Privacy Policy

6.1 Account Information

6.2 Authentication Information

6.3 Installation and Device Information

6.4 Documents and Document Content

Documents are intended to remain stored locally on your device unless you explicitly request a feature that requires transmission for processing.

6.5 AI Requests and Results

6.6 Case and Workspace Information

6.7 Subscription, Credit and Transaction Information

6.8 Support and Communications

6.9 Security and Diagnostic Information

6.10 Personal Data About Other People

Documents and case materials that you choose to process may contain personal data about family members, employees, customers, counterparties, medical professionals, public authorities or other individuals.

You are responsible for ensuring that you are authorized to provide and process such information through Ksonia and for complying with any duties that apply to you when handling another person's personal data.

You should avoid providing personal data that is not reasonably necessary for the feature you request.

6.11 Advertising and Cross-App Tracking

Ksonia does not use document content, AI requests or account information for targeted advertising.

Ksonia does not sell personal data and does not use your documents to track you across applications or websites owned by other companies.

7.1 AI Processing Is Initiated by the User

Ksonia does not automatically submit every document stored in the application for AI processing.

AI processing occurs when you expressly select an AI-powered function, such as explaining a document, extracting text, translating content, generating a suggested reply or asking a question about a document or case.

Before initiating an AI operation, you should review the selected document and ensure that you are authorized to process its contents.

7.2 Information Sent for AI Processing

Depending on the feature requested, Ksonia may transmit the selected document, document images or files, extracted text, relevant case context, your question or instruction, your preferred language and technical identifiers required to process and reliably deliver the result.

Ksonia seeks to limit each transmission to the information reasonably necessary for the requested operation.

Documents may contain personal, confidential or sensitive information. You control which documents and questions you submit for AI processing.

7.3 AI Service Providers

Ksonia may use one or more specialized artificial intelligence service providers to perform AI-powered operations. Information required for the operation requested by you may therefore be transmitted to and processed by the provider selected by Ksonia for that operation.

AI service providers process information on behalf of Ksonia and are required to act under applicable contractual, confidentiality, security and data-protection obligations. They may process the submitted information only for the purposes permitted by their agreement with Ksonia and applicable law.

The AI provider used for a particular operation may depend on factors such as the requested feature, language, document format, availability, performance, security, data-protection requirements and the country from which the Services are used.

Ksonia may add, replace or discontinue AI service providers where reasonably necessary to operate, secure or improve the Services. This provider-independent architecture allows Ksonia to select appropriate technology without making any single AI provider a permanent component of the Services.

An up-to-date list of material service providers and subprocessors, including AI providers where applicable, may be made available through the Ksonia website, within the application or upon request at support@ksonia.com.

Where required by applicable law, we will provide appropriate notice before a material change to our service providers results in a materially different use, disclosure or international transfer of personal data.

7.4 Model Training and Provider Use of Content

Ksonia does not use your documents, questions, instructions or AI-generated results to train Ksonia-owned general-purpose artificial intelligence models.

Ksonia intends to select AI service arrangements under which content submitted through the Services is not used to train or improve a provider's general-purpose models unless Ksonia has expressly authorized such use in accordance with applicable law.

Ksonia does not intend to authorize the use of user document content for general-purpose model training without first providing clear notice and obtaining consent where consent is required by applicable law.

AI providers may process limited information for purposes such as delivering the requested service, maintaining security, detecting abuse and complying with legal obligations, subject to their contractual obligations to Ksonia and the retention terms applicable to the relevant service.

7.5 Temporary Processing and Reliable Delivery

AI processing data may be held temporarily while an operation is being completed and while Ksonia attempts to deliver the result to your device.

Ksonia may use operation identifiers, processing status records and delivery acknowledgements to prevent duplicate processing, restore interrupted operations and confirm that a result has reached the application.

After successful delivery is confirmed, Ksonia is designed to delete temporary document payloads and generated processing results from its own temporary delivery systems, subject to limited exceptions described in this Privacy Policy.

If delivery cannot be confirmed, temporary processing data may be retained for a limited period so that delivery can be retried or the operation can be safely resolved.

