Privacy Policy

Last updated: July 31, 2026

This privacy policy explains, in accordance with Art. 13 and 14 GDPR, how personal data is processed (a) when you visit the website aegis-firewall.com (Part A) and (b) when you use the Aegis service, consisting of the Chrome extension and the associated API at aegis.kaino.io (Part B).

1. Controller

Kaino GmbH
Grabenweg 68, 4th Floor E5_2
6020 Innsbruck, Austria

VAT ID: ATU77867578
Commercial Register No.: 573644w

Phone: +43 512 411012
Email: aegis@kaino.at / hello@kaino.at
Website: https://kaino.at

Authorized Managing Directors: Pius Fischer, Florian Köllich

Data Protection Officer: Not appointed. Kaino GmbH's core business activity consists of pseudonymizing personal data, not in the extensive processing of special categories of data (Art. 9 GDPR) or the systematic monitoring of individuals. Therefore, the conditions of Art. 37 para. 1 GDPR are not met.

Part A: Website aegis-firewall.com

2. Which data we process, and why

Contact form

When you use our contact form, we process the data you provide (name, email address, subject and message) as well as your IP address in order to handle and answer your enquiry. The legal basis is your consent and the performance of pre-contractual measures (Art. 6(1)(a) and (b) GDPR). We keep this data for as long as it is needed to handle your enquiry and delete it afterwards, unless statutory retention obligations apply.

Spam protection (Cloudflare Turnstile)

To protect our contact form against abuse by automated programs we use, where enabled, the Turnstile service provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Turnstile uses technical signals (including IP address, browser and device information, and interaction patterns) to determine whether input comes from a human. The following data is transferred to Cloudflare servers, including in the USA: your IP address, technical browser and device information (including user agent, browser properties, screen and language settings), interaction patterns within the Turnstile widget (such as mouse movements and timing), and the verification result in the form of a token. The contents of your form entries (name, e-mail address, message) are not transferred to Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework, and standard contractual clauses pursuant to Art. 46 GDPR are in place as an additional safeguard. In the standard configuration we use (without so-called pre-clearance), Turnstile does not set any cookies and does not build user profiles. The legal basis is our legitimate interest in protecting the website against abusive automated use (Art. 6(1)(f) GDPR). Cloudflare processes this data on our behalf under a data processing agreement pursuant to Art. 28 GDPR. For more information, see the Cloudflare Turnstile privacy policy:cloudflare.com/en-gb/turnstile-privacy-policy.

Server log data

When the website is accessed, technically necessary data (including IP address, date and time, the page requested and browser type) is processed in server logs in order to provide the website securely and reliably and to assess, in aggregate form, which pages are visited how often. The legal basis is our legitimate interest in secure operation and in measuring reach (Art. 6(1)(f) GDPR). These log entries are automatically deleted after 30 days at the latest. We do not combine them with other data sources and do not use them to identify individual visitors.

Cookies and consent

By default this website sets only one technically necessary entry that stores your cookie choice. Analytics or marketing cookies are only set after your explicit consent. Details are in our Cookie Policy.

Web analytics (Google Analytics 4)

This website may use the web-analytics service Google Analytics 4. Where activated, it is used only after your explicit consent given via the cookie banner (Art. 6(1)(a) GDPR). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics processes pseudonymous usage data (including pages viewed, time spent, approximate location, and browser and device information) and sets _ga cookies (details and withdrawal in our Cookie Policy). According to Google, Google Analytics 4 does not log or store IP addresses; the IP address is processed only briefly during collection to derive coarse location data and is then discarded. Event data stored on Google servers is deleted automatically after the retention period configured in the Analytics property (2 or 14 months). Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework, and standard contractual clauses pursuant to Art. 46 GDPR are in place as an additional safeguard. Google processes this data on our behalf under a data processing agreement pursuant to Art. 28 GDPR. You can withdraw a given consent at any time with effect for the future via the cookie settings.

Advertising and conversion measurement (Google Tag Manager, Meta pixel, LinkedIn Insight Tag)

To measure our advertising campaigns we use the Meta pixel and the LinkedIn Insight Tag, but only after your explicit consent given via the cookie banner ("Marketing" category, Art. 6(1)(a) GDPR). Both are loaded via Google Tag Manager (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland); the Tag Manager itself stores no cookies. Without consent, none of these scripts is loaded and no data is transferred to the providers named here.

