Privacy policy

Last updated 1 November 2026

Kharon Labs personalizes websites for each visitor. This policy explains what personal information we collect when you use our website at kharonlabs.com, sign in to the console at console.kharonlabs.com, or visit a website that uses Kharon Labs, and what we do with it. “We” and “us” mean Kharon Labs.

Our role

• For account holders and visitors to our own website, we decide how personal information is used, so we are its controller.
• For visitors to our customers’ websites, we process information on our customer’s behalf and under their instructions. The customer is the controller, and their own privacy notice applies. Questions about that information are best sent to the website you visited; we will help them answer.

Information we collect

When you create an account or sign in

You sign in with Google or GitHub. We do not receive or store your password for either service.

• Google: we request the openid, email and profile scopes, and from them keep your Google account identifier and your verified email address. We use your name once, to name your first workspace (for example “Alex’s workspace”), and do not store it separately. We do not store your profile photo.
• GitHub: we request the read:user and user:email scopes, and keep your GitHub user ID and your verified primary email address. As with Google, your name or username is used only to name your first workspace.

We do not access your Google Drive, Gmail, contacts, calendar, repositories or any other data in those accounts.

When you use the console

We store what you and your team create: workspaces, members and their roles, the sites you connect, and the audiences, page content, variants, goals and published versions you author, along with who made each change and when.

If you connect a CRM (HubSpot, Salesforce, Pipedrive or Apollo), we read (never write) its lists (in Salesforce, list views; in Pipedrive, saved filters; in Apollo, account and contact lists), its companies and the contacts on lists you choose to sync. For companies we keep the name, website domain, industry, industry code, size, revenue, location, founding year, ownership, stock ticker, lifecycle stage or account type, owner name and which synced lists they are on. For contacts we keep only a keyed hash of the email address, the job title and the company domain: never their name or the email address itself. We store the CRM’s refresh token encrypted, and use this data only to target your audiences. When a visitor is matched to one of your CRM’s companies, the record of their company carries that company’s CRM fields, so your audiences can use them.

When an AI agent sets things up for you

An agent (such as a coding assistant) can ask to work in your account. When you approve its request we store the name it gave, the network address it asked from, the email it said it expected, and the role you granted, plus when its access was created and last used. Its access works until you revoke it in settings.

When you pay for a plan

Payments go through Stripe’s checkout page; your card details go to Stripe, never to us. We keep your Stripe customer and subscription identifiers, your plan, its status and when the current period ends.

When you visit a website that uses Kharon Labs

This includes our own homepage, which runs on Kharon Labs. To choose which version of a page to show, and to measure whether it worked, we process:

• Request details: your IP address, the country our network provider derives from it, your browser’s user agent, the page address and any campaign parameters in it, and the referring page.
• Inferred company: the company we believe the visit comes from (for example from a campaign link, the referring site, or the organization that owns your network address) and how confident we are. We infer organizations, not individuals. Network addresses are looked up in a copy of public datasets on our own servers (IP address data by IPinfo and IP2Location LITE, both CC BY-SA 4.0), and never stored. For an address on a business network we may also ask the public DNS for the name its owner published for it (reverse DNS), which reaches that network’s own DNS servers; we keep only the company domain from the answer. Your address is otherwise never sent to a third party.
• Visitor identifier: a random ID stored in a first-party cookie, so the same visitor sees a consistent page and is counted once.
• Usage events: page views, which content was shown, interactions with it, and conversions the website owner defines (such as booking a demo), each with the visitor and session IDs, a timestamp, and the domain of the company the visit was matched to, if any, and the kind of signal behind that match (such as the network address or a campaign link). Company details such as industry and size are looked up from that domain when reports are made, not stored with each event.

In the European Economic Area, the United Kingdom and Switzerland, and wherever we cannot tell a visitor’s location, we do not set the visitor cookie, record events or keep identity evidence unless the visitor gives consent on the website’s consent banner. Elsewhere you can opt out by turning on your browser’s Global Privacy Control signal, which we honour everywhere. Without consent we still use details of the current request (such as a campaign link) to choose content for that page, and keep nothing afterwards.

