EXOKERN / Legal / Privacy
Privacy Policy
Privacy policy for EXOKERN websites, AI-enabled robotics workflows, public GitHub links, and related services.
This Privacy Policy explains how Exokern Lab ("Exokern," "we," "us," or "our") collects, uses, discloses, and protects personal information in connection with exokern.com, skills.exokern.com, and our related websites, applications, AI-enabled tools, workflows, skills, APIs, software, content, and services.
Exokern is based in Germany. For users in the European Economic Area, the United Kingdom, and Switzerland, the GDPR section below applies. If you use the Services from other jurisdictions, additional local laws may apply. Contact details are in the Contact section at the end of this policy.
1. Personal Information We Collect
Account Information
Name, email address, company name, job title, username, authentication credentials, account settings, subscription status, and user role.
Contact Information
Name, email address, phone number, company, message content, and related communication data.
Usage Information
Pages viewed, features used, workflows created, skills accessed, timestamps, clicks, logs, session data, API usage, error reports, diagnostic information, and support interactions.
Device and Technical Information
IP address, browser type, device type, operating system, referring URLs, language settings, local storage identifiers, cookies where used, unique identifiers, and network information.
User Content
Prompts, instructions, files, repository links, text, documents, configurations, code snippets, workflow data, AI inputs, AI outputs, uploaded materials, and other content you submit to or generate through the Services.
Payment and Billing Information
The current public website implementation does not include payment processing. If paid Services are introduced, billing name, company, billing address, tax information, plan information, payment status, invoice data, and transaction metadata may be processed by a payment provider.
Support, Communications, and Security Information
Support requests, feedback, survey responses, emails, chat messages, login events, authentication logs, access attempts, fraud signals, abuse reports, and other security-related information.
2. Sensitive Personal Information
The Services are not intended for submission of sensitive personal information unless Exokern expressly authorizes it in writing.
Do not submit health information, biometric information, precise geolocation, government identifiers, financial account credentials, children's data, criminal history, union membership, racial or ethnic origin, religious beliefs, sexual orientation, or other sensitive information unless you have a lawful basis and written authorization from Exokern.
We do not use sensitive personal information to infer characteristics unless expressly disclosed and permitted by law.
3. How We Use Personal Information
- provide, operate, and maintain the Services;
- create and manage accounts;
- process transactions and subscriptions if paid Services are introduced;
- generate, process, and display AI outputs;
- run workflows, skills, automations, integrations, catalog indexing, and compatibility checks;
- provide support and respond to inquiries;
- secure the Services and prevent fraud, abuse, and unauthorized access;
- monitor performance, debug issues, and improve functionality;
- analyze product usage and improve the Services;
- communicate about updates, security notices, and administrative matters;
- send marketing communications where permitted;
- comply with legal obligations;
- enforce our Terms and protect our rights.
4. AI Processing
When you use AI-enabled features, your inputs, prompts, files, repository metadata, instructions, configurations, outputs, and related metadata may be processed by Exokern and by third-party AI providers or infrastructure providers.
Depending on the configuration, AI-related data may be used to generate outputs, execute workflows, provide requested functionality, maintain context during a session, detect abuse or security issues, debug and improve the Services, and comply with law.
Exokern will not use User Content to train Exokern-owned AI models unless this is expressly disclosed, permitted by law, and consistent with your account settings or agreement.
The current public skills page is a GitHub hub and does not run hosted metadata extraction. Third-party AI providers may process data only where an AI-enabled Exokern feature is configured, requested, or covered by a separate agreement.
5. Sources of Personal Information
- you directly;
- your company or organization;
- your account administrators;
- your use of the Services;
- cookies, local storage, and similar technologies;
- third-party integrations you connect;
- payment processors if paid Services are introduced;
- authentication, analytics, security, and infrastructure providers;
- publicly available sources, including public GitHub repository metadata;
- business partners or referral sources.
6. How We Disclose Personal Information
- hosting and infrastructure providers;
- AI model and API providers;
- authentication providers where configured;
- payment processors if paid Services are introduced;
- analytics and product analytics providers where configured;
- email and communication providers where configured;
- customer support tools;
- security, logging, and fraud prevention providers;
- professional advisors, such as lawyers, accountants, and auditors;
- affiliates;
- business transaction parties in connection with a merger, acquisition, financing, restructuring, or sale of assets;
- law enforcement, regulators, courts, or other authorities where required by law;
- other parties with your consent or direction.
Disclosure limits
We do not disclose personal information except as described in this Privacy Policy, as directed by you, or as permitted or required by law.
8. Analytics
We may use analytics tools to understand how users interact with the Services, improve functionality, detect errors, and measure performance.
The current public website codebase does not configure Google Analytics, PostHog, session replay, heatmaps, retargeting pixels, or cross-context advertising.
Hosting providers may process technical event data, request metadata, errors, and diagnostics for reliability and security.
9. Payments
The current public website implementation does not include checkout or payment processing.
If you purchase paid Services in the future, payment-related personal information may be processed by a payment processor to process transactions, manage subscriptions, issue invoices, prevent fraud, and comply with tax and accounting obligations.
10. Marketing Communications
We may send marketing emails if permitted by law. You may unsubscribe at any time by using the unsubscribe link or contacting us.