Meta pixel: the provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. The pixel measures whether visitors reached us via a Facebook or Instagram ad and which actions they take (such as installing the extension), and sets the _fbp and _fbc cookies. For the collection and transmission of this data we have a joint-controllership agreement with Meta pursuant to Art. 26 GDPR; Meta is solely responsible for the subsequent processing. Data may be transferred to Meta Platforms, Inc. in the USA; Meta is certified under the EU-US Data Privacy Framework.

LinkedIn Insight Tag: the provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. The tag attributes conversions to LinkedIn ads and sets the li_fat_id cookie. According to LinkedIn, it also processes this data for its own purposes; data may be transferred to LinkedIn Corporation in the USA. LinkedIn is certified under the EU-US Data Privacy Framework. You can withdraw your consent at any time with effect for the future via the cookie settings; all cookies set are listed in our Cookie Policy.

3. Recipients and processors (Website)

To provide the website and deliver contact enquiries, we use carefully selected service providers (hosting, email delivery and, where activated, web analytics). They process data only on our behalf and on the basis of data-processing agreements under Art. 28 GDPR. After your marketing consent, Meta and LinkedIn additionally receive the data described above; they process it partly under joint or their own responsibility (see "Advertising and conversion measurement"). Any disclosure beyond this to third parties takes place only where we are legally required to do so.

4. Storage period (Website)

We store personal data only for as long as it is necessary for the purposes stated above or as required by statutory retention periods. After that, the data is deleted.

5. Security

We take appropriate technical and organisational measures to protect your data, including encrypted transmission (TLS/HTTPS).

6. External links

This privacy policy does not apply to third-party websites we link to. The respective providers are responsible for their content and data protection.

Part B: The Aegis Service (Chrome extension and API)

7. Scope

This Part B applies to the Aegis Chrome extension by Kaino GmbH and the associated API at aegis.kaino.io. It provides information, pursuant to Art. 13 and 14 GDPR, about the personal data processed.

Aegis identifies and pseudonymizes personal data in documents before they are transmitted to AI chat platforms (such as ChatGPT, Claude, Gemini, or Perplexity). The transmission of pseudonymized data to the respective platform is exclusively initiated by an active action of the user. Aegis only performs the pseudonymization.

For the respective AI platform, the transmitted data is effectively anonymous: it receives only placeholders and never has access to the mapping table. The real data can only be restored in the user's browser extension.

8. Data Processing by Plan

8.1 Aegis FREE

In the FREE plan, pseudonymization is likewise performed server-side by Kaino GmbH: document contents are transmitted encrypted (HTTPS) to Kaino GmbH and processed exclusively on EU infrastructure (Hetzner, Germany; OVHCloud, France; Scaleway, France). The data flow is identical to the paid plans (see Section 8.2); the plans differ in the monthly document quota and the services included, not in the nature of the processing. Contents are processed exclusively in memory and are not stored server-side.

Data processed:

Kaino GmbH acts as a processor (Art. 4 No. 8, Art. 28 GDPR) on behalf of the user; the Data Processing Agreement applies.

No usage tracking takes place.

8.2 Paid plans

On the paid plans too, document contents are transmitted encrypted (HTTPS) to Kaino GmbH. AI-assisted pseudonymization is performed on EU infrastructure via the sub-processors OVHCloud SAS (France) and Scaleway SAS (France). Data processing is identical across all plans — including FREE; the plans differ in the monthly document quota and the services included, not in the nature of the processing.

On the ENTERPRISE plan, processing may, by individual agreement, take place on Kaino-operated EU servers in the region of your choice instead of via the sub-processors named above.

Supported file formats can be viewed on the Aegis product page. Image files are transmitted as binary data to aegis.kaino.io. Embedded metadata is removed server-side. OCR (Optical Character Recognition) processing is performed server-side to extract text from scanned documents and images.

