What we know about you, why, and for how long. Documents are never part of it.
The Web SDK opens, edits and saves documents inside the browser, so no document, file name, text or field value ever reaches us. That leaves two kinds of data this policy has to account for: what our customers give us to run an account and pay, and one pseudonymous identifier from each browser that uses a customer’s app. Beside each section we say what it means in ordinary words; the right-hand column is the policy.
Who we are
This policy is issued by PulsePoint Systems, LLC, a Delaware limited liability company trading as Kernstra ("Kernstra", "we", "us"), email legal@kernstra.com, postal address given on request. We are the controller of the personal data this policy describes; for the license check we share that role with our customer, as Section 3 explains, and Section 16 says where we process data for a customer instead. The person responsible for privacy at Kernstra is reachable at legal@kernstra.com; that person is our data protection officer where a law requires one (including the encarregado under Brazil's LGPD and the data protection officer under Singapore's PDPA), and our person in charge of the protection of personal information under Québec law.
The short version
We collect personal data in four situations, each described in its own section: when the SDK in one of our customers' applications checks its license (Section 3); when you have an account in the Kernstra console (Section 4); when your organization orders and pays for a license (Section 5); and when you contact us or receive email from us (Section 6). Our website itself collects nothing about you (Section 7).
We never receive the documents processed with the SDK, nor anything derived from them: no content, text, file names, form values, passwords or metadata. We do not sell personal data, do not share it for cross-context behavioural advertising, do not use it for advertising of any kind, and do not use it to train machine-learning models.
People who use our customers’ apps
Our customers build the SDK into their own web applications. When such an application starts the SDK, changes its license key, or opens a document more than an hour after the last confirmed answer, the SDK sends a status check to our licensing service. It carries: the license key; the origin of the page (its scheme, host and port, not its path); a random one-time value and the time; a stable pseudonymous identifier of the browser, derived from a key pair the SDK creates once in that browser and keeps on that origin; and technical facts about the SDK (its version and build, how the load went, failure counts and the last error code). Like any request, it also reveals the browser's IP address and user agent to our servers. It carries nothing that identifies the person, and nothing about the document.
We also serve the SDK's engine, text-processing binaries and fonts to the browser by their content digest, through Amazon CloudFront. Those requests carry no identifier; a font request shows, by its digest, which substitute font a document needed.
| What | Why | Legal basis | How long |
|---|---|---|---|
| License key, page origin, browser identifier, SDK facts | To verify the license and confirm its status; to count the distinct browsers that use each license in a month, which is how usage is measured against the customer’s plan; to detect a key used by someone it was not issued to; to troubleshoot | Our legitimate interests in licensing our software, billing by use and preventing its misuse (Art. 6(1)(f) GDPR) | The browser identifier is held only in a short-lived store and deleted two days after the end of the usage month in which it was seen; copies in encrypted backups are overwritten within 30 days (point-in-time backups) and within twelve months (monthly backups), and are restored only to recover the service. What we keep afterwards are daily totals per license key (numbers of loads and browsers, SDK versions, the origins used), which identify no one |
| IP address and user agent | To deliver the response, limit abusive traffic and protect the service | Our legitimate interests in securing the service (Art. 6(1)(f)) | Server logs, 30 days |
The identifier is pseudonymous: we cannot tell who is behind it, and we do not combine it with any other information to find out. We nevertheless treat it as personal data.
What the SDK keeps in the browser. On the customer's origin, the SDK keeps the license state in localStorage (the key, a signed status answer, a retry deadline, failure counters), the key pair behind the browser identifier in IndexedDB, and the verified engine binaries and fonts in Cache Storage, until the site data is cleared. It sets no cookies and uses no sessionStorage. The full list is on our Security page.
Who is responsible. The customer whose application loads the SDK and we are joint controllers for collecting and sending this data from the browser; this paragraph is the essence of our arrangement. The customer tells its users about it (by linking to this section or reproducing it) and obtains any consent that the law on storing information in a browser requires (in the EEA, Article 5(3) of the ePrivacy Directive and the national laws implementing it, including Norway's Electronic Communications Act; in the UK, the Privacy and Electronic Communications Regulations; in Switzerland, Article 45c of the Telecommunications Act). We alone are responsible for the data once it reaches us, and we answer requests about it; you may contact either of us. As we cannot identify a person from the identifier, we may be unable to find data about you unless you can show us which browser and application it came from; we will tell you if so.
