Privacy Policy

Effective date: August 6, 2026 Last updated: August 6, 2026

This Privacy Policy explains how Khella Productions Inc ("we," "us," or "our"), a corporation organized under the laws of Delaware, collects, uses, discloses, and protects personal data when you use Design Sprint AI (the "Service"), an AI-facilitated discovery-sprint web application that helps you turn your business ideas into structured requirements documents through an interactive, AI-guided interview.

You are interacting with an AI system, not a human. The "facilitator" that asks you interview questions and drafts your documents is an artificial intelligence system (a large language model), not a person. See Section 6 for detail on how your content is processed by that AI system and the third-party infrastructure behind it.

With respect to the personal data described in this Policy, we determine the purposes and means of processing — the role a "controller" plays under GDPR/UK GDPR terminology, and the role a "business" plays under CCPA/CPRA terminology — and we use that terminology in this Policy for clarity. See Section 1 and Section 8 for our actual position on which of those frameworks we believe apply to us.

This Policy describes our data practices and applies to all users of the Service, wherever you are located. Certain sections of this Policy reference rights and concepts drawn from the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and other privacy laws. We extend the rights described in those sections to every user of the Service as a matter of policy, regardless of where you live — this is not a representation that every provision of every one of those laws legally applies to us or to your use of the Service. Section 1 and Section 8 explain, for each framework, what we actually believe applies to us and what we voluntarily offer beyond that.

1. Who We Are

Controller: Khella Productions Inc Registered address: PO Box 56897, Sherman Oaks, CA 91413 Contact for privacy matters: privacy@khella.com Data Protection Officer: We have not appointed a Data Protection Officer because we do not believe one is required for our processing (we do not carry out large-scale systematic monitoring or large-scale processing of special category data). You can still reach us with any privacy question at the contact above. EU/UK Representative: We have not appointed an Article 27 EU representative or a UK representative. The Service is operated from the United States, we do not maintain an establishment in the EU or UK, and we do not market or target the Service to the EU or UK — our marketing, currency, and interface are US-English only, and we do not direct advertising or marketing at EU/UK audiences or otherwise hold ourselves out as offering the Service to EU/UK consumers specifically. On that basis, we do not consider GDPR Article 3(2) engaged and have not appointed an Article 27 or UK representative. If we begin marketing or targeting the Service to EU or UK users, we will reassess this position. Regardless of this assessment, we voluntarily honor the GDPR/UK GDPR-style rights described in Section 8 for anyone who contacts us from the EU or UK.

2. What Personal Data We Collect

We collect the following categories of personal data, all directly from you or automatically through your use of the Service:

2.1 Account data

• Email address
• Name
• Username
• Password (stored as a salted cryptographic hash — we never store or can see your plaintext password)

2.2 Session and technical data

• IP address
• Browser/device user-agent string
• Session identifiers and authentication tokens (Collected via our authentication system to keep you signed in, protect your account, and detect fraud or abuse.)

2.3 Analytics data

We use Vercel Web Analytics to understand aggregate traffic and usage patterns (e.g., which pages are visited, how often). This analytics tool is designed to be cookieless — it does not store an identifier in your browser — but it identifies a visit by computing a hash derived from your IP address and user-agent, on the server side, for a limited time window (e.g. to distinguish a "unique" visit from a repeat pageview). This is still personal data: the hash is derived from your IP address, a piece of information that can be personal data under GDPR/CCPA, even though it is not stored in a directly readable form and no cookie is set. On our own systems, we do not use this data to build an individual profile of you or to identify you by name, and we do not link it to your account data or sprint content. We do not control, and cannot make representations about, how Vercel itself processes or retains this hash on its own infrastructure — see Vercel's own privacy documentation for detail on how the hash is computed and how long it is retained on Vercel's side.

2.4 A technical request made to Google on every page load

Our web pages currently load one icon font ("Material Symbols") directly from Google's font servers (fonts.googleapis.com) rather than serving it from our own infrastructure. As a result, every time you load a page of the Service, your browser sends your IP address and user-agent string directly to Google, independent of and in addition to any account or Google reCAPTCHA data described elsewhere in this Policy. We do not control what Google does with this request on its end; see Google's general Privacy Policy.

