign-ins.

Data from your machines

Host names, system facts, health signals, metrics, and the text that Kosken reads when it investigates an incident, such as log lines and command output. This text can contain personal data. Kosken removes secrets that it recognizes before it sends context to a model provider. It cannot find every secret.

Incidents and reports

The incident, the evidence, the report, the approvals, and the result of each action.

Audit log

A record of who did what and when. Each entry is linked to the one before it, so a change to an old entry can be detected.

Billing data

We do not take payment now. When we do, a payment provider will handle card data. We will keep only identifiers and the state of your subscription.

Technical data

Our server records your IP address and the request when you use the service. We use this to keep the service safe and to find faults.

3. Why we use it, and on what basis

To give you the service that you asked for (contract).
To keep the service safe and to prevent abuse (our legitimate interest).
To follow the law (legal duty).
To send you a message that you asked for, or a notice about the service.

We do not sell your data. We do not use it for advertising. We do not use it to train models.

4. Who receives it

Model providers. You choose the provider and supply the key. Kosken sends the provider the context for a task, after redaction. The provider handles it under its own terms. Kosken can use OpenAI, Anthropic, or DeepSeek endpoints.
Hosting. The service runs on a server that we rent.
Payment provider. Stripe, when billing starts.
Authorities. Only when the law requires it.

Each workspace has its own sealed keys. A person in another workspace cannot read your data. Our staff access to production data is limited to what is needed to run and repair the service.

5. How long we keep it

The default periods are below. A workspace owner can change some of them.

Raw heartbeats from machines: 2 days.
Metrics at one-minute detail: 14 days.
Metrics at 15-minute detail: 400 days.
Raw signal deliveries: 7 days.
Notification delivery records: 90 days.
Incident history: 400 days. The workspace owner can set 30 to 1,095 days.
Model usage records: 400 days.
Records of a deleted account: 5 years.

When a workspace is deleted, we remove its data after the waiting period. Backups can keep a copy for a short time more.

6. Your rights

You can ask us to give you a copy of your data, to correct it, to delete it, to limit its use, or to move it to another service. You can object to a use that rests on our legitimate interest. Write to alberto@kosken.ai. If you are not happy with our answer, you can complain to the data protection authority where you live. If your data is in a workspace that you do not own, we can pass your request to the owner.

7. Cookies

Kosken uses cookies that the service needs: to keep you signed in, to protect forms, to remember your language, and to remember your workspace. The public site stores your theme choice in your browser. We do not use advertising or tracking cookies.

8. Where data goes

Your data is stored on the server that runs Kosken. When Kosken calls a model provider that you chose, the context for that task goes to the endpoint of that provider.

9. Security

We encrypt data in transit. We seal secrets such as model keys with keys that are separate for each workspace. We separate workspaces in the database. No system is fully safe. If a breach affects your data, we will tell you without undue delay.

10. Children

Kosken is for people who manage servers at work. It is not for children.

11. Changes

We will post a new date here when we change this text. For a change that matters, we will tell the workspace owner by email.