Privacy Policy.

Effective 2 November 2026.

1. Who we are

Kyber AI Technologies LLC is the data controller for this website and for the Kyber AI service. Our registered address is 41 N Rio Grande Street, Suite 102, Salt Lake City, Utah 84101, United States.

Write to privacy@l2-kyber.com about anything on this page.

2. What we collect, and why

We collect only what the service needs to work. We do not sell personal data. We run no advertising and no cross-site tracking.

• Your email address and a sign-in identifier. Microsoft Entra External ID handles sign-in and gives us your email address and an opaque subject identifier. We store both so we can recognise your account. We never receive your password.
• Session data. When you sign in we set one cookie so you stay signed in. We store a one-way hash of that session token, not the token itself.
• Subscription records. We store your Paddle customer and subscription identifiers, your plan, its status and its renewal date. We never see or store your card number. Paddle handles payment details.
• Service usage records. When your AI assistant searches or loads a skill, we record which tool ran, which skill it returned, how long it took and whether it succeeded. We use this to keep the library working and to find broken skills. In our tracing system your identifier is replaced with a keyed hash.
• Messages you send us. If you use the feedback form we store your message and the page you sent it from.
• Technical request data. Our network provider processes IP addresses and request metadata to route traffic and block abuse.

3. Cookies and local storage

We use no analytics or advertising cookies. The complete list is:

• kyber_session — keeps you signed in. Lasts 30 days. Secure, HttpOnly. Strictly necessary.
• kyber_auth — protects the sign-in redirect against cross-site request forgery. Lasts 10 minutes. Strictly necessary.
• kyber-theme — a local storage entry, not a cookie. Records whether you chose the light or dark theme. It holds no identifier and is never sent to a server.

4. Who else processes your data

We use these providers. Each one acts on our instructions, except Paddle, which is an independent seller of record for your purchase.

• Paddle.com Market Ltd — merchant of record. Paddle takes payment, issues invoices, collects and files sales tax, and runs the checkout and billing portal. Paddle is the seller for your purchase and applies its own buyer terms and privacy notice.
• Microsoft Corporation — Entra External ID for sign-in, and Microsoft Azure for hosting. Our application servers run in the Azure East US 2 region.
• Cloudflare, Inc. — domain name service, content delivery, web application firewall, and hosting for this website.

On our pricing and account pages only, your browser loads a script fromcdn.paddle.com so the checkout can run. That request discloses your IP address to Paddle. Every other page loads all of its files, including both fonts, from our own domain, so viewing it contacts no outside party.

5. Our legal bases

Where the GDPR or UK GDPR applies, we rely on:

• Performance of a contract — to give you an account, serve the skill library, and manage your subscription.
• Legitimate interests — to keep the service secure, prevent abuse, and fix broken skills. We use the least data that achieves this.
• Legal obligation — to keep tax and transaction records.

6. How long we keep it

• Account records: while your account exists, then up to 90 days.
• Sessions: 30 days, or until you sign out.
• Service usage records: up to 24 months.
• Transaction and tax records: as long as the law requires, usually 7 years. Paddle holds these as the seller of record.

7. Your rights

Depending on where you live, you may ask us to give you a copy of your data, correct it, delete it, restrict or object to our use of it, or send it to another provider. You may also withdraw consent where we relied on consent.

Write to privacy@l2-kyber.com. We answer within 30 days. We may ask you to confirm your identity first. If you are in the European Economic Area or the United Kingdom, you may also complain to your national data protection authority.

If you are a California resident, we do not sell or share personal information as those terms are defined by the CCPA, and we will not discriminate against you for exercising your rights.

8. International transfers

We are in the United States and our servers are in the United States. If you use the service from outside the United States, your data is transferred there. Our providers use the European Commission's standard contractual clauses, or another approved safeguard, where that is required.

9. Children

The service is not for people under 18. We do not knowingly collect data from children. Tell us if you believe a child has given us data and we will delete it.

10. Changes

We will post any change on this page and update the effective date. If a change matters to you, we will tell you by email before it takes effect.