2.5 Sprint content — the core content you create

This is the primary content you generate using the Service, and it may describe your business plans, ideas, and strategy in detail:

• Your answers to interview questions ("interview answers")
• The full back-and-forth conversation between you and the AI facilitator (your messages and the AI's questions/responses)
• The names and stated objectives of the sprints/projects you create
• The structured documents ("sections") generated from your answers

On our own systems, we do not use this content for any purpose other than providing, maintaining, and improving the Service, as described in this Policy, and we do not sell it. That commitment covers only what we ourselves do with your content — it does not extend to what happens once your content leaves our systems, described immediately below.

Your sprint content — including your interview answers and the full conversation history — is sent to a third-party AI infrastructure provider (OpenRouter) so that the underlying AI model can generate its responses and synthesize your documents. We configure our AI infrastructure to request routing only to providers that do not train on submitted content. This is a preference we set, not a guarantee, and it does not cover data retention — we do not control, and cannot guarantee, whether the provider that processes a given request retains your content. Retention and training practices differ between AI model providers and can change at any time at the provider's discretion. Assume that content you submit may be retained by a third-party AI provider. See Section 6 for full detail.

2.6 Data we do NOT collect

We do not collect or process payment card numbers, bank details, or other financial account data — the Service does not currently process payments.

2.7 A note on sensitive information

Please do not include in your interview answers any special category / sensitive personal data as defined by GDPR Article 9 (e.g., health information, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, sex life or sexual orientation, criminal history) about yourself or any third party, unless strictly necessary to describe your business idea and you understand the additional risks. The Service is not designed to collect or specially protect this category of data. If you provide sensitive data about a third party, you are responsible for having a lawful basis to do so.

3. Why We Process Your Data, and Our Legal Basis

As explained in Section 1, we do not believe GDPR/UK GDPR applies to us as a matter of statute. The table below uses GDPR/UK GDPR Article 6 terminology because it is a clear, structured way to describe our actual reasoning for processing each category of data — it reflects the standard we voluntarily hold ourselves to, not a representation that GDPR/UK GDPR governs this processing by law.

Where we rely on legitimate interests as our reasoning, we have considered (a) whether the purpose is legitimate, (b) whether the processing is necessary for that purpose, and (c) whether your interests or fundamental rights override our interest, and we have concluded they do not for the purposes listed above.

We do not currently rely on consent as a legal basis for any processing described in this Policy — see Section 9 for what this means in practice for cookies and similar technologies.

4. Who We Share Your Data With

We do not sell your personal data, and we do not "share" it (as that term is defined under the CPRA, meaning disclosure for cross-context behavioral advertising) with anyone.

We disclose personal data to the following service providers so they can provide services to us. Each is contractually bound by its own terms, but — as explained in Section 6 for AI providers specifically — a contractual relationship with us does not always mean we have verified or can guarantee how a given sub-processor's own downstream systems handle your data:

We may also disclose personal data:

• To comply with a legal obligation, court order, or valid governmental request;
• To protect the rights, property, or safety of Khella Productions Inc, our users, or the public;
• To a successor entity in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy (or a materially similar policy) continuing to apply.

A current list of our sub-processors is maintained internally and is available on request by contacting privacy@khella.com. Each sub-processor's own Data Processing Agreement or privacy terms (where published) govern our contractual relationship with them, but — as with any processor — we cannot independently verify every internal practice of every sub-processor's own downstream vendors.

4.1 Authorized personnel

Our own authorized personnel may access your account information and Service content on a need-to-know basis to operate, maintain, secure, and support the Service — for example, to investigate a bug you report, respond to a support request, diagnose a technical problem, or maintain the stability and functioning of the Service's features. This does not include using your sprint content to train any AI model we operate — see Section 6.4. Such access is logged and restricted to personnel who need it to perform their duties, and is subject to our internal confidentiality obligations. This internal access log is associated with your account and is deleted when your account is deleted — see Section 10.

5. Legitimate Interest: A Note on Necessary Operational Access

Some of our processing follows a "legitimate interests" style of reasoning (see Section 3), including limited internal access to Service content to provide support, diagnose technical problems, and maintain the Service's stability and functioning (Section 4.1) — this does not include using your content to train any AI model we operate (Section 6.4). Before relying on this reasoning we consider whether the processing is proportionate to the purpose and whether it could unreasonably affect you, and we maintain internal controls — including access logging — designed to ensure such access is limited to what is necessary. You have the right to object to processing based on legitimate interests; see Section 8.

6. AI Processing of Your Content

The Service uses artificial intelligence (large language models) to conduct the interactive interview and to synthesize your answers into structured documents. This is core to how the Service works, and it necessarily involves sending your interview content to third-party AI infrastructure. Please read this section carefully — it describes the area of processing with the most significant implications for your privacy, and we would rather you understand it fully than assume protections we cannot confirm.