Even if you opt out of marketing, we may still send transactional, legal, security, and account-related messages.
11. Data Retention
We retain personal information for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Services, comply with legal obligations, resolve disputes, enforce agreements, maintain security, and operate our business.
- Account and admin data: for the life of the account plus a reasonable period afterward.
- Billing data: not currently collected by the public website; if introduced, retained as required by tax, accounting, and legal obligations.
- Security logs and rate-limit records: typically 30 to 180 days unless needed for investigation.
- User Content, workflow inputs, files, repository links, AI outputs, and related service records: according to product functionality, account settings, contract terms, or deletion requirements.
- Support communications: as long as needed for support, legal, and business purposes.
12. Security
We use reasonable administrative, technical, and organizational safeguards designed to protect personal information.
However, no system is completely secure. We cannot guarantee that personal information will never be accessed, disclosed, altered, or destroyed by unauthorized parties.
You are responsible for securing your account credentials, devices, systems, and integrations.
13. GDPR Notice for the EEA, UK, and Switzerland
Where the EU or UK General Data Protection Regulation or the Swiss Federal Act on Data Protection applies, we process personal information on the following legal bases: performance of a contract or pre-contractual steps taken at your request (Art. 6(1)(b) GDPR), our legitimate interests in operating, securing, and improving the Services and communicating with business contacts (Art. 6(1)(f) GDPR), your consent where required, for example for non-essential cookies or marketing (Art. 6(1)(a) GDPR), and compliance with legal obligations (Art. 6(1)(c) GDPR).
- You have the right to access the personal information we hold about you (Art. 15 GDPR);
- the right to rectification of inaccurate data (Art. 16 GDPR);
- the right to erasure (Art. 17 GDPR);
- the right to restriction of processing (Art. 18 GDPR);
- the right to data portability (Art. 20 GDPR);
- the right to object to processing based on legitimate interests, including direct marketing (Art. 21 GDPR);
- the right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR);
- the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your residence, workplace, or the place of the alleged infringement.
Exercising your rights
To exercise these rights, contact us at hello@exokern.com. We will respond within the timeframes required by applicable law. We may need to verify your identity before processing your request.
14. U.S. State Privacy Rights
Depending on your state of residence, you may have rights regarding your personal information, including the right to know, access, correct, delete, obtain a portable copy, opt out of targeted advertising, sale, or sharing, limit certain uses of sensitive personal information, appeal a privacy rights decision, and not be discriminated against for exercising privacy rights.
To exercise rights, contact us at hello@exokern.com. We may need to verify your identity before processing your request.
15. California Privacy Notice
Categories of Personal Information Collected
In the past 12 months, we may have collected identifiers, commercial information, internet or network activity, professional or employment-related information, approximate geolocation derived from IP address, audio/electronic/visual information if you submit media, inferences such as product usage patterns or preferences, and sensitive personal information only if you submit it or if required for limited security or account purposes.
Purposes, Sources, and Disclosures
We collect and use these categories for the purposes described in this Privacy Policy, including providing the Services, security, support, analytics, billing where applicable, legal compliance, and business operations. Sources and disclosure categories are described above.
Sale or Sharing
We do not sell personal information for money. We also do not share personal information for cross-context behavioral advertising unless expressly disclosed in our cookie banner or privacy settings.
If we use advertising or retargeting technologies that constitute sharing under California law, we will add a Do Not Sell or Share My Personal Information link and a compliant opt-out mechanism.
Sensitive Personal Information and California Rights
We do not use or disclose sensitive personal information for purposes that require a right to limit under California law unless expressly disclosed.
California residents may request access, deletion, correction, portability, information about disclosures, and opt-out of sale or sharing where applicable by contacting hello@exokern.com.
16. Do Not Track and Global Privacy Control
Some browsers transmit Do Not Track signals. We do not currently respond to Do Not Track signals unless required by law.
Where required by applicable law, we will honor recognized universal opt-out mechanisms, such as Global Privacy Control, for applicable opt-out rights.
17. Children's Privacy
The Services are not intended for children under 13, and we do not knowingly collect personal information from children under 13.
The Services are intended for users who are at least 18 years old. If we learn that we have collected personal information from a child without required consent, we will delete it as required by law.
18. International Data Transfers
Exokern processes personal information primarily in Germany and the European Union. Some of our service providers, such as hosting and email infrastructure providers, may process personal information in the United States or other countries.
Where personal information is transferred outside the EEA, the UK, or Switzerland, we rely on appropriate safeguards, such as adequacy decisions, the EU-U.S. Data Privacy Framework where applicable, or Standard Contractual Clauses.
19. Business Transfers
We may disclose or transfer personal information in connection with a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction.
20. Legal Compliance and Protection
We may disclose personal information if we believe it is necessary to comply with law, subpoena, court order, or legal process; respond to lawful requests by public authorities; enforce our Terms; protect the rights, property, or safety of Exokern, users, or others; or detect, prevent, or investigate fraud, abuse, security incidents, or technical issues.
21. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. The updated version will be posted with a new effective date.
If changes are material, we may provide additional notice as required by law.
22. Contact Us
Exokern Lab
Exokern Lab, Germany