Data flow:

  1. Document is read into the browser as a binary file
  2. The complete file is transmitted via HTTPS to aegis.kaino.io
  3. Kaino GmbH performs server-side, rules-based pre-processing in which already detected personal data is replaced with placeholders (data minimization).
  4. The pre-processed file is pseudonymized using AI on EU infrastructure (Hetzner, Germany; OVHCloud, France; Scaleway, France). For image files, embedded metadata is removed beforehand and OCR processing is performed.
  5. Pseudonymized text and placeholder mapping are returned; file name, file type, and document content are processed exclusively in RAM and are not logged or stored server-side

Additionally processed data:

Processing ActivityDataLegal Basis
Product Key IssuanceEmail address, name, company name: stored encrypted (Encryption-at-Rest)Art. 6 para. 1 lit. b GDPR (Contract performance)
Subscription ManagementSubscription status, usage statistics (number of processed documents)Art. 6 para. 1 lit. b GDPR (Contract performance)
Subscription validationDaily check of subscription status via aegis.kaino.ioArt. 6 para. 1 lit. b GDPR (performance of contract)
Payment ProcessingEmail address, payment information (via Stripe as an independent controller)Art. 6 para. 1 lit. b GDPR (Contract performance)
Document PseudonymizationDocument content (text or binary file), file name, file typeArt. 6 para. 1 lit. b GDPR (contract performance: pseudonymization as a contractual service to the user). For third-party data in documents: see Section 10.
API CommunicationBrowser languageArt. 6 para. 1 lit. b GDPR (Contract performance: communication with the user in their preferred language)
Server Access LogsIP address, timestamp, user agent, requested URL, HTTP status code, browser languageArt. 6 para. 1 lit. f GDPR (legitimate interest: operational security and troubleshooting)

Kaino GmbH does not store document contents after processing. Document contents are processed exclusively by the processors mentioned in Section 12 within the EU. No transfer to other third parties takes place.

Legal Basis: Art. 6 para. 1 lit. b GDPR (contract performance), Art. 6 para. 1 lit. c GDPR (legal obligation: tax and commercial retention obligations according to § 132 BAO, § 212 UGB), Art. 6 para. 1 lit. f GDPR (legitimate interest: server access logs).

The processing of third-party data in documents is carried out within the framework of commissioned processing in accordance with Art. 28 GDPR (see Section 10). The details are regulated in the Data Processing Agreement (DPA), which comes into effect upon subscription.

Balancing of interests for server access logs (Art. 6 para. 1 lit. f GDPR): The legitimate interest of Kaino GmbH in processing server access logs (IP address, timestamp, user agent, requested URL, HTTP status code, browser language) consists of ensuring IT security, detecting and preventing attacks and misuse, troubleshooting and ensuring system availability, and legal prosecution in case of unauthorized access. The storage period is limited to 30 days. The interests of the data subjects are protected by the short storage period and the exclusively security-related use. A right to object exists according to Art. 21 GDPR (see Section 20).

8.3 Aegis ENTERPRISE

ENTERPRISE is an individually agreed-upon solution. By default, Kaino GmbH offers self-hosted AI on servers in Germany. Customers may also use other services depending on the agreement. In this case, the data protection provisions of the respective service apply.

Features (self-hosted version):

The Data Processing Agreement (DPA) serves as the basis. Supplementary or deviating conditions are agreed upon individually.

Legal basis: Art. 6 para. 1 lit. b GDPR (performance of contract), Art. 28 GDPR (DPA).

9. Additional Features

Download Restoration: When downloading files from supported AI chat platforms, placeholders are automatically replaced with original data. The extension monitors download processes on the respective platform pages and replaces recognized placeholders in the downloaded text. This processing occurs exclusively locally in the browser.

Clipboard Restoration: When copying text from responses on supported AI chat platforms, placeholders in the clipboard are automatically replaced with original data. For this purpose, the extension registers an event listener for copy events within the respective platform page. This processing occurs exclusively locally in the browser.

Placeholder View: Overview page for viewing the mapping of placeholders ↔ original data. Stored locally, accessible only within the extension.

Legal basis for all local functions: Art. 6 para. 1 lit. b GDPR (performance of contract).

10. Processing of Third-Party Data in Documents (Art. 14 GDPR)

Documents that users process via Aegis may contain personal data of third parties (e.g., employees, customers, patients, business partners).