6.1 What is sent, and what is not. When you use the interview feature, we send your sprint's name and stated objective, and the full conversation history (your answers and the AI facilitator's messages), to OpenRouter, an AI model routing service, which forwards this content to an underlying large language model provider to generate responses and synthesize your documents. We do not programmatically attach your name, email address, username, or any other account identifier to this message content — those identifiers are used only internally, on our own systems, to track usage for billing/cost-management purposes. This is not the same as redacting your answers: if you type your own name, email address, or other personal or identifying details into an interview answer, that text is sent to OpenRouter and the underlying model provider exactly as written — we do not scan, filter, or strip personal information out of your interview content before it is sent. Separately, each request to OpenRouter is authenticated using an API key issued specifically to your account (rather than a single key shared across all users), so at the infrastructure/authentication layer — separate from the message content itself — OpenRouter is able to associate a given request with your account. We are describing this precisely so you understand the actual boundary: we do not ourselves insert your name and email into the text the AI model reads, but (a) anything you choose to type is sent as-is, and (b) your account is not anonymous to OpenRouter's systems at the request level.

6.2 We do not name the specific underlying model or provider. The specific AI model that processes your content is a configuration value we can change at any time, and we do not publicly commit to a specific provider in this Policy, precisely so that this Policy remains accurate regardless of which provider is in use. Because of this, you should not assume any particular provider's data practices apply to your content — instead, rely on the general, conservative statements in this Section 6.

6.3 Multi-hop processing; retention is not covered. Because OpenRouter routes requests to third-party model providers, your content may be processed by more than one company before a response is returned to you. We configure our AI infrastructure to request routing only to providers that do not train on submitted content. This is a preference we set, not a guarantee, and it does not cover data retention — we have no contractual or technical control guaranteeing your content is excluded from a provider's own retention practices. Retention and training practices differ between AI model providers and can change at any time at the provider's discretion. Assume that any content you submit through the interview may be retained by a third-party AI provider, and do not include sensitive or confidential details in your interview answers.

6.4 We do not use your content to train our own models. Separately from the third-party AI processing described above, we do not ourselves use your sprint content to train any AI model that we operate.

6.5 No automated decision-making with legal effect. The AI facilitator's output is a drafting aid — it generates suggested questions and document text based on your input. It does not make any decision about you that produces legal effects or similarly significantly affects you (e.g., it does not decide whether to grant you an account, service, or benefit). Accordingly we do not believe GDPR Article 22 applies to this processing.

6.6 Error monitoring is designed to be separate from AI content, but is not guaranteed to be airtight. Our error-monitoring tool (Sentry) is configured to structurally discard request bodies, headers, and cookies, and to reduce any user information to a bare internal identifier, before anything is transmitted to it — see Section 4 and Section 11. This is intended to prevent your interview answers and sprint content from reaching Sentry. This is our design intent and general practice, not an absolute guarantee: a custom error message written elsewhere in our code could in principle include a fragment of sprint content despite these safeguards.

7. International Data Transfers

Depending on where you are located, using the Service will involve transferring your personal data to countries outside your own, including:

• Canada — where our database (Supabase) is hosted (ca-central-1 region);
• The United States — where our application hosting (Vercel and Vercel Web Analytics), AI gateway processing (OpenRouter and, depending on the model used, the underlying model provider), Google (Fonts and reCAPTCHA), our transactional email provider (Resend), and our error-monitoring provider (Sentry) process data. Sentry's default data-processing region is the United States; we have not separately audited our specific account configuration against that default;
• Potentially other countries — depending on which underlying AI model provider processes a given request via OpenRouter, your content may pass through infrastructure located outside the United States and Canada as well.

For transfers of personal data from the European Economic Area (EEA) or United Kingdom to these countries, we rely on the following safeguards:

• Canada: The European Commission has recognized Canada (in respect of recipients subject to Canada's federal private-sector data protection law) as providing an adequate level of data protection for commercial organizations, permitting transfers without additional safeguards for in-scope recipients.
• United States and other non-adequate countries: We rely on Standard Contractual Clauses (SCCs) adopted by the European Commission and/or, for UK transfers, the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs, and/or the EU-U.S. Data Privacy Framework (and its UK extension) where a given processor is a certified participant, as applicable to each individual processor's own certification status. You may request more detail about the transfer mechanism used for a specific processor by contacting us.

You may request more information about the safeguards we use for a specific transfer by contacting us at privacy@khella.com.

