Privacy policy
This policy explains what personal data we process when you visit kennt.ai, run the free kennt.ai Score, or use the kennt.ai app, why we do it, and what rights you have under the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).
1. Controller
FutureChamps GmbH, Schenkenstraße 4, 6th floor, 1010 Vienna, Austria, hello@kennt.ai. We have not appointed a data protection officer, as we are not required to do so (Art. 37 GDPR). Please send all data protection requests to hello@kennt.ai.
2. Visiting this website
When you open a page, our hosting provider Vercel processes technical data that your browser sends: IP address, date and time, page requested, referrer, browser and operating system. We need this to deliver the website and keep it secure (Art. 6(1)(f) GDPR, legitimate interest in a stable and secure website). Vercel keeps these server logs for at most 30 days.
No tracking. This website uses no analytics, no advertising pixels and no tracking cookies. Fonts are served from our own server, so your browser does not contact Google Fonts.
3. The free kennt.ai Score
When you enter a company name or website, we process:
- Your input (company name or domain). For a domain we load the public homepage once to understand what the company sells.
- A pseudonymous rate-limit key: a salted hash of your IP address that changes every day. We never store the IP address itself, and the key cannot be linked across days. It prevents abuse (limit of free checks per day).
- The result: brand, category, market, competitors, the questions asked, the AI answers and the score. Results are reused for the same input for 7 days.
- Bot protection: Cloudflare Turnstile checks your browser before a check starts and processes your IP address and browser signals for that purpose.
Legal basis: Art. 6(1)(b) GDPR (you request the check) and Art. 6(1)(f) GDPR (preventing abuse and keeping costs under control). The questions are sent to AI engines via DataForSEO; the brand set-up and analysis use Anthropic’s Claude models. Neither receives your IP address or e-mail address.
Full report. If you enter your e-mail address to get the full report, we store it with your check and use it to send you the report and a login link for your kennt.ai account (Art. 6(1)(b) GDPR, steps prior to a contract at your request). We do not send newsletters without your separate consent. Checks without an e-mail are deleted after 12 months; checks with an e-mail are kept until you delete your account or ask us to delete them.
4. kennt.ai account and app
- Account data: e-mail address, name and profile picture (if you sign in with Google or Slack), organisation, role, login times. Basis: Art. 6(1)(b) GDPR.
- Login: with a one-time link or code sent by e-mail, “Sign in with Google” or, where offered, Slack. We store no passwords. With Google or Slack we receive your name, e-mail and profile picture from them. The app sets strictly necessary session cookies.
- Project data: the brands, competitors, questions and markets you track, the AI answers we collect for you and the analyses we derive. This is mostly business data; where it contains personal data (e.g. names in AI answers), we process it on your behalf as a processor (see the DPA).
- Connected sources: if you connect Google Analytics 4 or Search Console, we read aggregated traffic, lead and search data of your sites. If you connect Slack, we post reports and answer questions in the channels you choose.
- AI analyst: questions you ask the analyst and its answers are stored with your project so you can see the history and so we can improve quality.
- Billing: billing address, VAT ID and payment data are processed by Stripe; we see the payment status and the last digits of the card. Invoices are kept for 7 years (§ 132 Federal Tax Code, BAO).
5. Processors and recipients
We use the following service providers. All are bound by data processing agreements under Art. 28 GDPR.
| Service | Provider | Where | Purpose | Basis for transfers outside the EU |
|---|---|---|---|---|
| Supabase | Supabase Pte. Ltd., Singapore | EU (AWS eu-central-1, Frankfurt) | Database, login (authentication), background jobs and the kennt.ai Score function | Data stored in the EU; access from outside the EU (e.g. support): Standard Contractual Clauses (Supabase DPA) |
| Vercel | Vercel Inc., USA | Functions in the EU (fra1, Frankfurt); global edge network for delivery | Hosting of this website and the kennt.ai app, content delivery, server logs | EU-U.S. Data Privacy Framework (certified) and Standard Contractual Clauses |
| DataForSEO | DataForSEO OÜ, Estonia | EU (Estonia) | Asks AI engines (ChatGPT, Gemini, Google AI Mode, AI Overviews) the tracked questions and returns their answers. Receives questions, country and language, no visitor data | Not required (EU company); data processing agreement under Art. 28 GDPR |
| Anthropic | Anthropic Ireland, Limited, Ireland (contract partner); processing by Anthropic PBC, USA | USA | AI models (Claude) that analyse AI answers, set up the free check (brand, category, competitors, questions) and power the AI analyst. Not used to train models | Standard Contractual Clauses (Anthropic DPA) |
| Stripe | Stripe Payments Europe, Ltd., Ireland | EU / USA | Payments, invoices, subscriptions | EU-U.S. Data Privacy Framework and Standard Contractual Clauses for transfers to Stripe, Inc. |
| Resend | Plus Five Five, Inc. (Resend), USA | Sending from the EU (AWS eu-west-1, Ireland); account data, e-mail metadata and logs in the USA | Sending e-mails: login links and codes, reports, service messages | EU-U.S. Data Privacy Framework (certified) and Standard Contractual Clauses |
| Google Ireland Ltd., Ireland | EU / USA | “Sign in with Google” (only if you choose it); reading Google Analytics 4 and Search Console data (only if a customer connects them) | EU-U.S. Data Privacy Framework | |
| Cloudflare Turnstile | Cloudflare, Inc., USA | Global | Bot protection for the free kennt.ai Score (checks browser signals, sets no tracking cookies) | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
| Slack | Slack Technologies Ltd., Ireland | EU / USA | Weekly report and AI analyst in Slack (only if a customer connects a workspace) | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
Where data is transferred outside the EU/EEA, we rely on an adequacy decision (including the EU-U.S. Data Privacy Framework for certified companies) or on the European Commission’s Standard Contractual Clauses (Art. 45, 46 GDPR).
6. Retention
We keep personal data only as long as needed for the purposes above: account data for the life of the account plus 30 days, project data until you delete the project or account, the daily rate-limit key for the day it is valid, free Score checks without an e-mail for 12 months, server logs for at most 30 days, invoices for 7 years. After an account is closed, we delete its data within 30 days; backups are overwritten in the normal backup cycle.
7. Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21 GDPR). Where processing is based on consent, you can withdraw it at any time with effect for the future. Write to hello@kennt.ai.
You can also lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at.
8. Automated decisions
We make no decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR). The kennt.ai Score is an estimate of a brand’s visibility, not an assessment of a person.
9. Changes
We will update this policy when our services or the law change. The current version is always on this page.