7.6 Sensitive and Special-Category Information

Documents submitted by users may contain health information, financial information, identification data, information about children, legal correspondence or other sensitive or specially protected personal data.

Ksonia does not require you to submit sensitive information unless it is relevant to the function you choose to use. You should avoid including information that is not reasonably necessary.

Where applicable law requires consent or another specific legal condition for processing sensitive information, you are responsible for ensuring that the relevant condition is satisfied before submitting information about another person. Where Ksonia itself is required to obtain additional consent, we will request it before carrying out the relevant processing.

7.7 Accuracy and Limitations of AI Outputs

AI-generated outputs may be incomplete, inaccurate, outdated, misleading or inappropriate for your particular circumstances.

Ksonia is intended to help users understand and organize paperwork. It does not replace qualified legal, tax, financial, medical, immigration or other professional advice.

You should verify important information, deadlines, amounts, names, reference numbers, translations and suggested actions against the original document and, where appropriate, consult a qualified professional.

You remain responsible for decisions, communications, submissions and actions taken based on an AI-generated output.

7.8 Automated Decision-Making

Ksonia may automatically classify documents, identify possible deadlines, suggest next steps or generate explanations and draft responses.

These functions are designed to provide assistance and recommendations. Ksonia does not intend to make decisions that produce legal or similarly significant effects about you solely through automated processing.

If Ksonia introduces a feature involving legally significant automated decision-making, we will provide the information, safeguards and user controls required by applicable law before using that feature.

7.9 Human Access to Document Content

Ksonia personnel do not routinely review the contents of documents submitted for AI processing.

Limited access may occur where reasonably necessary to investigate a technical or security incident, respond to a support request initiated by you, prevent fraud or abuse, comply with law or establish, exercise or defend legal claims.

Any such access is intended to be limited to authorized persons with a legitimate need and subject to confidentiality and security controls.

8.1 Providing the Services

To create and manage your account, organize documents and cases, synchronize account-related information where applicable, provide AI-powered features, manage subscriptions and credits, deliver requested functionality and maintain normal operation of the Services.

8.2 Authentication and Account Security

To verify your identity, maintain secure login sessions, protect accounts against unauthorized access and support password recovery or account restoration.

8.3 Communications

To send service-related notifications, respond to support requests, provide important account information, notify you about security matters and communicate changes to the Services or this Privacy Policy.

8.4 Billing, Credits and Subscriptions

To administer subscriptions, process purchases, allocate credits, prevent duplicate billing, maintain transaction records and comply with financial and accounting obligations.

8.5 Security and Fraud Prevention

To protect users, detect and prevent abuse, investigate suspicious activity, enforce our Terms of Service, maintain service integrity and protect the confidentiality, availability and security of the Services.

8.6 Service Improvement

To diagnose technical problems, improve performance, maintain compatibility with supported devices, identify software defects and enhance the quality and reliability of the Services.

8.7 Legal Compliance

To comply with applicable laws, regulatory requirements, court orders, lawful governmental requests, tax obligations, accounting requirements and other legal responsibilities.

8.8 Protection of Rights

To establish, exercise or defend legal claims, protect the rights, property and safety of Ksonia, our users and third parties, and resolve disputes.

8.9 Processing Based on Consent

Where required by applicable law, Ksonia will request your consent before carrying out specific processing activities. You may withdraw your consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

8.10 No Secondary Use of Documents

Ksonia does not process your documents for unrelated commercial purposes.

Document content is processed only to provide the functionality that you request or where otherwise required by applicable law.

9.1 Performance of a Contract

Most processing carried out by Ksonia is necessary to provide the Services requested by you, including account management, document organization, AI-powered features, subscriptions, credits and customer support.

9.2 Legitimate Interests

Ksonia processes certain information where necessary for our legitimate interests, including maintaining security, preventing fraud, protecting users, improving reliability, enforcing our Terms of Service, diagnosing technical problems and defending legal claims. Where required, we balance these interests against your rights and freedoms.

9.3 Consent

Certain processing activities may rely on your consent where required by applicable law. Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

9.4 Legal Obligations

Ksonia may process personal data where necessary to comply with applicable laws, regulations, lawful requests from competent authorities, accounting obligations, tax obligations and other legal requirements.

