Privacy Policy

Last updated: January 2026

Kadropic Labs, Inc. (“we”, “us”) built LEO Soul around a simple principle: we store zero of your conversation data. This policy explains what we do and don't collect.

The short version: The engine is stateless. Your messages and your soul_state (the learned state) are never persisted by us. On the hosted API we keep only your account, aggregate turn counts for billing, and standard security logs. With the SDK or a self-hosted deployment, your data never reaches us at all.

1. What we do NOT collect

The content of messages you send through the Service.
Your soul_state — beliefs, calibration, the neural model, the curiosity ledger. It rides in and out of each request and is stored only by you.
Your model provider API keys. On the hosted API they are used for the single request and never written to disk.

2. What we collect (hosted service)

Account data: name, email, hashed password, and plan.
Usage metering: aggregate per-day counts of turns and decision types (answer / ask / refuse, etc.) — counts only, never content.
Billing data: subscription status and identifiers held by our payment processor (Stripe). We do not store full card numbers.
Operational logs: standard request metadata (timestamps, status codes) for security and reliability, retained for a limited period.

3. SDK & self-hosted

When you run LEO Soul as the Python SDK or a self-hosted container, all processing happens inside your own environment. We receive no messages, no soul_state, and no model keys.

4. Third parties

The hosted service uses a payment processor (Stripe) for billing and infrastructure providers for hosting. Your chosen model provider (e.g. OpenAI, Anthropic) processes the requests you route to it under their own terms — that relationship is yours, not ours.

5. Data security

Passwords are hashed (PBKDF2-HMAC-SHA256), API keys are stored only as hashes, and traffic is served over HTTPS. Because we don't retain conversation data, the blast radius of any incident is structurally limited.

6. Your rights

You may access, correct, export, or delete your account data at any time from your dashboard or by emailing bader@kadropiclabs.com. Deleting your account removes your account and usage records.

7. Children

The Service is not directed to children under 18 and we do not knowingly collect their data.

8. Changes

We may update this policy; material changes will be posted here with a new date.

9. Contact

Kadropic Labs, Inc. — bader@kadropiclabs.com · kadropiclabs.com