Privacy policy

Kipling Secure Inc. ("Kipling Secure," "we," "us," or "our") provides an AI security and governance platform discover, monitor, govern, and protect the use of artificial intelligence applications and agents.

This Privacy Policy explains how we collect, use, disclose, and protect Personal Information in connection with:
• our website, marketing, sales, and business operations ("Website and Business Data"); and
• the Kipling Secure platform and related services ("Platform Customer Data").

We treat these categories differently. In particular, Platform Customer Data is processed on behalf of our customers and partners and is subject to the applicable customer agreement and Data Processing Addendum ("DPA").

If there is a conflict between this Privacy Policy and an executed customer agreement or DPA regarding Platform Customer Data, the executed agreement or DPA will control.

Questions about this Privacy Policy may be sent to privacy@kiplingsecure.ai.

1. Our Role in Processing Personal Information

For Website and Business Data that Kipling Secure collects directly for its own business purposes, Kipling Secure generally acts as the business or data controller.

For Platform Customer Data, Kipling Secure generally acts as a processor or service provider on behalf of the organization using the Platform.

Where an MSP provides the Platform to a managed customer, the managed customer may act as controller, the MSP may act as processor, and Kipling Secure may act as subprocessor.

Kipling Secure processes Platform Customer Data only as necessary to provide, secure, support, and operate the services and in accordance with applicable customer instructions and contractual terms.

2. Information We Collect‍

Website and Business Data‍

We may collect information such as:
• name, business email address, telephone number, company, and job title;
• information submitted through website forms, demonstrations, events, or communications with us;
• customer and partner account information;
• billing and commercial information;
• support requests and correspondence;
• IP address, browser type, device information, and website activity; and
• cookie and analytics information.
Payment card information, when applicable, is processed by our payment service providers and is not intended to be stored directly by Kipling Secure.‍

Platform Customer Data
The information processed by the Platform depends on the services enabled and the customer's configuration.
Platform Customer Data may include:
• user and account identifiers;
• device and endpoint information;
• IP addresses, hostnames, and network metadata;
• authentication and access activity;
• application and process activity;
• security telemetry and policy events;
• AI application usage information;
• prompts submitted to supported AI applications;
• AI responses or related response metadata where the applicable feature is enabled;
• uploaded file metadata and, where inspection features are enabled, file or content information necessary to perform security analysis;
• detected sensitive-data categories and policy violations;
• information regarding AI agents, connected applications, MCP servers, tools, permissions, and authorization scopes; and
• security, audit, and administrative logs.

Because users may enter Personal Information, confidential information, or regulated information into AI applications, Platform Customer Data may contain such information.

Kipling Secure processes that information only as necessary to provide the configured security and governance services and in accordance with the applicable customer agreement and DPA.

‍3. How We Use Information

We may use Website and Business Data to:
• provide and administer our website and services;
• respond to inquiries and provide demonstrations;
• manage customer and partner relationships;
• provide support;
• communicate about products, services, and events;
• administer billing and contracts;
• maintain the security of our systems;
• analyze website usage and improve our website; and
• comply with legal obligations.

We use Platform Customer Data to:
• provide AI discovery, monitoring, governance, and security capabilities;
• identify AI applications, agents, and related activity;
• perform threat, behavioral, and security analysis;
• inspect data for configured security and governance policies;
• identify potential sensitive-data exposure and policy violations;
• enforce customer-configured controls;
• generate alerts, reports, and audit records;
• investigate security events;
• administer customer and MSP environments;
• provide technical support and troubleshooting; and
• maintain and secure the Platform.

We do not use Platform Customer Data for advertising or to market third-party products to monitored users.

4. AI Processing and Model Training‍

The Kipling Secure Platform uses AI and machine-learning techniques as part of its security, governance, detection, and analytics capabilities.

Personal Information processed through those capabilities is used for the purpose of providing the Kipling Secure services and not for an independent commercial purpose.

Kipling Secure does not use customer prompts, AI responses, files, or security telemetry to train general-purpose or third-party foundation models.

Platform Customer Data is processed only as necessary to provide, secure, support, and operate the contracted Kipling Secure services.

Kipling Secure uses AI services hosted on Microsoft Azure to support certain Platform capabilities, including security analysis and threat detection.

Customer Data processed through these services remains subject to the applicable Microsoft Azure data protection and security commitments.

Kipling Secure does not sell customer prompts, AI responses, files, security telemetry, or other Platform Customer Data.

Our sub processors are contractually required to process Personal Information only for authorized purposes and subject to applicable data protection and security obligations.

‍5. Disclosure and Subprocessors

We may disclose Personal Information to service providers and sub processors that assist us in providing and securing the services, including providers of:

• cloud infrastructure and storage;
• authentication and identity services;
• monitoring and observability;
• security and threat-analysis infrastructure;
• customer support and business operations; and
• communications and notification services.

Our current Platform sub processors include providers such as Amazon Web Services (AWS), Microsoft Azure, and Descope.

We contractually require subprocessors that process Platform Customer Data to maintain appropriate
confidentiality, privacy, and security protections.

Kipling Secure remains responsible for its subprocessors as provided in the applicable DPA.

A current subprocessor list is available through Kipling Secure's Trust Center or upon request.

We may also disclose Personal Information when required by law; to protect the security, rights, or property of Kipling Secure, our customers, or others; or in connection with a merger, acquisition, financing, or similar corporate transaction, subject to applicable legal protections.

‍6. We Do Not Sell Platform Customer Data

Kipling Secure does not sell Platform Customer Data.

