Kumio Inc. (“Kumio,” “we,” “us,” or “our”) builds agentic cybersecurity for data centers. We embed security expertise into coordinated AI agents that protect data centers across planning, design, construction, commissioning, and day to day operations.

This policy explains how we handle personal information in connection with our website at kumio.ai. Our site is an informational one. It describes the company and invites you to reach us by email at hello@kumio.ai.

Our platform is being rolled out to a small number of pilot partners. Personal information processed in connection with the platform is governed by our agreements with those partners rather than by this policy. As the platform becomes more widely available we will publish separate terms and a data processing addendum covering it.

Kumio serves enterprise organizations and the people who represent them. We design our website for business audiences, and we treat the information we collect as relating to individuals in their professional capacity rather than their personal one.

This policy does not cover our employees, contractors, or job applicants, who receive separate notices.

Our website does not host a form. It offers an email address, so information reaches us in one of three ways.

When you email us.
We receive whatever you choose to include, which is typically your name, your work email address, your employer and role, and the substance of your message. We hold that correspondence in our business email system.

When you visit the site.
Our website platform provides us with aggregate measurement of site traffic, including pageviews, referring source, approximate country, device and browser type, session duration, and campaign parameters where a link contains them. This measurement operates without cookies and without any persistent identifier stored on your device. Daily visitor counts are derived by hashing IP address and user agent with a secret that rotates and is deleted each day, which means we hold aggregate figures rather than a continuing record tied to you.

When we meet you at an industry event.
If you share a business card or contact details with us, for example at a conference where members of our team are presenting, we record your name, work contact details, employer, and role.

We do not ask for or seek sensitive categories of personal information through this website, and we would prefer that you leave such details out of email correspondence.

Where United Kingdom or European Union data protection law applies, we rely on the following:

To respond to you.

We use your contact details, professional details, and the content of your message to reply, to arrange a conversation, and to follow up on it. Lawful basis: our legitimate interest in responding to a message you have sent us, and in developing relationships with prospective partners and customers.

To understand how the site is performing.

We review aggregate traffic patterns to see which pages are useful and how visitors reach us. Lawful basis: our legitimate interest in maintaining and improving our website, supported by measurement that operates without cookies or persistent identifiers.

To follow up after an event.

Where you have given us your details at a conference or similar gathering, we may contact you about Kumio. Lawful basis: our legitimate interest in continuing a conversation you have started with us. You may ask us to stop at any point.

To keep our systems and records secure and accurate.

This covers protecting against misuse of our systems, maintaining business records, and seeking professional advice. Lawful basis: our legitimate interest in the integrity of our systems and records, and compliance with our legal obligations where they apply.

To meet legal and regulatory requirements.

We may use and disclose personal information to comply with applicable law, respond to lawful requests from authorities, establish or defend legal claims, and enforce our rights. Lawful basis: compliance with a legal obligation, and our legitimate interest in protecting our rights.

If we later want to use your information for a purpose outside the above, we will tell you first and, where the law requires it, ask for your consent.

We disclose personal information to the following categories of recipient:

• Framer B.V., which hosts our website and provides our site measurement. Framer processes information on our behalf under a data processing agreement.

• Google LLC, which provides our business email through Google Workspace and therefore holds correspondence you send us. Google processes this information on our behalf under Google’s data processing terms.

• Professional advisers, including our lawyers, accountants, and auditors, where they need the information to advise us.

• Public authorities and courts, where disclosure is required by law or appropriate to establish or defend legal claims.

• A successor entity, if we are involved in a financing, merger, acquisition, or comparable transaction, in which case personal information may be reviewed as part of diligence or transferred as part of the transaction. Where the law requires notice, we will provide it.

We do not sell personal information, and we do not share it for cross-context behavioral advertising or targeted advertising, as those terms are used in United States state privacy laws. We do not use advertising or marketing tracking technologies on our website.

We may create aggregated or de-identified information from what we collect and use it for our business purposes. We maintain such information in de-identified form and do not attempt to re-identify it.

Our website uses cookies that are strictly necessary for it to function. Our site measurement operates without cookies and without persistent identifiers stored on your device, and we use no advertising, marketing, or profiling technologies. This is why you will not see a consent banner on our site.

Should we introduce analytics, marketing, or advertising technologies that set non-essential cookies, we will add a consent mechanism that blocks them until you opt in, and we will update this policy before they operate.

Our website links to profiles and pages held by third parties, including the LinkedIn profiles of our founders and advisers. Those organizations handle your information under their own policies, and we encourage you to read them. A link from our site reflects a professional connection rather than an endorsement of a third party’s privacy practices.

Kumio is incorporated in Delaware and based in the United States, and our team and advisers work across several countries. Personal information you provide may therefore be transferred to and processed in the United States and in other countries where we or our service providers operate.

Where we transfer personal information out of the United Kingdom or the European Economic Area, we put in place a recognized safeguard. For transfers to Google we rely on Google’s certification under the EU-U.S. Data Privacy Framework, together with the United Kingdom Extension and the Swiss-U.S. Data Privacy Framework, and on the Standard Contractual Clauses where the Framework does not apply. Our website host is established in the European Union and operates under a data processing agreement incorporating the Standard Contractual Clauses approved by the European Commission together with the United Kingdom International Data Transfer Addendum. You may write to us at the address in Section 13 for detail on the mechanism that applies to a given transfer.

We keep email correspondence and event contact details for as long as we are in touch with you and for 24 months afterward, after which we delete or de-identify them. We keep information for longer where we need it to comply with a legal or accounting obligation, to establish or defend a legal claim, or where you have asked us to stay in touch.

Aggregate site measurement figures, which do not identify you, may be retained beyond that period.

We use technical, organizational, and administrative measures appropriate to the information we hold, including access controls, encryption in transit, and review of the providers we work with. Security is a practice we keep strengthening as we grow, and we welcome reports of any concern at security@kumio.ai, which our team monitors.

Depending on where you live, you may have the right to:

• ask whether we hold personal information about you and obtain a copy of it

• have inaccurate or incomplete information corrected

• have information deleted

• object to processing that relies on our legitimate interests, including for direct marketing

• ask us to restrict processing in certain circumstances

• receive information you provided to us in a portable, machine readable format

• withdraw consent where we rely on it

• appeal a decision we make on a request, where your state or country provides for an appeal

• exercise these rights without receiving different treatment as a result

To make a request, write to us at privacy@kumio.ai. We may ask for information to confirm your identity, and we will respond within the period the applicable law allows. An authorized agent may submit a request on your behalf with appropriate proof of authority.

If you would prefer that we stop contacting you, write to us and we will update our records. We may still send you a reply to something you have asked us about.

If you are in the United Kingdom, the European Economic Area, or Switzerland and you would like to raise a concern with a regulator, you may lodge a complaint with your local supervisory authority. We would appreciate the chance to address it with you first.

Our website is directed to business audiences and is not intended for anyone under 16. We do not seek to collect personal information from children. If you believe a child has provided us with personal information, please write to us at privacy@kumio.ai and we will remove it.

We will update this policy as our business develops, and we will revise the effective date at the top when we do. Where a change is significant, we will give additional notice on our website.

Questions, requests, and concerns are welcome at:

Kumio Inc.
Attn: Privacy 9030 35th Ave SW, Suite 100 Seattle, WA 98126 United States
privacy@kumio.ai