Privacy notice

The intended controller is [Krill legal entity pending], krill.agency. Its registered address, legal representative, privacy contact, retention schedule, international-transfer safeguards, and competent supervisory authority are still pending and must be completed before live processing.

Krill intends to process account identifiers and authentication events; order answers, quotes, approvals, files, communications, previews, progress and support records; Stripe payment status and transaction identifiers; role, access, repository and audit events; and programmer application, skills, portfolio and onboarding status. Raw payment-card details and raw identity documents should remain with the specialist provider rather than Krill where possible.

Intended purposes include pre-contract estimates, contract delivery, customer support, payment and payout administration, fraud and platform security, legal compliance, project version control, and service improvement. The final notice must map each purpose to an applicable legal basis such as pre-contract steps, contract, legal obligation, legitimate interests, or consent after counsel review.

Planned providers include Stripe for payments, refunds, Connect onboarding and payouts; Resend for transactional email; Vercel for application hosting and protected previews; GitHub for repositories, commits and approved project access; and OpenAI for limited AI-assisted task proposals. Their exact entities, regions, subprocessors, contracts, transfer mechanisms, and retention settings remain subject to configuration and counsel review.

OpenAI should receive only the order fields or code excerpts needed for a specific task. Secrets, payment data, identity documents and unrelated order or repository content are excluded or redacted. AI output proposes project chunks; support reviews and approves it before assignment or operational effect. Krill does not intend to rely on solely automated decisions that produce legal or similarly significant effects.

Planned customer uploads are images, PDF and DOCX only, limited to 25 MB per file and 50 MB per order. Krill does not promise antivirus scanning. Planned safeguards include server-side size limits, MIME and magic-byte or file-signature checks, private storage, controlled download or preview, validation, role-based access, approval gates, throttling and activity logs. No security measure is presented as absolute.

Retention periods are not final. Krill intends to keep information only as long as needed for the stated purpose, contract, security records, claims, accounting, tax, or other legal duties, then delete or anonymise it under a documented schedule.

Subject to legal conditions, individuals may request access, correction, deletion, restriction, portability, or object to processing; withdraw consent without affecting earlier lawful processing; and complain to a competent supervisory authority. Identity verification and a live contact channel are required before launch; the current contact remains [pending].