Technical logs

Our servers keep operational logs, which can include IP addresses and request details, to run, debug and secure the service.

Cookies and similar storage

We do not use advertising cookies or third-party tracking pixels.

How we use information

• To create your account, sign you in and keep your session secure.
• To provide the service: resolving which content a visitor sees and reporting how it performs.
• To let the website owner review individual visits to their site: the pages a visitor viewed, the content they were shown, what they interacted with and converted on, and the company they were matched to, grouped by the visitor identifier. This uses only the usage events above; we do not record screens, typing or mouse movement.
• To operate, maintain, debug and protect the service, and to prevent abuse.
• To contact you about your account, security, and changes to the service or these documents.
• To comply with legal obligations and enforce our terms of service.

Where the GDPR or UK GDPR applies, we rely on performance of our contract with you (account and service), our legitimate interests (security, debugging and improving the service), consent (visitor cookies and measurement where consent is required) and legal obligation.

Google user data

Kharon Labs’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to sign you in and identify your account. We do not sell it, use it for advertising, use it to train AI or machine learning models, or let people read it except where you ask us to, for security, or where the law requires.

How we share information

We do not sell personal information. We share it only with:

• Service providers that host and run the service for us under contract, principally Amazon Web Services (hosting, database and content delivery, in the United States).
• Google and GitHub, when you choose to sign in with them. Their own privacy policies apply to your accounts there.
• Moonshot AI’s Kimi models on Amazon Bedrock, when you ask for AI-drafted copy. We send the slot copy, audience rule and brief you submit to Amazon Bedrock to write the drafts. We never send visitor data.
• Stripe, when you subscribe to a plan. We send your email address and workspace identifier; Stripe handles your payment details under its own privacy policy.
• Our customers, who see reports about visits to their own websites. Reports describe companies and aggregate results, not named people.
• Other members of your workspace, who can see your email address and role.
• Authorities or others when the law requires it, or to protect the rights, safety and property of our users, the public or us.
• A successor, if we are involved in a merger, acquisition or sale of assets, with notice to you.

How long we keep it

• Account and workspace data: while your account is active, and deleted within 30 days of a deletion request.
• Usage events, including the company each was matched to: while the customer’s site uses Kharon Labs, or until the customer asks us to delete them.
• Identity evidence: deleted automatically 400 days after it was recorded or the visitor was last seen. Records of a returning visitor’s company: 90 days.
• Data imported from a CRM: replaced on every sync, so records deleted in the CRM are deleted here at the next sync (daily). Disconnecting the CRM deletes all of it. Copies in the records of visitors’ companies are refreshed when a sync changes them, and otherwise expire with those records.
• Server logs: about 14 days. Database backups: about 1 day.
• Cookies: as listed above.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict how we use it, and to withdraw consent at any time. You can also revoke Kharon Labs’s access from your Google or GitHub account settings. To make a request, email alex.armenciu@gmail.com. We will respond within the time the law allows and will not treat you differently for exercising these rights. If you are in the EEA or UK, you may also complain to your local data protection authority.

Security

Data is encrypted in transit, sessions are signed, and access to production systems is restricted. No system is perfectly secure, so we cannot guarantee absolute security; we will notify you of a breach affecting your information as the law requires.

International transfers

We store and process data in the United States. Where the law requires, we protect transfers from the EEA, the UK and Switzerland with appropriate safeguards such as the European Commission’s standard contractual clauses.

Children

Kharon Labs is a business tool and is not directed to children. You must be at least 16 to create an account, and we do not knowingly collect information from children.

Changes

We will post any change to this policy on this page and update the date above. If a change is significant, we will also tell account holders by email or in the console before it takes effect.

Contact

Kharon Labs. Email alex.armenciu@gmail.com.