Privacy Policy

Last updated: 10 October 2026

Who we are

Kernalin is a software-as-a-service product operated by Jashom (“we”, “us”). It is available at kerneln.com (the website) and kerneln.com/app (the app), together with the rnx command-line tool and the Kernalin VS Code extension.

For personal data in your account and on this website, we are the controller. For the workloads, kernels and results your team uploads to a workspace, we process that content on behalf of the customer who owns the workspace, to provide the service to them.

Contact for anything in this policy: [email protected].

What we collect

Account and workspace data

• Your email address, a salted hash of your password (never the password itself), and, if you sign in with single sign-on, the identity your provider returns.
• Workspaces, projects, memberships, roles and invitations.
• Integration settings you add: an encrypted GitHub access token if you connect GitHub, SSO connection settings (with encrypted client secrets), CI API tokens (stored hashed), and alert destinations such as Slack or Teams webhook URLs and email recipients.
• An audit log of actions taken in a workspace, with the account and time.

Content you upload

• Workloads, kernel source code, models (for example ONNX files) and configuration you upload or that our GitHub integration fetches from repositories you connect.
• What the service produces from them: benchmark and profiling results, memory analyses, verification verdicts, optimized or converted kernels, the model’s explanations, and job logs.
• GPU telemetry and cost data from the GPUs you connect, such as utilization, memory use and the hourly price you enter.

Technical data

• Server and proxy logs: IP address, time, requested URL (including any query string), user agent and response status. These are used for security, debugging and abuse prevention.
• On the website we do not set cookies. Your theme choice is kept in your browser’s local storage. If you arrive from a link with campaign parameters (utm_*, gclid, ref), a small script keeps them, and the referring site, in your browser’s session storage for that visit and adds the campaign parameters to links to our contact page, so they can appear in our server logs. Cloudflare Web Analytics may count page views without cookies.
• The app uses one essential session cookie to keep you signed in.

When you email us

Your name, email address and whatever you choose to tell us, for example about your GPU stack.

How we use it, and our legal basis

• To provide the service (performance of our contract with you or your organization): run intake checks, benchmarks, profiling, verification, optimization and the CI gate on your workloads; show results; send the emails and alerts you set up.
• AI features (contract): when you or a teammate uses Explain or Optimize, we send the relevant kernel source and its measurements to our AI model provider (see below). Uploading a workload alone does not send it to the model provider.
• Security and abuse prevention (legitimate interests): sandboxing, rate limits, logs, and investigating incidents.
• Improving the product (legitimate interests): aggregate usage and reliability information. We do not use the content of your workloads to train AI models.
• Answering you (legitimate interests, or steps before a contract): early-access, sales and support emails.
• Legal obligations: where the law requires us to keep or disclose information.

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

AI processing of your kernels

The Explain (suggestions) and Optimize features use Anthropic’s Claude models. To use them we send Anthropic, through OpenRouter, the kernel source you asked about, its profile and benchmark results, the description of the execution environment, and our instructions. The model’s reply is stored with your results. Each provider handles this data under its own terms and privacy policy (Anthropic, OpenRouter). If your organization cannot send kernel source to a third-party model provider, don’t use Explain or Optimize; the other features don’t need it.

Sub-processors

These companies process personal data or customer content for us:

Services you connect yourself, such as GitHub, Slack, Microsoft Teams or your identity provider, receive data because you configured them to, under your own agreement with them. We will update this list before adding a new sub-processor that handles customer content.

How long we keep it

• Account and workspace content: for as long as the account or workspace exists. When you delete your account in the app, it is removed immediately, along with any workspace where you were the only member and everything in it. In a shared workspace, only your membership is removed; the workspace’s content stays with the team.
• Backups: nightly backups are kept for up to 14 days, so deleted data can remain in backups for up to 14 days.
• Live GPU telemetry: 24 hours at full detail, and hourly summaries for 90 days.
• Server logs: kept only as long as needed for security and debugging.
• Emails with us: as long as needed to deal with your request and any follow-up.

Security

Uploaded workloads are checked on intake and run in a sandbox with no network access, as an unprivileged user on a read-only filesystem, with resource limits. Traffic is encrypted in transit with TLS. Secrets such as GitHub tokens and SSO client secrets are encrypted at rest, and passwords and API tokens are stored only as hashes. Access within a workspace is controlled by roles. No system is perfectly secure; if you find a vulnerability, please email [email protected].

International transfers

Our providers operate in several countries, including the United States, so your data may be processed outside the country where you live. Where data protection law requires it, we rely on appropriate safeguards for those transfers, such as the European Commission’s Standard Contractual Clauses. You can ask us for details at [email protected].

Your rights

Depending on where you live (for example under the GDPR, the UK GDPR or US state privacy laws such as the CCPA), you may have the right to access, correct, delete or export your personal data, to object to or restrict some processing, and to withdraw consent where we rely on it. You can delete your account yourself in the app. For anything else, email [email protected]; we may need to confirm your identity, and we will reply within the time the law requires (one month under the GDPR). If the data belongs to a workspace your employer controls, we may refer you to them. You also have the right to complain to your local data protection authority.

Children

Kernalin is a tool for professionals and is not directed at children. We do not knowingly collect data from anyone under 16.

Changes

If we change this policy, we will update the date at the top. If a change is material, for example a new use of your content or a new AI provider, we will tell account holders by email or in the app before it takes effect.

Contact

Privacy questions and requests: [email protected]. Security issues: [email protected].