Legal

Privacy policy

Last updated Nov 4, 2026Draft — pending legal review

This policy explains how Kasada AI LLC ("Kasada", "we", "us") collects, uses and shares personal information about our customers and website visitors in connection with Kasada Hosting. Kasada Hosting is offered to customers in the United States. For data you store on your servers, we act as your service provider (processor) — see the Data processing addendum.

This policy includes the disclosures required by the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, the "CCPA"), and by other US state comprehensive privacy laws, such as those of Virginia, Colorado, Connecticut, Utah, Texas and Oregon.

Who is responsible

Kasada AI LLC decides how account information is used. Contact us about privacy at privacy@hosting.kasadaai.com.

Categories of personal information we collect

Identifiers — name, email address, US phone number, organization name, account IDs, and IP addresses.
Account credentials — your sign-in email and password (stored only as a secure hash) and two-factor settings. Under the CCPA, account log-in details are "sensitive personal information"; we use them only to provide and secure your account.
Commercial information — top-ups, charges, receipts, statements and the services you use.
Payment information — card details are collected and stored by our payment processor; we receive only limited details such as card brand, last four digits, expiry month and the card's country.
Internet and network activity — sign-in times and IP addresses, browser and device information, console activity (which console pages you open), and network-level traffic statistics for abuse detection (not the content of your traffic).
Approximate location — the city, state and internet provider derived from your IP address, looked up on our own servers and used for security, fraud prevention and support. You can ask for a copy of your sign-in records at privacy@hosting.kasadaai.com. We do not collect precise geolocation.
Inferences — a fraud-risk score based on IP reputation, email domain and payment details.
Communications — the content of support tickets and emails you send us.

Sources

Directly from you, when you sign up, use the console, API or CLI, top up or contact us.
Automatically, from your devices and the Service (logs and usage records).
From service providers, such as our payment processor (payment results) and fraud-prevention and IP-reputation services.
From people who report abuse involving your servers.

How we use it

To create and run your account, provide the Service and bill you.
To verify accounts and prevent fraud, spam and abuse, and keep the network secure.
To send service, billing and security messages by email or SMS.
To provide support and improve the Service.
To keep financial records, comply with tax and other laws, and respond to lawful requests.
To send product news, only if you opt in. You can unsubscribe at any time.

No sale or sharing

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the CCPA and similar state laws. We have not done so in the past 12 months. We do not use or disclose sensitive personal information for purposes other than those permitted by law, such as providing and securing the Service. We do not engage in profiling that produces legal or similarly significant effects.

Who we disclose it to

We disclose personal information only for business purposes, to:

Infrastructure and data center providers that host the Service.
Payment processing providers.
Email and SMS delivery providers.
Fraud-prevention and security services.
Professional advisers (such as lawyers and accountants), and authorities where the law requires. We review every law-enforcement request.
A successor, if Kasada is involved in a merger, acquisition or sale of assets, subject to this policy.

These recipients are bound by contracts that limit their use of the information to the services they provide to us.

Where it is stored

Account information is stored in the United States. Data on your servers is stored in the region you choose for each server. If you choose a region outside the United States, data on that server is stored there.

How long we keep it

Account information: while your account is open, then up to 2 years.
Billing records: as long as tax and accounting laws require (usually 7 years).
Sign-in and security logs: up to 12 months.
Console page history: up to 6 months.
Support communications: up to 3 years after the ticket is closed.
Server data: deleted when you delete the server, or as described in the terms for unpaid accounts.

Your privacy rights

If you are a California resident, or a resident of another state with a comprehensive privacy law, you have the following rights, subject to exceptions in the law:

Right to know / access — the categories and specific pieces of personal information we hold about you, the sources, the purposes, and the categories of recipients.
Right to delete — personal information we collected from you.
Right to correct — inaccurate personal information.
Right to data portability — a copy of your information in a usable format.
Right to opt out — of the sale or sharing of personal information, targeted advertising and certain profiling. We do not do these things, but you can still contact us.
Right to limit — the use and disclosure of sensitive personal information. We already use it only for permitted purposes.
Right to non-discrimination — we will not deny you service, charge you a different price or provide a different quality of service because you used your privacy rights.
Right to appeal — if we decline your request, you can appeal by replying to our decision. If your appeal is denied, you may contact your state attorney general.

To make a request, email privacy@hosting.kasadaai.com or write to us through a support ticket in the console. We respond within 45 days, and may extend this once by 45 more days where the law allows, telling you why.

Verification

To protect your account, we verify requests by matching them to information we already hold — usually by asking you to send the request from the email address on your account, or to sign in to the console. We may ask for more information for requests about specific pieces of information or for deletion.

Authorized agents

You may use an authorized agent to make a request for you. We will ask the agent for written permission signed by you, and may ask you to verify your identity directly with us, unless the agent holds a valid power of attorney.

Global Privacy Control

We honor browser opt-out signals such as Global Privacy Control as a request to opt out of sale and sharing, although we do not sell or share personal information.

Cookies

The website uses basic, cookie-free analytics and server logs. The console uses one essential session cookie to keep you signed in, and stores your light or dark theme choice in your browser. We do not use advertising cookies.

Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13 (or anyone under 16 for the purposes of sale or sharing). Accounts are for adults aged 18 or older. If you believe a child has given us personal information, contact us and we will delete it.

Security

We encrypt data in transit, restrict staff access, require two-factor authentication for staff, log administrative actions and securely wipe disks when servers are deleted. No system is perfectly secure; if a breach affects your personal information, we will notify you as the law requires.

Changes

We will post updates here, change the "last updated" date and email you about significant changes.

Contact

Kasada AI LLC · Privacy questions and requests: privacy@hosting.kasadaai.com · Support: support@hosting.kasadaai.com (Mon–Fri 9am–6pm ET).