← Back to Kthulhu
KTHULHU

Privacy Policy

Effective date: 1 June 2026 · Last updated: 1 June 2026

Kthulhu ("we", "us", or "our") operates the autonomous smart contract security auditing platform at kthulhu.co. This Privacy Policy explains how we collect, use, store, and protect your personal information in accordance with the Protection of Personal Information Act (POPIA) and the General Data Protection Regulation (GDPR).

1. Information We Collect

When you create an account or use our services, we may collect:

  • Account data — organisation name, email address, hashed password
  • Audit data — smart contract code or repository URLs you submit for auditing
  • Usage data — API request logs, audit job metadata, timing data
  • Technical data — IP addresses, browser type, referring URL (via Plausible Analytics — cookieless, no personal fingerprinting)

We do not collect payment card data directly. Payment processing is handled by our payment provider under their own privacy policy.

2. How We Use Your Information

  • To provide, operate, and improve the Kthulhu audit platform
  • To authenticate your account and issue API credentials
  • To process audit jobs and deliver audit reports
  • To send transactional emails (audit completion, account alerts)
  • To detect and prevent fraud, abuse, and security threats
  • To comply with legal obligations under POPIA and applicable law

3. Data Storage and Security

Your data is stored on Cloudflare's global infrastructure (D1, KV) and Neon PostgreSQL (US East region). All data is encrypted in transit (TLS 1.3) and at rest. API keys are stored as bcrypt hashes — we cannot recover a plaintext key after creation.

Submitted contract code is held under a 90-day disclosure embargo, after which reports may enter the public knowledge feed. Audit job data (submissions and findings) is retained for a maximum of 24 months from submission and then automatically purged; compliance logs are retained for 36 months (EU AI Act Art. 13). Account data is retained until account deletion.

4. Sharing of Information

We do not sell, rent, or trade your personal information. We may share data with:

  • Infrastructure providers (Cloudflare, Neon) as data processors under binding agreements
  • AI model providers (Google — Gemini & Vertex AI; NVIDIA — NIM) for audit analysis — submitted contract code only, no account PII
  • Law enforcement or regulators when required by applicable law

5. Your Rights (POPIA / GDPR)

You have the right to:

  • Access — request a copy of your personal information we hold
  • Rectification — correct inaccurate personal data
  • Erasure — request deletion of your account and associated data
  • Portability — receive your data in a machine-readable format
  • Objection — object to processing for direct marketing
  • Restriction — request that we limit processing of your data

To exercise any of these rights, email us at john@agilegypsy.com. We will respond within 30 days (POPIA) / 30 days (GDPR).

6. Cookies and Analytics

We use Plausible Analytics — a privacy-first, cookieless analytics tool. No personal data is collected, no cookies are set, and no cross-site tracking occurs. No cookie consent banner is required.

7. Children's Privacy

Kthulhu is intended for business and professional use. We do not knowingly collect personal information from individuals under 18 years of age.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users by email of material changes at least 14 days before they take effect. Continued use of Kthulhu after the effective date constitutes acceptance of the updated policy.

9. Responsible Party, Information Officer & PAIA

Kthulhu is operated by AGILEGYPSY LABS PTY LTD (Reg No 2026/270871/07), trading as Kthulhu. For privacy enquiries, data subject access requests, or complaints, contact the registered Information Officer:

John Wellard — Information Officer
AGILEGYPSY LABS PTY LTD t/a Kthulhu · CIPC Reg. 2026/270871/07
Information Regulator Reg. 2026-005090
Email: john@agilegypsy.com
Tel: +27 68 938 8687
Website: kthulhu.co

The entity-wide PAIA & POPIA Manual (Section 51 of PAIA) covering AGILEGYPSY LABS PTY LTD and all of its brands, including Kthulhu, is published at agilegypsy.com/legal/paia-manual. If you are unsatisfied with our response to a privacy request, you may lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za.