Your account in the console
| What | Why | Legal basis | How long |
|---|---|---|---|
| Name, work email, company name, the organizations you belong to and your role in each | To create and run your account and your organization’s access to the console | Our and your organization’s legitimate interest in performing our contract with it (Art. 6(1)(f)); the contract with you, where you contract with us yourself (Art. 6(1)(b)) | While you have an account; erased on request (Section 12) |
| Google account email, name and its verified flag, if you sign in with Google | To sign you in (we receive no Google password and no other Google data) | Our and your organization’s legitimate interest in performing our contract with it (Art. 6(1)(f)); the contract with you, where you contract with us yourself (Art. 6(1)(b)) | As above; a Google sign-in in progress (with the name, company, IP address and browser it started with) is deleted when it completes or within 15 minutes of its 10-minute expiry |
| Sign-in sessions: IP address, browser and when last seen; sign-in links while they are valid | To keep you signed in, show you your sessions and protect your account | Legitimate interests in security (Art. 6(1)(f)) | Links 15 minutes; renewal 30 days from the last use; the session list while you have an account, without IP and browser once erased |
| Activity in your organization (who invited, created a key, signed, changed a setting), with the IP address of sign-ins | To show your organization its activity and to investigate misuse | Legitimate interests in security and accountability (Art. 6(1)(f)) | Until the organization’s data is deleted at its request after it closes, and at the latest seven years after it closes; sign-ins not tied to an organization while you have an account; shown as “Former member” after an erasure |
| Your acceptance of our Terms of Service and this policy: the email address you accepted with, the version, the time, IP address and browser | To prove which terms you accepted and when | Legitimate interests in being able to prove our agreements (Art. 6(1)(f)) | Seven years after an erasure; otherwise while you have an account |
| Invitations: the invitee’s email address, who invited them and the invitation’s status | To let the invitee join the organization and show its owners who was invited | Our and your organization’s legitimate interest in performing our contract with it (Art. 6(1)(f)); the contract with you, where you contract with us yourself (Art. 6(1)(b)) | Until the organization’s data is deleted at its request after it closes, and at the latest seven years after it closes |
| License requests: the application name, its domains, expected users and your notes | To prepare an offer and issue a license | Our and your organization’s legitimate interest in performing our contract with it (Art. 6(1)(f)); the contract with you, where you contract with us yourself (Art. 6(1)(b)) | Until the organization’s data is deleted at its request after it closes, and at the latest seven years after it closes |
Where it comes from. You give us most of it. An owner of your organization may give us your name and email address to invite you, or name you as its billing or copy-to contact; Google gives us your sign-in details if you use it; Stripe gives us your card's brand, last four digits and expiry date.
Orders, billing and payments
| What | Why | Legal basis | How long |
|---|---|---|---|
| Billing details: legal name, billing email and an optional copy-to email, postal address, tax ID | To invoice and charge your organization, and to meet our tax and accounting duties | Our and your organization’s legitimate interest in performing our contract with it (Art. 6(1)(f)); the contract with you, where you contract with us yourself (Art. 6(1)(b)); Legal obligations under EU, Member State or UK law where they apply (Art. 6(1)(c)); otherwise our legitimate interest in complying with US tax and commercial law (Art. 6(1)(f)) | Seven years after the organization closes, then deleted |
| Orders and their signatures: the signer’s name and job title as printed, the time, IP address and browser | To make the agreement and prove it | Our and your organization’s legitimate interest in performing our contract with it (Art. 6(1)(f)); the contract with you, where you contract with us yourself (Art. 6(1)(b)); legitimate interests in proving it (Art. 6(1)(f)) | Seven years after the organization closes |
| Card brand, last four digits and expiry date; invoices and payments | To show you your payment methods and remind you before a card expires | Our and your organization’s legitimate interest in performing our contract with it (Art. 6(1)(f)); the contract with you, where you contract with us yourself (Art. 6(1)(b)) | Seven years after the organization closes |
Cards are entered in Stripe's own form and held by Stripe; the full card number never reaches us. Stripe also processes payment data for its own purposes, such as fraud prevention and its legal duties, as an independent controller under its privacy policy, and keeps its own records of invoices and charges after we delete ours.
