Privacy policy

Last updated: April 2026 Alpha version — GDPR

1. Who are we?

Kymora is an AI assistant specialised in Luxembourg labour law and HR compliance, published by Kymora ([email protected]).

2. Data collected

• User account: email address and password (encrypted via bcrypt)
• Questions asked: the content of questions submitted to the AI is stored in the database
• Technical logs: IP address, timestamps of logins and actions, for debugging and security purposes
• Anonymised browsing data: pages visited, country, browser, via Umami Analytics (no cookies, no personally identifiable data)

3. Purpose of processing

• Service provision (authentication, AI responses)
• Detection and correction of technical bugs
• Security and abuse prevention
• Anonymised usage analysis to improve the product

Data is never used to train AI models.

We may use your email address to contact you to collect feedback on the service. You can object at any time by writing to [email protected].

4. Data sharing

Questions are transmitted to OpenRouter, a language model access platform, which may use providers in different regions worldwide (USA, Europe, Asia). No personally identifiable data (email, IP) is transmitted to these third parties.

No data is sold or transferred for commercial purposes to third parties.

5. Data retention

Data is retained without a defined time limit. You can request deletion of your data at any time by contacting [email protected].

6. Cookies

• access_token: JWT session cookie, 30-day duration, httpOnly, not accessible via JavaScript
• Cloudflare cookies (__cf_bm): anti-bot protection, automatically set by the CDN

No tracking or advertising cookies are used.

7. Your rights (GDPR)

You have the following rights: access, rectification, erasure, portability, objection.
Contact: [email protected]

8. Security

Passwords are encrypted via bcrypt. Communications are encrypted via HTTPS (TLS 1.3). Database access is restricted to the application server.

---