Kenosis is operated by Jorcks Consult ApS, CVR 39555492, Rodelundvej 13C, 8653 Them, Denmark. Write to us at pj@jorcks.com.
We are the controller of the data we need to run your account and bill you: your name and email address, your sign-in records, which organisations you belong to and in what role, your plan and invoices, and per-request usage records (token counts and costs).
We are a processor of everything an organisation puts into Kenosis: conversations and their messages, files, the memory our agents build from them (facts, entities, relationships), and anything read from a connected service. We process that data only on the organisation's instructions, to provide the service, and never to train AI models. The organisation is its controller. An organisation that needs a signed data processing agreement can ask us for one.
When an organisation connects a mailbox, a calendar or a file store (Google or Microsoft 365), the organisation is the controller of its own mailboxes, on the basis of its legitimate interest in working with its own business correspondence, and we process what we read as its processor. The text a user sees when connecting is that user's instruction to Kenosis to read the account, not a consent form. Content read from a connected account is private to the user who connected it unless they choose to share it.
When an organisation connects its accounting system (e-conomic), Kenosis reads its invoices, customers and balances, and creates customers, and draft invoices from approved hours with their time overview attached, on your explicit confirmation. It never books invoices.
If your organisation installs the Kenosis Slack app, Slack sends us the messages you address to the assistant and the ids of the Slack users and channels involved; we process them to answer and store them with your organisation's conversations. Disconnecting the app stops this.
If your organisation connects an SMS number, Twilio delivers the texts sent to it to us, with the sending phone number. We answer only texts from a phone a member has linked, and store them with that member's conversation, which is kept out of memory. Each member's linked number is stored until they unlink it or leave the organisation. Disconnecting the number stops this.
Conversations, uploaded files and the memory built from them are private to the person who created them. Colleagues in the same organisation see them only when that person shares them.
Kenosis sets only the cookies needed to keep you signed in. There are no tracking or analytics cookies, so no cookie banner is needed: strictly necessary cookies are exempt from consent.
Your data is stored in the EU: the database in Ireland and application compute in Dublin. AI processing (Anthropic) and text embeddings for memory search (Voyage AI) take place in the US, under the transfer safeguards listed on our sub-processor page.
Organisation data lives for as long as the organisation exists on Kenosis. You can export it at any time. If an organisation or an account is deleted, its conversations, files and memory are permanently removed after a 30-day grace period, during which the deletion can be cancelled. Billing records are kept for 5 years, as Danish bookkeeping law requires. Anonymised usage statistics may be kept indefinitely.
We use a small number of specialist providers to run Kenosis: hosting, database, AI inference, payments and error monitoring. None of them may use your data for anything other than providing their service to us. The full list, with region, purpose and transfer safeguards, is on our sub-processor page. Our data processing agreement template is the agreement organisations sign with us as their processor.
Under the GDPR you can ask what data we hold about you, have it corrected or deleted, receive a copy of it, or object to its processing. For data an organisation put into Kenosis, the organisation is the controller: ask your organisation's administrator, and we will help them answer. Write to pj@jorcks.com and we will respond within the legal deadline. You can also complain to Datatilsynet, the Danish Data Protection Agency.
Questions about this policy: pj@jorcks.com.