Privacy Policy.
This policy explains what personal information Kantrix collects, why we collect it, who we share it with, where it is kept and for how long, and the choices and rights you have.
In short
- The data inside your virtual machines and containers stays on your nodes. We don't collect it.
- We collect what we need to run Kantrix: who you are, what you manage with it, and how the platform is working.
- We don't sell personal information, and we don't use advertising or analytics trackers on kantrix.io or in the portal.
- The Kantrix control plane runs on Amazon Web Services in the United States, and the emails we send go through AWS there too.
- Two features use AI models: the assistant (Amazon Bedrock) and failure triage (TypeSafe). Section 4 says what each one receives.
- To ask about your information, email privacy@kantrix.io.
1. Who we are
Kantrix Inc. ("Kantrix", "we" or "us") is an Ontario corporation. We make Kantrix, a platform that runs virtual machines and containers on servers our customers control, managed through a portal and control plane that we host.
Our Privacy Officer is accountable for how we handle personal information, and can be reached at privacy@kantrix.io.
2. What this policy covers
This policy covers personal information that Kantrix decides how to use:
- when you visit kantrix.io or status.kantrix.io, or fill in a form on them;
- when you create an account, and when you use the portal, the partner portal or our APIs;
- when you contact us for support, sales or partnership, or apply to our partner program;
- when a Partner registers a deal with us that names you.
When we act for a customer. When an organization uses Kantrix, it decides what goes into its account: its users, its sites, its nodes and its workloads. For that information, we act as a service provider, or processor, for that organization, under our Terms of Service. If you are a user in an organization's account, or one of its clients, contact that organization about your information. If it is an IT provider in our partner program, you can contact the provider directly. We will help the organization respond to you.
3. What we collect, and why
Information you give us
| What | Examples | Why we use it |
|---|---|---|
| Forms on our websites | Name, work email, company, country, province or state, sector, number of sites, current platform, IT provider | To reply to you, send the security overview, assess a partner application, and, if you ask us to, introduce you to a partner |
| Your account | Name, email address, organization, role | To give you access to the portal and identify you in it |
| Sign-up details | The page that referred you, campaign tags in the link you followed, language, country, company size | To understand how organizations find Kantrix |
| Business contacts | Name, email, phone, job title, and records of our emails and meetings with you | To manage our relationship with customers, partners and prospects |
| Deal registrations | The name, email and phone of a contact at a business that a Partner registers with us | To protect the Partner's deal and support it. Partners must have a lawful basis to share them with us |
| Support requests | What you tell us, and any files you send | To help you, and to fix and improve Kantrix |
| Billing | Billing contacts, invoices and payment records | To invoice and keep accounting records. We don't take card payments, so we don't collect card numbers |
Information collected as you use Kantrix
| What | Examples | Why we use it |
|---|---|---|
| The activity log | Every change made in the portal or API, who made it, when, and with what role | Security, accountability and support. The log can't be edited or deleted |
| Remote access records | For console and shell sessions opened through the portal: who opened them, when, the IP address and browser used, and, where your organization records sessions, the recording | Security and your organization's own audit |
| Node information | Hostnames, network interfaces, serial numbers, a hardware fingerprint, the location you give each site, the node's public IP address, metrics and logs | To run, monitor and support your nodes |
| Assistant conversations | The questions you ask and the answers given | See section 4 |
| Sign-in data | When and how you sign in. Your password is handled by Amazon Cognito, and we never see it | To keep accounts secure |
What we don't collect
- The data in your workloads. Virtual machine and container disks, and the data in them, stay on your nodes. Kantrix staff cannot open a console or shell on your nodes.
- Tracking data. kantrix.io sets no cookies and uses no analytics or advertising tools. The portal uses no third-party analytics either.
- Sensitive information. We don't ask for sensitive information, such as health information or government identifiers. Please don't put it in support requests or the assistant.
Our legal bases
Where the law asks for a legal basis, we rely on: performing our contract with you or your organization; our legitimate interests in running, securing and improving Kantrix and in growing our business, balanced against your rights; your consent, such as for a partner introduction; and our legal obligations.
4. AI features
Two features in Kantrix use AI models.
The assistant. When you ask the assistant a question, we send it, with the information about your fleet the answer needs (such as device and virtual machine names, status and alerts), to a model on Amazon Bedrock. We use Anthropic's Claude models and Amazon's Nova models, processed in AWS's United States regions. Under AWS's terms, Bedrock does not use your questions to train models, and does not share them with the model's maker. We store each conversation: the question, the answer, the tools used and the fleet information behind it. We use stored conversations to provide and improve the assistant for your organization. We use them to improve Kantrix's AI features for anyone else only if your organization opts in, and then only in anonymized form. The assistant can propose actions, but nothing it proposes runs until a person approves it.
Failure triage. When an operation in Kantrix fails, we may send the error message and a short summary of what failed to TypeSafe AI, Inc., which hosts its service in the United States. Its answer helps us suggest a fix. The message may include names you have given things, such as virtual machine names, and details of the node involved. TypeSafe has committed not to train models on what we send it.
5. Who we share it with
We share personal information only as this policy describes. We don't sell personal information, and we don't share it for targeted advertising.