Support and email
| What | Why | Legal basis | How long |
|---|---|---|---|
| Support cases: your messages, our replies and your contact details (personal data of others in what you attach is processed for your organization, Section 16) | To answer you and fix problems | Our and your organization’s legitimate interest in performing our contract with it (Art. 6(1)(f)); the contract with you, where you contract with us yourself (Art. 6(1)(b)); legitimate interests in supporting our customers (Art. 6(1)(f)) | Until the organization’s data is deleted at its request after it closes, and at the latest seven years after it closes; attachments returned or deleted within 30 days of a request |
| Emails you send to our addresses, and the forms on our website, which open your own email program | To answer you | Legitimate interests in answering inquiries (Art. 6(1)(f)) | As long as the conversation needs, and at most three years after the last message unless it becomes part of a contract |
| Emails we send you (sign-in links, invitations, receipts, notices about your licenses and billing), their delivery records, and the queued events that produce them (which hold names and addresses) | To run your account and tell you what you need to know | Our and your organization’s legitimate interest in performing our contract with it (Art. 6(1)(f)); the contract with you, where you contract with us yourself (Art. 6(1)(b)) | Delivery records and delivered events 30 days; undelivered events 37 days |
We do not send marketing email. If we ever offer product news by email, we will ask you first or let you opt out of every message with one click, as the law where you are requires.
Our website
Our website sets no cookies, uses no analytics, advertising or tracking technology, and loads no content from third parties. Cloudflare, which hosts it, processes the technical data of each request (IP address, user agent, the page requested) to deliver the site and protect it from attacks; we keep no record of visits. If you open the console from a link on our website, the website notes that on your device (a localStorage entry that stays in your browser and is sent nowhere), so that its header offers "Open console" next time; clear your site data to remove it. Our website and console do not respond to Do Not Track or Global Privacy Control signals differently, because they do nothing those signals could switch off: neither we nor any third party collect information about your activity across websites over time through them.
Cookies
| Cookie | Purpose | Lifetime | Kind |
|---|---|---|---|
__Host-ks_refresh | Keeps you signed in to the console | 30 days from the last use | Secure, HTTP-only, first-party, SameSite Strict |
__Host-ks_link | Ties an emailed sign-in or invitation link to the browser that asked for it | 15 minutes | Secure, HTTP-only, first-party, SameSite Lax |
__Host-ks_oauth | Ties a Google sign-in to the browser that started it | 10 minutes | Secure, HTTP-only, first-party, SameSite Lax |
These cookies are strictly necessary for the service you ask for, so they need no consent. The website sets none, and the SDK's own browser storage is described in Section 3.
Who processes data for us
We share personal data only with the service providers below, which process it on our instructions under contracts that protect it, except where the table says a provider acts as an independent controller; with professional advisers bound by confidentiality; with authorities where the law requires it; and with a buyer of our business, which would be bound by this policy.
| Provider | What for | Data | Where |
|---|---|---|---|
| Hetzner Online GmbH | Servers and databases for the console and the licensing service | Everything in Sections 3 to 6 | Germany |
| Amazon Web Services | Encrypted database backups, encrypted file storage (support files, order documents), key management, malware scanning, and the delivery network for the SDK’s binaries | Everything in Sections 3 to 6 (in backups); support files, order documents; IP addresses of downloads | Germany (Frankfurt); the delivery network worldwide |
| Cloudflare, Inc. | DNS, hosting of the website and of the console’s pages, and the network and firewall in front of the console API and the licensing service | Everything sent to those services in transit (Sections 3 to 6) | Worldwide network; United States |
| Zoho Corporation | Our mailboxes (Zoho Mail) and the emails the console sends (ZeptoMail) | Email addresses and the content of emails | United States |
| Stripe (independent controller) | Payments, invoices and payment methods | Billing details, payment data | United States, Ireland |
| Google LLC (independent controller) | Sign-in with Google, if you choose it | Your Google sign-in | United States |
We tell our customers at least thirty (30) days before we add or replace a provider that processes personal data on their behalf, by updating this list and by email to the owners of every organization.