Roles:

Note to Users: As the controller, you bear sole responsibility for having an appropriate legal basis for processing third-party personal data (e.g., legitimate interest, consent, or contractual basis). This includes, in particular, the obligation to independently check the admissibility of processing before transmitting it to Aegis and to assess the risks for affected third parties. As the controller, you are obliged to inform affected third parties about the processing in accordance with Art. 14 GDPR, unless an exception under Art. 14 para. 5 GDPR applies. Kaino GmbH is not liable for unlawful transmission of documents by the user. Insofar as documents contain special categories of personal data within the meaning of Art. 9 para. 1 GDPR (e.g., health data, data on religious beliefs), the user is responsible for ensuring that an exception under Art. 9 para. 2 GDPR exists. Further details are regulated in the Data Processing Agreement (DPA), § 3.1.

Art. 14 para. 5 lit. b GDPR: Insofar as Kaino GmbH processes third-party data as a processor, direct information of the affected third parties by Kaino GmbH is not possible, as Kaino GmbH has no knowledge of the identity of the affected individuals nor does it have contact details. The obligation to inform affected third parties lies with the user as the controller.

11. Obligation to Provide Data (Art. 13(2)(e) GDPR)

Aegis FREE: No personal data (such as an account) is required for use.

Paid Plans (PRO, ENTERPRISE): The provision of name, company name, email address, and payment information is a contractual prerequisite for use. Without this data, no subscription can be concluded.

Document Processing: Uploading documents is voluntary. Aegis only becomes active if the user uploads a file for pseudonymization on a supported AI chat platform.

12. Processors and Other Recipients

OVHCloud (AI processing: all plans)

AI-powered document pseudonymization and OCR processing.

Scaleway (AI processing: all plans)

AI-powered document pseudonymization and OCR processing.

Hetzner Online (Infrastructure and Website Hosting: all plans)

Hosting of Kaino servers, the API infrastructure and the website.

Stripe (Paid Plans): Independent Controller

Payment processing via Stripe Checkout and Stripe Billing Portal. The user is redirected to Stripe's hosted checkout page for payment processing and enters their payment data directly with Stripe there. Stripe processes this data under its own data protection responsibility in accordance with Art. 4 No. 7 GDPR, not as a processor for Kaino GmbH. Only billing data is transmitted to Stripe; document content is never passed on to Stripe.

Tax Advisor (Paid Plans): Independent Controller

To fulfill tax and commercial retention obligations (§ 132 BAO, § 212 UGB), billing data is passed on to Kaino GmbH's tax advisor. The tax advisor processes the data under their own data protection responsibility (Art. 4 No. 7 GDPR) and is subject to professional confidentiality (§ 80 WTBG).

Hetzner Online GmbH, OVHCloud SAS and Scaleway SAS are contractually bound as processors in accordance with Art. 28 GDPR. Stripe Payments Europe, Ltd. processes payment data as an independent controller. The tax advisor processes billing data as an independent controller to comply with statutory retention obligations. Personal data is not disclosed to third parties beyond this unless required to fulfill legal obligations (Art. 6(1)(c) GDPR).

13. Data Transfers to Third Countries

All plans: All document data is processed exclusively within the EU (Hetzner, Germany; OVHCloud, France; Scaleway, France). No document contents are transferred to third countries.

ENTERPRISE (Self-Hosted): Processing exclusively in Germany.

Stripe: Stripe Payments Europe, Ltd. (Ireland) processes billing data exclusively as an independent controller within the EU. Document content is never transmitted to Stripe. Stripe may transmit billing data to affiliated companies in the USA (Stripe, Inc.), secured by the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) and additionally by Standard Contractual Clauses in accordance with Art. 46 para. 2 lit. c GDPR. Further information can be found in Stripe's Privacy Policy.