9.5 Vital Interests

In exceptional circumstances, Ksonia may process personal data where necessary to protect the vital interests of an individual where permitted by applicable law.

9.6 Public Interest

Ksonia does not normally process personal data on the basis of a task carried out in the public interest or in the exercise of official authority. If this changes in the future, this Privacy Policy will be updated accordingly.

10.1 No Sale of Personal Data

Ksonia does not sell personal data for monetary or other valuable consideration.

Ksonia does not share personal data for cross-context behavioural advertising and does not disclose document content for advertising purposes.

10.2 AI Service Providers

When you initiate an AI-powered operation, the selected document, relevant context, instruction and technical information may be disclosed to an artificial intelligence service provider engaged to perform that operation.

The provider is expected to process the information on behalf of Ksonia and only for purposes permitted under its agreement with Ksonia and applicable law.

The provider used may vary depending on the requested feature, language, document format, availability, performance, security and data-protection requirements.

10.3 Cloud, Hosting and Infrastructure Providers

Ksonia may use cloud hosting, database, storage, network, monitoring and infrastructure providers to operate the Services, maintain accounts, process requests, deliver results and protect service availability.

Because Ksonia follows a local-first architecture, these providers are not intended to maintain a permanent central repository of all documents stored by users on their devices.

Temporary document content may nevertheless pass through infrastructure systems when required to complete a user-requested operation or reliably deliver its result.

10.4 Authentication Providers

If you choose to sign in using a third-party authentication provider, Ksonia may receive account identifiers and profile information made available by that provider, such as your name and email address.

The authentication provider may independently process information about your use of its sign-in service under its own privacy terms.

Ksonia does not receive the password used for your third-party account.

10.5 App Stores and Payment Providers

Purchases and subscriptions may be processed through an app store, payment processor or other billing provider.

These providers may process payment details, billing addresses, transaction identifiers, subscription status and information required for fraud prevention and legal compliance.

Ksonia may receive confirmation of a purchase, product identifier, transaction identifier, subscription status and related billing metadata, but is not intended to receive or store full payment-card details processed directly by the payment provider.

Payment and app-store providers may act as independent controllers for parts of their processing and may apply their own privacy policies.

10.6 Email and Communication Providers

Ksonia may use email delivery and communication providers to send account confirmation messages, password-reset messages, service notifications, security alerts and responses to support requests.

These providers may process email addresses, message delivery information and the contents of communications required to provide the relevant service.

10.7 Support and Technical Service Providers

Ksonia may engage service providers to assist with customer support, technical diagnostics, security monitoring, error investigation and service maintenance.

Access to document content is not routine and should be limited to circumstances where it is reasonably necessary to resolve a request, investigate an incident or protect the Services.

10.8 Workspace Members and Administrators

If you use Ksonia through an organizational or shared workspace, information relating to your membership, role, allocated credits and workspace activity may be visible to authorized workspace owners or administrators.

The extent of access depends on the workspace features and permissions made available by Ksonia.

We will seek to provide clear information about workspace access before introducing features that allow other workspace members to access document content or case information.

10.9 Professional Advisers

Ksonia may disclose personal data to lawyers, accountants, auditors, insurers, consultants and other professional advisers where reasonably necessary to obtain advice, fulfil legal obligations, conduct audits or establish, exercise or defend legal claims.

Such recipients are expected to be subject to professional, contractual or statutory confidentiality obligations.

10.10 Legal and Regulatory Disclosures

Ksonia may disclose personal data where required by applicable law, regulation, court order or a valid and binding request from a competent public authority.

Ksonia may also disclose information where reasonably necessary to investigate unlawful conduct, prevent fraud or security threats, protect an individual from serious harm or protect the rights, property or safety of Ksonia, our users or others.

Where legally permitted and reasonably practicable, Ksonia will seek to review governmental requests for validity, scope and proportionality before disclosing personal data.

10.11 Corporate Transactions

Personal data may be disclosed in connection with a proposed or completed merger, acquisition, financing, reorganization, sale of assets, insolvency proceeding or transfer of all or part of the Ksonia business.