We do not disclose Platform Customer Data to advertising networks or data brokers and do not use it for cross-context behavioral advertising.

Information collected through the public Kipling Secure website may be processed by analytics and marketing service providers as described in our cookie controls and this Privacy Policy.

‍7. Security

Kipling Secure maintains technical and organizational safeguards designed to protect Personal Information.

Our Platform security measures include, as applicable:
• encryption in transit using TLS 1.2 or higher;
• encryption at rest using AES-256 or equivalent industry-standard cryptography;
• least-privilege and role-based access controls;
• multi-factor authentication for personnel accessing production environments;
• logical isolation between customer environments;
• security monitoring and logging;
• vulnerability assessment and independent penetration testing;
• documented incident-response procedures;
• business continuity and disaster-recovery processes; and
• confidentiality and security obligations for personnel with access to Personal Information.

No information system can guarantee absolute security, but we maintain safeguards appropriate to the nature of the information and the risks associated with its processing.

‍8. Security Incidents

Kipling Secure maintains a documented incident-response program.

For Platform Customer Data subject to our DPA, Kipling Secure will notify the applicable customer or partner of a confirmed Personal Data Breach without undue delay and, under our standard DPA, within 48 hours after becoming aware of the breach.

We will provide available information reasonably necessary to assist the affected customer with its applicable notification and remediation obligations.

‍9. Data Retention and Deletion

We retain Website and Business Data only for as long as reasonably necessary for the purposes described in this Privacy Policy, to maintain our business records, or as required by law.

Platform Customer Data is retained in accordance with the customer's subscribed service tier, configured retention settings, applicable documentation, and contractual terms. Retention periods may vary by data type and service tier.

Kipling Secure does not retain Personal Information for longer than reasonably necessary to provide the applicable services, meet security and operational requirements, or satisfy legal obligations.

Applicable retention periods are provided in the customer's service documentation or agreement and are available upon request.

Under our standard customer agreements, following termination customers generally receive a 60-day export window, which may be extended by up to 30 additional days in specified circumstances.

Following the applicable export period, Platform Customer Data is securely deleted or anonymized unless continued retention is required by law or otherwise agreed with the customer.

Customers may contact privacy@kiplingsecure.ai regarding applicable retention or deletion procedures.

‍10. International Data Transfers‍

Kipling Secure is based in the United States, and Personal Information may be processed in the United States and in other jurisdictions in which our authorized sub processors operate.

Where required, we use appropriate safeguards for international transfers of Personal Information.

For transfers of Personal Data subject to the European Economic Area GDPR, UK GDPR, or Swiss data protection law, our DPA incorporates applicable Standard Contractual Clauses and other legally required transfer mechanisms.

‍11. Privacy Rights

Depending on where you live and the nature of our relationship with you, you may have rights concerning your

Personal Information, including rights to:
• access Personal Information;
• correct inaccurate Personal Information;
• request deletion;
• restrict or object to certain processing;
• obtain a portable copy of certain information;
• withdraw consent where processing is based on consent;
• opt out of certain marketing communications; and
• lodge a complaint with an applicable privacy regulator.

Requests relating to Website and Business Data may be submitted to privacy@kiplingsecure.ai.
‍
For Platform Customer Data, Kipling Secure generally processes information on behalf of a customer or MSP.

Individuals should normally direct privacy requests to the organization that controls their information.

We will assist our customers with those requests as required by applicable law and our DPA. We may need to verify identity or authority before fulfilling a request.

‍12. California Privacy Rights

California residents may have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), including applicable rights to know, access, correct, and delete Personal Information and to opt out of certain uses or disclosures.

Kipling Secure does not sell Platform Customer Data.

Where Kipling Secure processes Platform Customer Data on behalf of a customer, we act as a service provider or contractor as applicable under California law and process that information in accordance with our contractual obligations.

California privacy requests concerning information for which Kipling Secure acts as the business may be sent to privacy@kiplingsecure.ai.

We will not discriminate against an individual for exercising an applicable privacy right.

13. Cookies and Website Analytics

Our website may use cookies and similar technologies required for website operation, security, analytics, and,where applicable, marketing.

Visitors may control cookies through browser settings and any cookie-consent controls provided on our website.

Website analytics information is separate from Platform Customer Data. We do not use monitored Platform Customer Data to create advertising profiles.

14. Marketing Communications

You may unsubscribe from promotional email communications using the unsubscribe mechanism contained in the message or by contacting us at privacy@kiplingsecure.ai.

We may continue to send transactional, security, contractual, or service-related communications where necessary.

‍15. Children‍

Kipling Secure's website and services are business-to-business services and are not directed to children.

We do not knowingly solicit Personal Information directly from children for use of the Platform.

If you believe a child has provided Personal Information directly to Kipling Secure inappropriately, please contact us at privacy@kiplingsecure.ai.

‍16. Data Processing Addendum

Customers and partners may request our Data Processing Addendum, which provides additional contractual commitments relating to:
• controller, processor, and subprocessor roles;
• permitted processing;
• security requirements;
• subprocessors;
• international data transfers;
• data-subject requests;
• breach notification;
• audits; and
• data return and deletion.

Contact privacy@kiplingsecure.ai to request a copy.

‍17. Changes to this Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our services, legal requirements, or data-processing practices.

When we make material changes, we will update the "Last Updated" date and provide additional notice where required by applicable law.

‍18. Contact Us

Questions about privacy, data protection, or this Privacy Policy may be directed to:

Privacy Officer, Kipling Secure Inc.
18 S Second St, San Jose, CA 95113
privacy@kiplingsecure.ai