Privacy Notice

This notice explains what personal data Emersa Labs (“Emersa”, “we”) collects through krupiq.com and portal.krupiq.com, why, how long we keep it, and the rights you have under the UK General Data Protection Regulation and the EU General Data Protection Regulation. Emersa Labs, London, is the data controller.

It covers the website and the portal only. The krupiq software runs on your own machines and sends nothing of yours to us; what it holds is covered by your agreement with us, not by this notice.

What we collect, and why

Early access requests. Your name, email address, company, and anything you write in the message box. We use it to reply to you and to arrange early access. Legal basis: the steps you ask us to take before a contract (Article 6(1)(b)), and our legitimate interest in answering enquiries (Article 6(1)(f)).

Portal accounts. Your email address, a sign-in link sent to it, any passkey you register, and the orders and licences on the account. We use these to run your account, issue licences and bill you. Legal basis: performance of the contract with you (Article 6(1)(b)) and our legal obligations on invoicing and tax (Article 6(1)(c)).

Payments. Payments are taken by Stripe. We receive the order status, the amount and the last part of the card number; we never see the full card details. Stripe’s own privacy notice applies to what it holds.

Licence renewals. A licensed installation reports its instance keys, the number of seats in use and a counter of audit entries so that its licence can be renewed. This identifies an installation, not a person.

Server logs. When you load a page, Cloudflare, which serves the site, records the IP address, the page requested and the time, as any web server does. We use these for security and to keep the site running. Legal basis: legitimate interest (Article 6(1)(f)).

Cookies and storage. The site sets no tracking or advertising cookies and uses no analytics. The portal sets one sign-in cookie when you sign in. Your browser keeps your light or dark theme choice locally. Nothing is shared with advertisers.

Who receives it

Cloudflare (hosting and email delivery infrastructure), Stripe (payments) and Postmark (transactional email such as sign-in links and receipts). Each acts on our instructions as a processor. We do not sell personal data and we do not share it with anyone else unless the law requires it.

Some of these providers operate outside the UK and the European Economic Area. Transfers rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, or on an adequacy decision where one applies.

How long we keep it

Early access requests: until we have replied and either arranged access or closed the request, then no longer than 12 months.
Account data: for as long as the account exists, then up to 12 months.
Orders and invoices: 6 years after the end of the tax year, as UK tax law requires.
Server logs: 30 days.

Your rights

You can ask us for a copy of the personal data we hold about you, ask us to correct or delete it, object to or restrict how we use it, and ask for it in a portable form. Where we rely on your consent, you can withdraw it at any time. Write to 4d@emersa.io and we will answer within one month.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office in the UK (ico.org.uk) or to the supervisory authority in the EU country where you live.

Changes

We will update this notice when what we collect changes. The date at the top says when it was last revised.