14. Retention Periods in the Aegis Service

Data CategoryStorage PeriodStorage Location
Mapping Table (Placeholders ↔ Original Data)Automatic deletion after 14 days or manual deletion by the userLocal Browser Storage
Product Key (API Key)Until uninstallation or manual deletionChrome Extension Storage
Email Address, Name, Company NameUntil termination of the subscription; irreversible anonymization at Kaino GmbH within 30 days after termination. Tax-relevant billing data is retained by the tax advisor for 7 years (§ 132 BAO, § 212 UGB) and by Stripe as an independent controller according to its retention obligations (see Section 12).Kaino GmbH (encrypted, Encryption-at-Rest)
Subscription StatusFor the duration of the subscription; anonymization together with customer master data within 30 days after terminationKaino GmbH Server (Hetzner, DE)
Usage Statistics (Number of Processed Documents)For the duration of the subscription. After termination, customer master data is irreversibly anonymized (see above). The remaining usage statistics contain exclusively aggregated counters (number of documents, number of recognized categories per processing) without personal reference and do not constitute personal data within the meaning of Art. 4 No. 1 GDPR (cf. Recital 26).Kaino GmbH Server (Hetzner, DE)
Document Content (Kaino)No storage after processingKaino GmbH Server
Server Access Logs30 daysKaino GmbH Server (Hetzner, DE)
Payment DataStripe processes payment data as an independent controller; the storage period is determined by Stripe's Privacy PolicyStripe Payments Europe, Ltd.

Upon uninstallation of the extension, all locally stored data is automatically deleted by Chrome.

15. Automated Decision-Making (Art. 22 GDPR)

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. Pseudonymization does not constitute a decision with legal effect, as it does not evaluate personal aspects of the data subjects, but exclusively serves pattern recognition for data protection improvement.

16. Data Security in the Aegis Service

A detailed description of the technical and organizational measures in accordance with Art. 32 GDPR is documented in the Data Processing Agreement (DPA), Annex 1.

Kaino GmbH does not permanently store document content. Processing takes place exclusively via the infrastructure of the processors mentioned in Section 12. For the technical and organizational measures of the infrastructure providers, we refer to their data protection and security documentation:

17. Cookies and Tracking in the Extension

The extension does not use cookies or usage tracking.

18. No Sale of Personal Data

Personal data is neither sold by Kaino GmbH nor passed on to third parties for remuneration.

19. Chrome Web Store: Limited Use

The use of information received from Google APIs complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

The extension:

Common Provisions

20. Your Rights (Art. 15–22 GDPR)

You have the following rights regarding your personal data vis-à-vis Kaino GmbH:

Requests will be answered without undue delay, and in any case within one month of receipt (Art. 12 para. 3 GDPR). In complex cases, the deadline may be extended by a further two months, of which you will be informed within the first month.

Data processing by Aegis is based exclusively on Art. 6 para. 1 lit. b GDPR (performance of contract) and Art. 6 para. 1 lit. f GDPR (legitimate interest). Consent is not obtained; therefore, there is no right of withdrawal according to Art. 7 para. 3 GDPR.

Right to object (Art. 21 GDPR)

Insofar as Kaino GmbH processes personal data on the basis of a legitimate interest (Art. 6 para. 1 lit. f GDPR), which exclusively concerns server access logs, you have the right to object to this processing at any time for reasons arising from your particular situation.

In the event of an objection, Kaino GmbH will no longer process the data concerned, unless there are compelling legitimate grounds that override your interests, or the processing serves the assertion, exercise, or defense of legal claims. The use of paid Aegis services is voluntary: you can stop using them or cancel your subscription at any time.

Contact for all inquiries and objections: aegis@kaino.at

Right to lodge a complaint (Art. 77 GDPR)

You have the right to lodge a complaint with a data protection supervisory authority. You can contact the supervisory authority of your place of residence, your workplace, or the place of the alleged infringement.

Competent Authority of the Controller:
Austrian Data Protection Authority
Barichgasse 40–42, 1030 Vienna
dsb@dsb.gv.at · https://www.dsb.gv.at

A list of all EU data protection supervisory authorities can be found at: edpb.europa.eu/about-edpb/about-edpb/members

21. Changes to this Privacy Policy

We update this privacy policy when our processing or the legal situation changes. Changes that significantly affect data processing will be announced by email at least 30 days before they come into effect and will be published in advance at https://aegis-firewall.com/en/privacy. The version published on this page at the time applies.

Kaino GmbH