Privacy Statement
This Privacy Statement explains how we collect and process personal information from visitors of koryki.ai and users of the demo at demo.koryki.ai ("you", "your").
Controller
Johannes Zemlin
c/o Block Services
Stuttgarter Str. 106
70736 Fellbach, Germany
[email protected]
What we process, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Questions you type, generated queries, and the names and sample values of the data you query | Answering your question — this is what the service does | Art. 6(1)(b) — performance of the service you requested |
| Files you upload (CSV, Excel, DuckDB, SQLite) and their contents | Running your queries against your own data | Art. 6(1)(b) |
| Account details from your identity provider: subject id, e-mail address, name | Signing you in, lifting the anonymous usage limit | Art. 6(1)(b) |
| Server logs: IP address, request data, your question text, and your e-mail address if signed in | Operating the service, diagnosing faults, improving answer quality | Art. 6(1)(f) — our legitimate interest in a working, improvable service |
| Bot-check signals (IP address, browser characteristics) and a rate-limit counter | Preventing automated abuse of a service that costs money per request | Art. 6(1)(f) — our legitimate interest in preventing misuse |
Recipients, including outside the EU
We do not sell personal information. To provide the service we use the following processors and services:
| Recipient | What it receives | Where |
|---|---|---|
| Anthropic PBC (Claude) | Your question, plus the table names, column names and a few sample values of the data being queried — this is what allows a query to be generated at all | USA |
| Google Ireland Ltd. / Google LLC (sign-in, hosting) | Sign-in: the account data listed above. Hosting: all request data | EU and USA |
| Cloudflare, Inc. (Turnstile bot check) | IP address and browser characteristics when the check runs | USA |
Transfers to the USA take place on the basis of the EU Commission's adequacy decision for the EU–US Data Privacy Framework where the recipient is certified, and otherwise on the basis of Standard Contractual Clauses under Art. 46(2)(c) GDPR.
We may also disclose personal information where we are required to do so by law, to establish or defend legal claims, or to investigate suspected abuse of the service.
Do not upload confidential or personal data
The demo is a public showcase. It is not operated under a data-processing agreement and is not intended for data covered by the GDPR. Please upload anonymised or example data only. If you upload personal data of third parties, you do so as the controller for that data and without a data-processing agreement with us.
Cookies and local storage
We use no advertising or tracking cookies and no analytics. What is stored is limited to what the service needs to work:
| Name | Purpose | Lifetime |
|---|---|---|
SESSION (cookie) | Keeps your session — sign-in state and the current conversation | Session |
ts_clearance (cookie) | Records that the bot check was passed, so it is not repeated on every request | 2 hours |
koryki.language, koryki.theme, koryki.ui-mode (local storage) | Your language, colour scheme and view preferences | Until you clear your browser storage |
These are strictly necessary for a service you requested and therefore do not require consent under §25(2) TDDDG.
How long we keep it
- Uploaded files are deleted when you sign out, after 30 minutes without a question, and whenever the service restarts. They are not kept beyond your session.
- Conversation history lives in your session only and is discarded with it.
- Server logs, which contain your question text and — if you are signed in — your e-mail address, are retained for up to 90 days for operations and quality, and for up to one year where needed for security and system integrity.
Longer retention applies only where we are subject to statutory retention periods or need the data for ongoing legal proceedings.
Your rights
You have the right to request access to your personal data (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), and to object to processing based on our legitimate interests (Art. 21). Where processing is based on consent, you may withdraw it at any time with effect for the future.
To exercise any of these, write to [email protected].
You also have the right to lodge a complaint with a supervisory authority (Art. 77). The authority responsible for us is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstr. 20, 70173 Stuttgart.
Automated decision-making
The service uses a language model to turn your question into a database query. It does not make automated decisions producing legal or similarly significant effects concerning you within the meaning of Art. 22 GDPR.