Any recipient will be expected to use personal data consistently with this Privacy Policy unless applicable law permits otherwise or affected users are provided with appropriate notice.

10.12 Service Provider and Subprocessor List

Ksonia may maintain an up-to-date list of material service providers and subprocessors through the Ksonia website, within the application or upon request.

The list may identify the provider, the type of service provided, the categories of data involved and the principal processing location where appropriate.

You may contact support@ksonia.com to request information about material service providers used for the processing of personal data.

11.1 Countries Providing an Adequate Level of Protection

Where personal data is transferred to a country that has been recognized by the applicable authority as providing an adequate level of data protection, Ksonia may rely on that adequacy decision where permitted by applicable law.

11.2 Appropriate Safeguards

Where an adequacy decision is not available, Ksonia seeks to implement appropriate safeguards, which may include Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum or other legally recognized transfer mechanisms.

11.3 Additional Protective Measures

Where appropriate, Ksonia may implement supplementary technical, contractual and organizational measures, including encryption, access controls, data minimization and contractual confidentiality obligations.

11.4 International Nature of the Services

Because Ksonia uses technology providers that may operate internationally, certain processing activities may occur outside your country of residence.

Ksonia seeks to limit international transfers to those reasonably necessary to provide the Services requested by you.

11.5 Additional Information

You may contact support@ksonia.com if you would like additional information regarding the safeguards used for international transfers of personal data where required by applicable law.

12.1 Documents Stored on Your Device

As a general principle, documents, scans and case materials remain stored locally on your device.

Ksonia does not intend to maintain a permanent centralized cloud repository of your documents.

You control how long locally stored documents remain on your device and may delete them at any time.

12.2 Temporary AI Processing

When you request an AI-powered operation, the information required for that operation may be retained temporarily while processing is completed and the result is delivered.

Temporary processing data is intended to be deleted after successful delivery of the requested result unless a longer retention period is reasonably necessary for security, fraud prevention, technical troubleshooting, legal compliance or the establishment, exercise or defence of legal claims.

Where delivery cannot be confirmed, temporary processing information may be retained for a limited period to allow secure retry of the operation.

12.3 Account Information

Account information is generally retained while your account remains active.

After account deletion, Ksonia will delete or anonymize personal data within a reasonable period unless continued retention is required by law or permitted for legitimate legal, accounting, security or fraud-prevention purposes.

12.4 Billing and Financial Records

Information relating to subscriptions, purchases, credits and financial transactions may be retained for the period required by applicable accounting, tax and financial reporting laws.

Such records may continue to be retained even after your account has been closed where required by law.

12.5 Customer Support

Support requests and related correspondence may be retained for a reasonable period to improve customer service, investigate recurring issues and establish, exercise or defend legal claims.

12.6 Security and Technical Logs

Security logs, technical logs and diagnostic records may be retained only for as long as reasonably necessary to maintain the security, reliability and integrity of the Services.

12.7 Anonymized Information

Information that has been irreversibly anonymized so that it can no longer reasonably identify an individual is no longer considered personal data and may be retained for statistical, analytical, security or product improvement purposes where permitted by applicable law.

12.8 Deletion Requests

Where applicable law provides a right to deletion, Ksonia will respond to valid deletion requests within the time required by applicable law.

Certain information may nevertheless be retained where continued retention is required or permitted by applicable law.

13.1 Local-First Data Protection

Ksonia's local-first architecture is intended to reduce the amount of document content stored in centralized systems.

Documents and case materials are generally stored on your device and are transmitted only when required for a function that you expressly request.

Reducing unnecessary collection and retention limits the amount of personal data potentially exposed in the event of a security incident.

13.2 Protection During Transmission

Ksonia seeks to protect personal data transmitted between the application, Ksonia systems and service providers by using encrypted network connections and industry-standard transport security where supported.

You should avoid using unsecured devices, compromised networks or modified operating systems when submitting sensitive documents.

13.3 Access Controls

Access to systems containing personal data is intended to be limited to authorized persons, systems and service providers that require access for a legitimate operational purpose.