8. Your Privacy Rights

8.1 GDPR/UK GDPR-style rights we voluntarily extend to everyone

As explained in Section 1, we do not believe GDPR or UK GDPR applies to our processing as a matter of statute, because we do not have an EU/UK establishment and do not market or target the Service to the EU or UK. Regardless, as a matter of policy we voluntarily extend the following rights to every user of the Service, wherever you live:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase your data ("right to be forgotten") — our Service supports account deletion, which permanently deletes your account and associated sprint content from our active systems (see Section 10 for what this covers and any limited retention exceptions);
• Restrict processing in certain circumstances;
• Data portability — receive your data in a structured, commonly used, machine-readable format;
• Object to processing based on legitimate interests (Section 3), including profiling based on those interests;
• Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal;
• Lodge a complaint with your local data protection supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, your national Data Protection Authority.

Note that we cannot retract or delete personal data already processed by a third-party AI provider outside our own systems as described in Section 6; our ability to fulfill an erasure request is limited to data within our own systems and within the systems of processors who are contractually obligated to act on our instructions.

8.2 California residents, and CCPA/CPRA-style rights we voluntarily extend to everyone

We do not currently meet the CCPA/CPRA's statutory revenue, data-volume, or revenue-from-sale thresholds that would make us a "business" subject to that law, so the CCPA/CPRA does not apply to us as a matter of statute. Regardless, as a matter of policy we voluntarily extend the following rights to every user of the Service, wherever you live:

• Know what personal information we collect, use, disclose, and the categories of sources, purposes, and third parties involved — Section 2 and Section 4 of this Policy describe this in detail;
• Delete personal information we have collected from you;
• Correct inaccurate personal information;
• Opt out of the "sale" or "sharing" of your personal information — we do not sell or share your personal information, so there is nothing to opt out of today, but we will honor any such request if our practices change. Where we are able to detect a recognized universal opt-out preference signal (such as Global Privacy Control), we honor it as a request not to sell or share, consistent with the commitment above;
• Limit use of sensitive personal information — we do not use any sensitive personal information we may incidentally receive for purposes beyond providing the Service;
• Non-discrimination for exercising any of these rights.

Because these are rights we extend voluntarily rather than obligations imposed on us by the CCPA/CPRA, we do not hold ourselves out as a "business" under that statute, and this Policy is not a CCPA "notice at collection." We describe what we collect and why in Section 2, Section 3, and Section 4 instead.

8.3 How to exercise your rights

Contact us at privacy@khella.com with your request. We will verify your identity before acting on a request. As a matter of policy, we aim to respond on the same timelines those laws set for the businesses to which they apply (generally one month under GDPR/UK GDPR, extendable by two further months for complex requests; 45 days under CCPA/CPRA, extendable by 45 additional days), even though — as explained above — we do not believe those laws apply to us as a matter of statute.

9. Cookies and Similar Technologies

We use a small number of cookies and no other client-side storage:

We do not use any localStorage or sessionStorage browser storage. We have not exhaustively enumerated every cookie that our third-party authentication library may set as part of its internal operation (for example, a short-lived companion cookie used only during the login process itself) — the categories above describe their purpose rather than claiming to be an exhaustive byte-for-byte list.

Beyond cookies, two other technologies also transmit data about your visit and are covered elsewhere in this Policy: our analytics tool (Vercel Web Analytics) does not set a cookie but computes a server-side hash from your IP address and user-agent (Section 2.3), and one icon font is loaded directly from Google's servers on every page load, sending your IP address and user-agent to Google (Section 2.4).

We do not currently use advertising or cross-site tracking cookies. Our own better-auth.session_token cookie is strictly necessary for authentication. The Google reCAPTCHA cookies described above are a separate matter: we do not treat them as strictly necessary or as automatically exempt from consent requirements. As Section 4 discloses, Google reCAPTCHA operates under Google's general Privacy Policy rather than a narrower, purpose-limited one, and some EU/UK data protection authorities treat reCAPTCHA cookies as requiring consent under the ePrivacy rules. As of the effective date of this Policy, we do not display a cookie consent banner, and we have not implemented a consent mechanism for the reCAPTCHA cookies, the Google Fonts request, or the Vercel Web Analytics hash described above. If you are located in a jurisdiction that requires consent for any of these, this Policy's disclosure serves as notice of that current gap; contact us at privacy@khella.com with any concern. You should rely only on the current state as stated here.