International transfers
We are established in the United States. We host the console and the licensing service in Germany, but our staff and some of the providers in Section 9 access or process personal data from the United States and other countries. Where personal data is transferred from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), with the UK International Data Transfer Addendum and the Swiss amendments where they apply, which are in place with each provider in Section 9 that processes data for us. Where a provider is also certified under the EU-US Data Privacy Framework and its UK and Swiss extensions (Cloudflare, Amazon, Stripe and Google are; Zoho is not), we rely on that certification as well; the Clauses remain in force if the Framework ceases to apply. You may ask us for a copy of the safeguards at legal@kernstra.com.
Security
We protect personal data with technical and organizational measures appropriate to the risk, including encryption in transit (TLS) and at rest, keys held in a managed key service, access limited to the staff who need it and protected by strong authentication, malware scanning of uploaded files, encrypted backups, and logs that never contain license keys, sign-in links, tokens or card data. License keys are stored only as a fingerprint and their last four characters. Backups are encrypted; point-in-time backups are kept for 30 days and monthly backups for twelve months, after which they are overwritten, and they are restored only to recover the service. No system is perfectly secure; if a breach affects personal data, we will notify the competent authorities and, where the law requires, the people affected, or publish a notice where we cannot reach them.
Your rights
Depending on where you are, you have the right to: access the personal data we hold about you and receive a copy; have it corrected; have it erased; restrict its processing; receive it in a portable format where we process it under a contract with you; and object to processing based on our legitimate interests (below). To use them, write to legal@kernstra.com or open a support case. We may need to confirm who you are. We answer within one month, which we may extend by two further months for complex requests, telling you why.
Your right to object. Where we rely on our legitimate interests (Sections 3 to 7), you may object at any time, on grounds relating to your situation, by writing to us; we will then stop, unless we have compelling legitimate grounds that override your interests or need the data for legal claims.
Do you have to give us data? No law requires you to. Without the details in Section 4 we cannot open an account, without those in Section 5 we cannot grant a paid license, and the SDK cannot run a license without its status check.
Some data we keep even after a request to erase it: billing records and signed orders (with the name and title you signed with), for seven years under tax and commercial law; the record of which terms you accepted, to prove our agreements; and, as records of your organizations, what you wrote in their support cases and the licenses, keys and requests you created, shown as "Former member" until the organization's data is deleted. Erased data also remains in encrypted backups until they are overwritten: within 30 days for point-in-time backups and within twelve months for monthly backups, which are restored only to recover the service. Erasing your account removes you from every organization. If you are the only owner of an organization that is still open, another owner must be added first.
Complaints. You may complain to us about how we handle your data, by email or in a support case; we acknowledge a complaint within thirty (30) days and tell you the outcome without undue delay. If you are in the EEA or the UK, you may also complain to the data protection authority where you live or work or where you believe the infringement took place, or, in the UK, to the Information Commissioner's Office; in Switzerland, to the Federal Data Protection and Information Commissioner.
We make no decisions about people based solely on automated processing that produce legal or similarly significant effects. Our licensing service automatically refuses a license key on a domain it is not issued for, and may limit a key that appears to be copied; that concerns the key, not a person, and a customer may ask us to review it.
United States privacy rights
Residents of US states with comprehensive privacy laws (such as California, Colorado, Connecticut, Delaware, Oregon, Texas and Virginia) may, where the law applies to us and to their data, request to know or access the personal data we hold about them, to correct it, to delete it and to receive a portable copy, and to opt out of its sale, of targeted advertising and of profiling with significant effects. We do not sell personal data, share it for cross-context behavioural advertising, use it for targeted advertising or profile people, including the data of consumers under 16; we do not process sensitive personal data. In the last twelve months we have collected, for the purposes in Sections 3 to 7 and from the sources they name: identifiers (name, email address, IP address, the browser identifier); commercial information (orders, invoices, payments); internet or network activity (sign-ins, console activity, license checks); and professional information (company, role, the job title you sign with). We disclose them only to the recipients in Section 9, and keep them for the periods Sections 3 to 6 give.