Ksonia seeks to apply authentication, authorization and least-privilege principles appropriate to the relevant system and role.

Administrative and service credentials should be protected and managed separately from ordinary user access.

13.4 Account and Authentication Security

Ksonia uses authentication and session-management mechanisms designed to protect registered accounts against unauthorized access.

You are responsible for protecting access to your email account, device, authentication credentials and any third-party account used to sign in to Ksonia.

You should notify Ksonia promptly if you believe that your account, device or credentials have been compromised.

13.5 Data Minimization and Separation

Ksonia seeks to collect and transmit only the information reasonably necessary for the requested operation.

Where reasonably practicable, account, workspace, billing, operational and temporary document-processing information are handled according to their respective purposes and access requirements.

Operation identifiers and limited metadata may be used instead of document content where the relevant function does not require access to the content itself.

13.6 Service Provider Security

Ksonia seeks to select service providers that maintain security and data-protection measures appropriate to the services they provide and the information they process.

Service providers may be required through contractual arrangements to protect personal data, limit access, maintain confidentiality and notify Ksonia of relevant security incidents.

The security measures of third-party providers may also be governed by their own infrastructure, certifications, policies and contractual commitments.

13.7 Monitoring, Testing and Maintenance

Ksonia may use security logs, technical monitoring, software updates, dependency management, access reviews and testing procedures to identify vulnerabilities, investigate incidents and maintain the reliability of the Services.

Security measures may be reviewed and updated in response to changes in technology, identified risks, legal requirements and the development of the Services.

13.8 Availability and Recovery

Ksonia seeks to maintain reasonable procedures for handling interrupted operations, service failures and unsuccessful result delivery.

Because documents are generally stored locally, you are responsible for protecting your device and maintaining any device-level backups that you consider appropriate.

Deleting the application, resetting or losing your device, clearing application data or experiencing device failure may result in the permanent loss of locally stored documents and case information unless a separate backup or synchronization feature is available and enabled.

13.9 Security Incidents

If Ksonia becomes aware of a personal-data breach, we will investigate the incident and take measures that we consider appropriate to contain, mitigate and remediate it.

Where required by applicable law, Ksonia will notify the competent supervisory authority and affected individuals within the legally required time periods.

Notifications may describe the nature of the incident, the categories of information involved, the likely consequences, the measures taken and steps that affected users may take to protect themselves.

13.10 Reporting Security Concerns

If you believe that you have identified a security vulnerability or unauthorized access affecting Ksonia, please contact support@ksonia.com and provide sufficient information for us to investigate.

You must not exploit a suspected vulnerability, access data that does not belong to you, disrupt the Services or publicly disclose sensitive technical details before Ksonia has had a reasonable opportunity to investigate and address the issue.

13.11 No Absolute Security

No method of electronic transmission, storage or processing is completely secure. Ksonia cannot guarantee that unauthorized persons will never defeat our security measures or that information will never be lost, altered or disclosed.

Ksonia will continue to assess risks and seek to maintain safeguards appropriate to the nature and scope of the Services.

14.1 Right of Access

You may request confirmation of whether Ksonia processes your personal data and, where applicable, obtain access to that information together with supplementary information required by law.

14.2 Right to Rectification

You may request correction of inaccurate or incomplete personal data relating to you.

14.3 Right to Erasure

You may request deletion of your personal data where applicable law provides such a right. Certain information may nevertheless be retained where retention is required or permitted by law.

14.4 Right to Restrict Processing

You may request that Ksonia temporarily restrict certain processing activities in circumstances recognized by applicable law.

14.5 Right to Object

Where processing is based on legitimate interests or other applicable legal grounds, you may object to certain processing activities in accordance with applicable law.

14.6 Right to Data Portability

Where required by applicable law, you may request that personal data you have provided to Ksonia be supplied in a structured, commonly used and machine-readable format or transferred to another controller where technically feasible.

14.7 Withdrawal of Consent

Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

14.8 Right to Lodge a Complaint

You may lodge a complaint with the competent data-protection supervisory authority if you believe that your personal data has been processed in violation of applicable law.

14.9 Identity Verification

Before responding to certain requests, Ksonia may request information reasonably necessary to verify your identity and protect personal data against unauthorized disclosure.

