Privacy Policy

Operator

Operator: TriKro LLC, doing business as Kromatic ("we", "us"). This policy covers the Neumann simulation service: its REST API, its MCP server, and its web pages at neumann.kromatic.com.

What we collect

• Account data. An account id, a one-way hash of your API key or access token, your credit balance and credit purchase and consumption records. Creating an account through the API does not require an email address or name. If you connect through a Kromatic account (sign-in at api.kromatic.com), we also store the account identifier ("subject") from your sign-in token. If you buy credits, we store the Stripe customer identifier (see "Payments").
• Models and results. The graphs you submit (node names, descriptions, distributions, formulas and parameter labels) and the simulation results we return, including full per-trial result files.
• Anonymous calls. To enforce the daily free allowance, a SHA-256 hash of the caller's IP address and user-agent string, with a daily run count. The same hash is attached to anonymous runs so the caller can fetch their results. We remove the hash after 30 days; anonymous runs and results are then kept without it. The raw IP address is not stored in these records, but the hash is not salted, so it is pseudonymous rather than anonymous and we treat it as personal data.
• Arrival counts. For each MCP tool call we add to a daily count per AI platform (for example Anthropic, OpenAI or xAI), referral code (the ref link parameter) and tool name. We infer the platform from the network the request comes from, the user-agent string and the client name the MCP client reports. These counts store no IP address, user agent, account or fingerprint.
• Server logs. Our hosting provider's request logs record the IP address, path and status of each request, for security and troubleshooting.
• Feedback. If you use the feedback tool, the message, your email address, your name if you give it, and your account id if you are signed in. It is emailed to us (with a copy to you) and not stored in the service's database.
• Error reports. When the service hits an unexpected error, an error report (the error message, stack trace and request metadata such as the URL path) goes to Sentry. Request bodies and program variables are excluded from these reports, so submitted graphs are not attached to them; an error message can still quote part of the input that caused it.
• Web analytics. Web pages (including these legal pages, the API documentation and public share pages, but not the MCP or REST API) load Google Analytics 4 via Google Tag Manager, which sets first-party cookies and collects page-view and session data. The service sets no other cookies.

Using Neumann through Claude, ChatGPT, Grok or other assistants

When you use Neumann as a connector or app inside an AI assistant, the assistant's operator (for example Anthropic, OpenAI or xAI) is a separate, independent controller of your conversation, and its own privacy policy governs it. Neumann receives only what the assistant sends when it calls a Neumann tool (the tool arguments, such as a graph), the client name it reports when it connects, and standard network metadata such as IP address and user agent. Neumann does not receive or request your conversation history or the assistant's memory.

Share links

If you create a share link for a run, anyone with the link can see that run's name and description, node names, graph id and version, status, trial counts, summary statistics and histogram, and timestamps, without signing in. Revoke a link to end public access.

How we use it

To run simulations and return results; to manage accounts, credits and payments; to enforce the free allowance and prevent abuse; to measure, in aggregate, which platforms and channels people use; to fix errors; to answer feedback and support requests; and to meet legal, tax and accounting obligations. For users in the EEA and UK, our legal bases are performance of our contract with you, our legitimate interests in securing, measuring and improving the service, your consent where the law requires it for analytics cookies, and legal obligation.

Service providers

Submitted graphs are not sent to any third-party AI model or LLM provider, and we don't train AI models on your inputs. Simulations run on our own Fly.io-hosted servers. We use these providers, solely to operate the service:

• Fly.io (hosting, database and request logs): all service data is stored on or transits Fly.io infrastructure in the United States.
• Amazon Web Services (S3 storage): full simulation result files.
• Sentry (error monitoring): error reports as described above.
• Stripe (payments): your account id and purchase details; see "Payments".
• Mailchimp Transactional (Mandrill) (email): feedback messages, the email address and name you give, and your account id.
• Google (Google Analytics and Google Tag Manager): page-view and session data from the web pages.

Payments

Credit purchases are processed by Stripe, which collects your email address and card details directly; we never receive your full card number. Your card is saved with Stripe so that later purchases you request (for example through the buy_credits tool) can be charged without re-entering it.

Your responsibility

Do not put personal data in node names, descriptions or parameter labels; the service treats them as model structure, not as protected data.

Retention

• Account data, graphs and results: kept until you delete your account. To delete it, email legal@kromatic.com (see below).
• Anonymous fingerprints: deleted after 30 days, together with their daily run counts. Anonymous runs and results are kept without the fingerprint after that.
• Arrival counts: kept as aggregate statistics. They contain no personal data.
• Billing records: kept as long as required for tax and accounting, even after account deletion.
• Error reports, server logs and feedback email: kept by Sentry, our hosting provider and our mailbox under their retention settings, and no longer than needed.

Deletion and your rights

Email legal@kromatic.com with your account_id and we delete the account, its graphs and results; billing records are retained as required for tax and accounting.

Subject to applicable law, you may also ask us to access, correct or export the personal data we hold about you, or object to or restrict its processing, by emailing legal@kromatic.com. California residents have the rights to know, delete and correct personal information and to non-discrimination; we do not sell or share personal information for cross-context behavioral advertising. We respond within 45 days, or one month for EEA and UK requests. EEA and UK residents may also complain to their data protection authority.

Children

The service is not directed to children, and you must be at least 13 to use it. We do not knowingly collect personal information from children under 13; if you believe a child has given us personal information, email legal@kromatic.com and we will delete it.

International users

The service is operated from the United States. If you use it from elsewhere, your information is transferred to, stored and processed in the United States, where data protection laws may differ from those of your country. For transfers of personal data from the EEA and UK, we rely on the standard data processing agreements, including their transfer terms, of our service providers: Fly.io, Amazon Web Services, Sentry, Stripe, Mailchimp (Intuit) and Google.

Support

For general support questions email innovate@kromatic.com. Deletion and privacy requests stay with legal@kromatic.com.

No advertising

We do not sell data or show ads.

Changes

We may update this policy; the version at this URL is always the current one, and the "Last updated" date shows when it last changed.