Kolter AI Privacy Policy
Draft for counsel review. Remove this note before publishing. Publish at kolter.ai/privacy, link it from the kolter.ai footer and the Kolter AI sign-in page (replacing the current unlinked "Terms & Privacy Policy" text), and add the link to the Trust Center. Bracketed items need confirmation.
Effective date: October 12, 2026
1. Who we are and what this policy covers
Kolter AI is a regulatory intelligence and lifecycle change planning platform provided by Kamet Consulting Group LLC ("Kolter", "we", "us"). This policy explains how we handle personal information when you visit kolter.ai or use the Kolter AI platform.
We act in two roles:
- As controller for information about our website visitors and for the account details of people who use Kolter AI (for example, your name, email address and sign-in activity).
- As processor for content our business customers put into Kolter AI (such as product, regulatory and change information). We process that content only on our customer's instructions, under our agreement and data processing agreement with them. If you have questions about how your organization uses Kolter AI, please contact your organization first.
2. Information we collect
| Category | Examples | Source |
|---|---|---|
| Account information | Name, business email, organization, role | You or your organization's administrator |
| Sign-in and security data | Sign-in times, single sign-on identity (Microsoft or Google), session records, IP address | Collected when you use Kolter AI |
| Activity data | Actions taken in projects, approvals and decisions, with user and time | Collected when you use Kolter AI |
| Service usage data | Features used, performance and error information | Collected automatically; aggregated and de-identified |
| Customer content | Product, market, regulatory and change information entered or uploaded by users | Processed on behalf of our customers (see section 1) |
| Website and contact data | Information you send through forms or email, basic website analytics | You, and automatically when you visit kolter.ai |
Kolter AI is not designed to hold patient, clinical or other sensitive personal information, and our customer agreements prohibit entering it.
3. How we use information
We use personal information to:
- provide, operate and support Kolter AI and our website;
- authenticate users, manage access and keep the platform secure;
- keep records of actions and approvals so customers have a reliable audit history;
- improve and maintain the platform using aggregated, de-identified service usage data;
- respond to inquiries and communicate about the service;
- meet legal, regulatory and contractual obligations.
We do not sell personal information, and we do not use customer content for marketing or advertising. Our legal bases, where UK or EU law applies, are performance of our contract with you or your organization, our legitimate interests in operating a secure and reliable service, and compliance with legal obligations.
4. How we use AI
Kolter AI uses large language models (Anthropic Claude models, hosted on Amazon Bedrock within our AWS environment in the United States) for language tasks such as interpreting a user's description of a change and drafting summaries for user review. AI does not make regulatory decisions; regulatory requirements and plans come from our curated regulatory content and deterministic planning engine and are reviewed by users.
- Only the information needed for each task is sent for AI processing.
- Amazon Bedrock does not store prompts or outputs or use them to train models, and does not share them with the model provider.
- We do not use customer content, prompts or outputs to train or fine-tune AI models without the customer's written opt-in.
5. How we share information
We share personal information only as needed to provide the service, with:
- Service providers (subprocessors) that host and support Kolter AI under written agreements with confidentiality, security and data protection obligations:
| Subprocessor | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting, storage, backups, sign-in, email delivery, AI processing (Amazon Bedrock) | United States |
| Sentry | Application error monitoring (configured to exclude personal data) | [confirm] |
| Microsoft | Business email and support correspondence | [confirm] |
- Your organization, where you use Kolter AI through your employer or client account.
- Professional advisors and authorities, where required by law or to protect rights and safety.
- A successor business, in a merger, acquisition or sale, subject to this policy.
Customers receive advance notice of changes to our subprocessors as set out in their agreement.
6. Where information is stored and international transfers
Kolter AI is hosted and processed in AWS data centers in the United States. Authorized Kolter engineering personnel, including personnel located outside the United States, may access the environment remotely for administration and support, using a company VPN, multi-factor authentication and logged access; customer data is not copied or stored outside the United States.
If you are in the United Kingdom or European Economic Area, your personal information is transferred to the United States. We protect these transfers with the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, included in our data processing agreement with customers.
7. How long we keep information
We keep personal information only as long as needed for the purposes in this policy:
| Information | Retention |
|---|---|
| Account and activity data | For the life of the customer's contract, then deleted within [30] days after a [30]-day export window |
| Conversation transcripts | 90 days |
| Security and access logs | At least 1 year |
| Backups | Rolling 30 days |
| Website inquiries | As long as needed to respond and maintain our business relationship |
Customers may agree different retention periods in their contract. We may keep information longer where the law requires.
8. Security
We protect personal information with administrative, technical and physical safeguards, including encryption in transit and at rest, multi-factor authentication for administrative access, role-based access controls, logging and monitoring, and regular security testing. Our security program is managed under SOC 2 controls. No system is completely secure, but we work to protect your information and will notify affected customers of incidents as required by law and our agreements.
9. Your rights
Depending on where you live, you may have the right to:
- access the personal information we hold about you;
- correct inaccurate information;
- ask us to delete your information;
- object to or restrict certain processing;
- receive your information in a portable format;
- withdraw consent where we rely on it;
- complain to a data protection authority, such as the UK Information Commissioner's Office.
To make a request, email megha.sinha@kolter.ai. We will respond within the time required by law, usually one month. If your request concerns content your organization put into Kolter AI, we will refer it to your organization, as we process that content on its behalf.
10. Cookies
Kolter AI uses strictly necessary cookies to keep you signed in securely. Our website may use basic analytics cookies, which you can control through your browser settings.
11. Changes to this policy
We may update this policy from time to time. We will post the updated version here with a new effective date and, for material changes, notify customers directly.
12. Contact us
Kamet Consulting Group LLC (Kolter AI) PO Box 3852, Incline Village, NV 89450 Email: megha.sinha@kolter.ai