14.10 Response Time

Ksonia will respond to valid privacy requests within the time periods required by applicable law. Where permitted, the response period may be extended if a request is particularly complex or numerous.

14.11 How to Exercise Your Rights

Privacy requests may be submitted by contacting support@ksonia.com.

Please provide sufficient information to enable us to identify your account and understand your request.

15.1 No Intentional Collection

Ksonia does not knowingly collect personal data directly from children where such collection is prohibited by applicable law.

If you are a parent or legal guardian and believe that a child has provided personal data in violation of applicable law, please contact us so that we can investigate and take appropriate action.

15.2 Documents Containing Information About Children

Users may choose to process documents that contain information relating to children, such as school records, medical documents or official correspondence.

Such processing is performed only at the user's request for the purpose of providing the requested functionality.

The user is responsible for ensuring that they are authorized to submit and process such information.

15.3 Consent Where Required

Where applicable law requires parental or guardian consent before certain processing activities may occur, Ksonia expects that the necessary consent has been obtained before the information is submitted.

If Ksonia determines that additional consent is required for a particular feature, we may request it before providing that feature.

15.4 Removal of Information

If Ksonia becomes aware that personal data has been collected from a child in violation of applicable law, we will take reasonable steps to delete or otherwise handle that information in accordance with applicable legal requirements.

16.1 Independent Third Parties

Third-party providers operate under their own terms, privacy policies and legal obligations.

Ksonia is not responsible for the privacy practices, security measures or content of third-party services that are not controlled by Ksonia.

We encourage you to review the privacy policy of every third-party service that you choose to use.

16.2 External Websites

The Services may contain links to external websites for your convenience.

Following an external link may result in your interaction with a website that is governed by its own privacy practices and legal terms.

16.3 App Stores and Platform Providers

Distribution platforms, mobile operating systems and application stores may independently process personal data relating to downloads, purchases, subscriptions, updates and device information.

Such processing is governed by the applicable platform provider's own privacy documentation.

16.4 Future Integrations

Ksonia may introduce additional integrations with third-party services as the platform evolves.

Where such integrations materially affect the processing of personal data, Ksonia will update this Privacy Policy or provide additional notice where required by applicable law.

17.1 Effective Date and Version

The current version of this Privacy Policy will identify its effective date or last-updated date.

The version made available through the Ksonia application or website replaces earlier versions from its stated effective date.

17.2 Material Changes

If a change materially affects how Ksonia collects, uses, discloses or otherwise processes personal data, we will provide additional notice where required by applicable law.

Notice may be provided through the application, by email, on the Ksonia website or by another appropriate method.

17.3 Consent Where Required

Where applicable law requires consent for a new processing activity, Ksonia will request that consent before carrying out the relevant processing.

A policy update alone does not replace consent where consent is legally required.

17.4 Reviewing Updates

We encourage you to review this Privacy Policy periodically so that you remain informed about how Ksonia processes personal data.

Your continued use of the Services after an update does not limit any rights granted to you by applicable data-protection law.

17.5 Previous Versions

Where reasonably practicable, Ksonia may retain or make available previous versions of this Privacy Policy for transparency and record-keeping purposes.

18.1 Data Controller

18.2 Information to Include in a Request

To help us understand and respond to your request, please describe the matter clearly and provide the email address associated with your Ksonia account, where applicable.

Please do not send passwords, full payment-card details or documents containing unnecessary sensitive information by ordinary email.

Ksonia may request additional information where reasonably necessary to verify your identity, locate relevant records or protect personal data from unauthorized disclosure.

18.3 Supervisory Authority

You may have the right to contact or lodge a complaint with the data-protection authority responsible for your country or region.

The supervisory authority for private-sector data protection in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC).

You are not required to contact Ksonia before approaching a supervisory authority where applicable law provides otherwise, although contacting us first may allow us to address your concern more quickly.

18.4 Language Versions

This Privacy Policy may be made available in several languages.

Ksonia seeks to keep all language versions consistent. If a translation differs materially from the English version, the interpretation required by mandatory law in the user's jurisdiction will apply.