10. Data Retention and Deletion

We retain your personal data, including your account information and sprint content, for as long as your account is active. We do not currently run any automated process that purges or anonymizes data on a schedule — your data persists in our active systems indefinitely unless and until you delete your account.

Account deletion: You may delete your account at any time. When you do, this is a genuine, permanent deletion, not a deactivation:

• Your account record, sprint content (interview answers, conversation history, generated documents, sprint names and objectives), and the internal access-audit log described in Section 4.1 are all permanently and immediately removed from our active production database. We do not use a "soft delete" or retain a hidden copy in the active database after deletion.
• Your dedicated AI-provider API key (used to route your interview requests) is revoked with our AI infrastructure provider before your account data is deleted, so it can no longer be used after that point.
• Backups: Our database provider (Supabase) maintains its own infrastructure-level backups as part of normal operations. Deleting your account removes your data from our live, active database, but a copy of your data may continue to exist in encrypted backup snapshots for a period of time until those backups age out and are overwritten in the ordinary course. We do not control the exact backup retention window, and do not want to state a specific number we cannot verify — you should assume backup copies may persist for some limited period after deletion.
• Content already sent to a third-party AI provider before you delete your account is not retrieved or deleted by this process — see Section 6.3 for why we cannot guarantee deletion at that layer.
• Hosting provider logs: Our application hosting provider (Vercel) independently retains brief runtime/request logs (which may include IP address and user-agent) on its own infrastructure, outside our database. Deleting your account removes your data from our database but does not reach into or purge Vercel's own short-lived request logs, which age out on Vercel's own retention schedule.
• Email provider records: Our transactional email provider (Resend) retains its own account data, metadata, and logs (which may include your email address and delivery history) independently of our database. Resend states it deletes such data within 90 days of contract termination with us, and separately retains compliance-related records for up to 3 years. Deleting your Service account does not, by itself, delete Resend's own records — those follow Resend's retention schedule and our contractual relationship with Resend, not your individual account deletion.
• We do not separately retain your data for fraud-prevention or legal purposes beyond what is described above, except where we are required to preserve specific records by law or a valid legal process, in which case we retain only what is legally required, for only as long as required.

We retain data no longer than necessary for the purposes described in this Policy, or as required by law.

Retention periods by category:

11. Data Security

We use industry-standard technical and organizational measures to protect your personal data, including storing passwords using a salted, adaptive one-way password hash (not encryption — this means your password cannot be mathematically reversed or decrypted by us or anyone else, including in the event of a breach), encrypted connections (TLS) between your browser and our servers and between our systems and our sub-processors, and access controls limiting who can view your data internally.

Our error-monitoring system is configured with specific structural safeguards: it discards request bodies, headers, and cookies before transmission, reduces any associated user information to a bare internal identifier only, and does not capture console logs, session recordings, or performance traces. We do not call our error-monitoring tool in a way that attaches your name or email address to error reports. As with any configured safeguard, this is our design intent and general practice rather than an absolute, code-verified guarantee — see Section 6.6 for the specific limitation.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we experience a data breach affecting your personal data, we will provide notification as required by applicable law. Legal breach-notification requirements differ by recipient and by law: for example, where GDPR applies, Article 33 requires notifying the relevant supervisory authority within 72 hours of becoming aware of a breach likely to result in a risk to individuals' rights and freedoms, while notice to affected individuals under Article 34 applies only where the breach is likely to result in a high risk, and is required "without undue delay" rather than on a fixed 72-hour clock; most U.S. state breach-notification laws require notice to affected individuals and/or regulators without unreasonable delay, on their own timelines. We are not promising a uniform 72-hour notification to every user for every breach — the applicable timeline and recipient depend on the law that applies and the nature of the breach.

12. Children's Privacy

The Service is not directed to, and we do not knowingly collect personal data from, children under 16 (or the minimum age required by applicable law in your jurisdiction, which may be as low as 13 in parts of the United States). If we learn we have collected personal data from a child below the applicable age without appropriate consent, we will delete it. If you believe a child has provided us with personal data, please contact us at privacy@khella.com.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you (for example, by email or a prominent notice within the Service) before the changes take effect. The "Last updated" date at the top of this Policy indicates when it was last revised.

We do not treat your silent, continued use of the Service as acceptance of a material change to this Policy. Where a material change requires your agreement, we will ask you to affirmatively accept the updated Policy before you continue using the Service, rather than relying on continued use alone.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us at:

Khella Productions Inc PO Box 56897, Sherman Oaks, CA 91413 privacy@khella.com

If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection supervisory authority.