Legal

Privacy Policy

Last updated: 28 June 2026 · Effective immediately

BlackFlag Digital (Pty) Ltd trading as KairoNull ("KairoNull", "we", "us", or "our") operates kaironull.com and the Umbra Trust Protocol evidence infrastructure. This policy explains what personal data we collect, why, how long we keep it, and what rights you have.

1. Who we are

KairoNull is the data controller for information collected through this website and newsletter. For questions about this policy, contact [email protected].

2. What data we collect

• Newsletter subscribers: email address only. No name required.
• Contact enquiries: email address and the content of your message.
• Verification tool: the hash string you submit. We do not store this. Verification is stateless and runs in your browser against our public ledger API.
• Analytics: Cloudflare Web Analytics. Privacy-first: no cookies, no fingerprinting, no cross-site tracking. We see aggregated page view counts only.

3. Legal basis (GDPR)

• Newsletter: consent (Article 6(1)(a)). You may withdraw at any time by clicking unsubscribe in any email.
• Contact enquiries: legitimate interest (Article 6(1)(f)), responding to business enquiries.
• Analytics: no personal data is collected by Cloudflare Analytics, so no legal basis is required.

4. How we use your data

• Newsletter email addresses are used solely to send The Evidence Brief: regulatory updates, AI governance intelligence, and KairoNull product news. We never sell or share subscriber lists.
• Contact enquiry data is used only to respond to your message.

5. Data retention

• Newsletter subscribers: retained until you unsubscribe or request deletion.
• Contact messages: retained for 24 months, then deleted.

6. Third-party processors

• Loops.so: newsletter delivery. Stores subscriber email addresses on our behalf. Loops.so privacy policy: loops.so/privacy.
• Cloudflare, website hosting and privacy-first analytics. No personal data is shared with Cloudflare beyond standard network routing.

7. Your rights

Under GDPR and UK GDPR, you have the right to: access your data, correct inaccuracies, request deletion, withdraw consent, lodge a complaint with your supervisory authority.

To exercise any right, email [email protected]. We will respond within 30 days.

8. Cookies

We use no third-party cookies. No tracking pixels, no advertising cookies, no cross-site identifiers. Any local storage we use is limited to session state (e.g. verification UI) and never leaves your device.

9. Changes to this policy

We will post any changes here with an updated effective date. Material changes will be communicated to newsletter subscribers.

10. Contact

Privacy questions: [email protected]
General enquiries: [email protected]