Privacy Policy

Effective Date: 23 July 2026

1. Controller and scope

CloudOps S.L. ("K8Studio," "we," "us," or "our") is the data controller for the processing described here.

Address: Calle Aguila 5, 11500 El Puerto de Santa Maria, Cadiz, Spain
Email: info@k8studio.io

This notice covers k8studio.io, the K8Studio desktop application, accounts, licensing, support, feedback, website analytics, and download measurement.

2. Processing activities

a. Accounts, trials, and licenses

Data: email, account identifiers, authentication provider identifiers, license and subscription data, a device identifier used to activate and enforce a license, and related transaction records.
Purpose and legal basis: provide the requested account, trial, license, and subscription; perform our contract; prevent license abuse; and comply with accounting and legal obligations.
Retention: while the account or contract is active, then for applicable statutory limitation, tax, and accounting periods. The account portal stores its authentication token only for the browser session and may store non-sensitive grid preferences locally until you clear site data. Self-service account deletion removes the profile, credentials, sessions, active licenses, activations, and invitations. Billing invoices and limited subscription or transaction records are retained only where required for tax, accounting, or legal obligations. We keep a deletion receipt containing an irreversible pseudonymous account reference, request source, timestamps, outcome, and retained-record categories for up to three years. Failed deletion-attempt receipts expire after one year. The receipt contains no email address or account profile.

b. Contact and support

Data: email, subject, message, and any information you choose to provide. Google reCAPTCHA also processes connection and device signals when you submit the form.
Purpose and legal basis: respond to your request and prevent abuse, based on steps requested by you and our legitimate interest in securing support services.
Retention: up to 24 months after the request is closed, unless a longer period is needed for an active dispute or legal obligation.

c. Optional website analytics and download measurement

Data: page URL and title, referrer, browser and operating-system category, device type, screen size, session timing, campaign parameters, approximate country, download package, version, and selected platform. Rybbit or our delivery infrastructure may briefly process an IP address to provide the connection and derive approximate location. We do not create a persistent download identifier.
Purpose and legal basis: understand aggregate use and download demand. We process this only with your consent.
Retention: analytics and identifiable event-level download records are retained for no more than 13 months, after which they are deleted or irreversibly aggregated.

d. First-party interactive diagrams

Data: requested diagram identifier, IP address, request time, and ordinary browser and security-log metadata.
Purpose and legal basis: render UxxU interactive diagrams as first-party K8Studio website functionality and secure the service, based on providing the page you requested and our legitimate interest in reliable service delivery.
Retention: diagram content follows the applicable K8Studio account or content lifecycle. Service logs are normally retained for up to 12 months as described below. The embed bundle does not use cookies, browser storage, or analytics.

e. Application operation and local cluster data

K8Studio reads Kubernetes configuration and cluster resources to provide the desktop features you request. Cluster data, credentials, logs, terminal content, and CloudMaps data are processed locally by default and are not sent to K8Studio merely because you use the application. Local settings remain on your device until you remove them or uninstall the application.

The application may connect to GitHub for update information and to K8Studio licensing services for activation and account functions. These connections process ordinary network data such as IP address, version, platform, and the licensing data described above.

f. AI and Copilot features

AI features are off by default. When you configure and invoke an AI provider, the prompt and the context needed for your request are sent to the provider you selected. K8Studio applies its local anonymization pipeline to supported Kubernetes secrets and identifiers before remote requests, but you should review the context before sending it.

Ollama can remain local when you configure a local endpoint. OpenAI, Anthropic/Claude, Codex CLI, Claude Code, Gemini CLI, and GitHub Copilot may process data under the account and terms you have with that provider. K8Studio does not send AI context while the AI assistant is disabled.

g. Product feedback

Data: rating, optional comment, and a random event identifier. We do not attach the computer's hardware identifier to new feedback.
Purpose and legal basis: review feedback you voluntarily send, based on your consent.
Retention: up to 24 months, then deletion or irreversible aggregation.

h. Security and service logs

Data: IP address, timestamp, request metadata, authentication events, error details, and security signals.
Purpose and legal basis: maintain service reliability, diagnose faults, prevent fraud, and defend our systems, based on our legitimate interests and legal obligations.
Retention: normally up to 12 months, with longer retention only for a documented incident, dispute, or legal requirement.

3. Recipients and providers

We do not sell personal data. Depending on the feature you use, recipients can include Amazon Web Services for hosting and email delivery, Stripe for payments, Rybbit for optional analytics, Google for user-initiated authentication, reCAPTCHA, and optional YouTube media, GitHub for releases and updates, and the AI provider you explicitly configure. UxxU interactive diagrams are operated by CloudOps S.L. as a first-party K8Studio service. Professional advisers and public authorities receive data only where necessary or legally required.

4. International transfers

Some providers may process data outside the European Economic Area. Where GDPR requires it, we rely on an adequacy decision, the European Commission's Standard Contractual Clauses, or another lawful transfer mechanism, together with appropriate supplementary safeguards.

5. Cookies and similar storage

Optional analytics, download measurement, YouTube, and other third-party media are disabled until you choose them. First-party UxxU diagrams load as functional website content and do not use browser storage or analytics. We use necessary local storage to remember your website privacy choices. The account portal uses session storage for authentication and local storage for interface preferences; it loads Google OAuth only after you enable Google sign-in. You can change or withdraw optional website consent at any time through "Privacy choices" in the website footer. Withdrawal does not affect processing that was lawful before withdrawal. See the Cookie Policy for details.

6. Security

We use proportionate technical and organizational safeguards intended to protect personal data against unauthorized access, alteration, disclosure, and loss. No system can guarantee absolute security.

7. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, or portability of your personal data, and you may object to processing based on legitimate interests. You may withdraw consent at any time. You also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. K8Studio does not use the data described here for such decisions.

You can permanently delete a signed-in K8Studio account from "Account & privacy" in the account portal. For access, correction, portability, restriction, objection, or an assisted erasure request, send an email to info@k8studio.io with the subject "Data protection request". We may need to verify your identity before acting. We normally respond within one month.

You may lodge a complaint with the Spanish Data Protection Agency (AEPD) at https://www.aepd.es/ or with the supervisory authority where you live or work.

8. Required information

Where data is required to create an account, activate a license, process a payment, or answer a support request, not providing it may prevent us from supplying that function. Optional analytics, external media, feedback, and AI features are not required for the core desktop application.

9. Children

K8Studio is a professional product and is not directed to children. We do not knowingly collect personal data from children through the website or application.

10. Changes

We may update this notice when our processing changes. We will identify the effective date and provide additional notice where a change materially affects your rights.