- Partners. If you ask us on a form to find you a partner, or to run an exit assessment, we share your details with the one partner we introduce, because you said yes. If your organization is managed by a Partner, that Partner can see your organization's information in Kantrix.
- Service providers. Companies that host, run or support Kantrix for us, listed in section 6. They may use the information only to provide their services to us.
- The law and safety. Where the law requires it, or where it is needed to protect the rights, property or safety of anyone, including to investigate fraud or abuse.
- Business transfers. As part of a merger, financing, acquisition or sale of all or part of our business, under confidentiality obligations.
- With your consent. In any other case, only if you agree.
6. Our service providers
| Provider | What it does for us | Where |
|---|---|---|
| Amazon Web Services | Hosts the control plane: its servers, database, sign-in (Amazon Cognito), file storage, encryption keys, maps (Amazon Location Service), and kantrix.io and status.kantrix.io | United States (Ohio and Northern Virginia) |
| Amazon Web Services | Sends our emails (Amazon Simple Email Service) | United States (Ohio) |
| Amazon Bedrock, with models from Anthropic and Amazon | Runs the assistant | United States |
| TypeSafe AI, Inc. | Failure triage | United States |
| Microsoft 365 | Our own email, calendar and documents | Canada |
| GitHub | Tracks engineering work. When we pass a support issue to our engineers, we leave out the name of the person who reported it | United States |
Some providers see limited technical information when your browser or your nodes contact them:
- Pages on kantrix.io load fonts from Google Fonts, and the home page loads code from jsDelivr. Those services see your IP address and browser details.
- Map tiles in the portal come from Amazon Location Service, which sees the area of the map you're viewing. It does not receive the locations of your sites.
- To check its network, a node contacts public servers run by Google and Cloudflare, which see the public IP address of the site's network.
7. Where your information is stored
We are based in Canada, and we store personal information in the United States, with the exceptions section 6 lists. When your information is in another country, the laws of that country apply to it, and its courts, law enforcement and national security authorities may be able to access it. We protect it there with contracts and the safeguards in our Security Policy.
8. How long we keep it
We keep personal information only as long as we need it for the purposes in this policy, or as long as the law requires.
| Information | How long we keep it |
|---|---|
| Account and organization information | While the account is open, and up to 90 days after it closes |
| The activity log | While the organization's account is open |
| Remote access records | 400 days by default. Your organization can set between 1 and 7 years |
| Session recordings | 90 days by default, or the period your organization sets |
| Node metrics | 7 days |
| Node logs | 30 days |
| The control plane's own server logs | 30 days |
| Database backups | 7 days |
| Assistant conversations | While the organization's account is open |
| Forms, sales and partner records | Up to 2 years after our last contact, or longer while a business relationship continues |
| Billing records | As long as tax and accounting law requires, generally 7 years |
When we no longer need information, we delete it or make it anonymous. Copies in backups are overwritten in the normal course.
9. How we protect it
We protect personal information with technical and organizational safeguards suited to its sensitivity. These include encryption in transit and at rest, access checked against each person's role, a second sign-in step required of all Kantrix staff, and an activity log no one can change. Our Security Policy describes them. No system is perfectly secure. If a breach of security creates a real risk of significant harm to you, we will tell you and the regulators the law requires us to tell, as soon as feasible.
10. Cookies and browser storage
kantrix.io sets no cookies. The portal keeps your sign-in session, and settings such as your preferences, in your browser's local storage. It sets cookies only to keep the console and shell sessions you open in the portal signed in. These are needed for Kantrix to work, so we don't ask for consent to them, and there are no others to turn off. Because we don't sell or share personal information for advertising, there is nothing for a Do Not Track or Global Privacy Control signal to opt you out of.
11. Your rights
Depending on where you live, you may have the right to:
- know what personal information we hold about you, and get a copy;
- correct it if it is wrong;
- ask us to delete it;
- withdraw your consent, where we rely on it, or object to how we use it;
- receive it in a portable format;
- complain to a privacy regulator.
To use any of these rights, email privacy@kantrix.io. We may need to confirm your identity first, and we will use the information you give us for that only to verify you. We reply within 30 days. If we need longer, we will tell you why. You can ask someone to act for you if you give them written authority. We won't treat you differently for using your rights.
You can stop our marketing emails at any time with the unsubscribe link in each one, or by emailing us. We will still send messages about your account and the Services.
In Canada, you can complain to the Office of the Privacy Commissioner of Canada, or to your provincial privacy commissioner, such as Quebec's Commission d'accès à l'information.
In the United States, some states, including California, Colorado, Connecticut, Virginia and Utah, give residents the rights listed above. We don't sell personal information, share it for targeted advertising, or use it for profiling that has legal or similarly significant effects. If we decline a request, you can appeal by replying to our decision, and we will answer within 45 days.
In the European Economic Area, the United Kingdom and Switzerland, you can also ask us to restrict how we use your information, and complain to your local data protection authority.
12. Children
Kantrix is for businesses and is not directed at children. We don't knowingly collect personal information from anyone under 18. If you believe we have, email us and we will delete it.
13. Changes to this policy
We will update this policy when our practices change. The date at the top shows when it last changed. If we make a material change, we will tell account administrators by email or in the portal before it takes effect.
14. Contact us
Privacy Officer, Kantrix Inc., Ontario, Canada: privacy@kantrix.io.