Send requests to legal@kernstra.com; an authorized agent may send one for you with your written permission. We answer within 45 days, which we may extend once by 45 days, telling you why. Where your state provides a right to appeal and we decline your request, you may appeal by replying with the word "Appeal"; we answer appeals within 45 days, which we may extend by 60 days where reasonably necessary, telling you why, and if we deny it you may contact your state attorney general. We will not discriminate against you for using these rights.
If you are outside the EU, UK and US
This policy applies to everyone whose data we process, wherever they are. We collect and use personal data for the purposes and on the grounds stated in Sections 3 to 7: to perform our contract with you or your organization, to meet legal duties, and otherwise in our legitimate interests in licensing, securing and running our services, which we have weighed against your interests. Where the law where you are requires consent for any of this, the customer whose application you use obtains it before the SDK loads, and we obtain it ourselves for anything we collect directly. Your data is processed in Germany and the United States, where the authorities of those countries may lawfully obtain it; we protect it with the measures in Section 11 and the contracts in Section 10.
Wherever you are, you may ask us to confirm whether we hold data about you, to access it and receive a copy, to correct it, to delete it, to receive it in a portable format, to object to or restrict its processing, and to withdraw any consent, and you may complain to the data protection authority of your country. Write to legal@kernstra.com or open a support case; we answer within one month, or sooner where your law requires, and we never charge for a first request. We make no decisions about you based solely on automated processing. Our services are not offered to or directed at individuals in mainland China; a customer that deploys the SDK to users there is responsible for its own compliance.
Brazil. Our legal bases under the LGPD are those stated in Sections 3 to 7 (Article 7, V and IX); we answer access requests within 15 days; our encarregado is the contact in Section 1; you may petition the Autoridade Nacional de Proteção de Dados.
Canada. Your information is stored and accessed outside Canada, in Germany and the United States, where the authorities of those countries may lawfully obtain it. We remain accountable for it under PIPEDA and, in Québec, the Act respecting the protection of personal information in the private sector; our person in charge is named in Section 1. You may complain to the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec.
India. From 13 May 2027, we process your account data because you provide it to us for that purpose (section 7(a) of the Digital Personal Data Protection Act 2023); the license check is covered by the notice of the customer whose application you use. Our contact person is named in Section 1; we answer grievances within 30 days, after which you may complain to the Data Protection Board of India.
Australia. You may complain to us first and, after 30 days, to the Office of the Australian Information Commissioner.
Singapore. Our data protection officer under the PDPA is the contact named in Section 1.
Japan and South Korea. The customer whose application you use is responsible for telling you that this data goes to a company in the United States; we give it the particulars it needs (recipient, data items, retention, contact) on request.
Mexico. Requests about your account are answered within 20 business days.
Children
Our services are for businesses and are not directed to children. We do not knowingly collect personal data from children under 16 (13 in the United States) through the console or our website. Where a customer uses the SDK in an application directed to children, the license status check uses the browser identifier only to authenticate the license, protect the security and integrity of the SDK and keep it working; it is not used or disclosed to contact a specific person, for behavioural advertising or to build a profile of anyone, is held separately from any account data and never joined to it, and is deleted as Section 3 states.
When we process data for our customers
Where a customer shares personal data of others with us, for example a document attached to a support case, we process that data on the customer's behalf and on its instructions, as its processor, under the data processing terms in Section 12 of our Terms of Service. The customer is the controller of that data, and requests about it should go to the customer first; we will help it answer them.
Changes to this policy
We may change this policy by publishing a new version at this address with its new version number and effective date. For a material change, we tell account holders by email or in the console at least thirty (30) days before it takes effect, and the console asks each person to acknowledge the new version at their next visit. Earlier versions are available on request.
Contact
PulsePoint Systems, LLC, trading as Kernstra. Email: legal@kernstra.com. Postal address: given on request. Security issues: security@kernstra.com.