Privacy policy
What Kornial collects, why, who receives it, how long it is kept and what you can do about it.
Draft Written 17 October 2026, last revised 31 October 2026, pending the operator's review; not yet in effect.
Who we are
Kornial (kornial.ai) is a research tool for trading strategies: an MCP server that AI assistants such as ChatGPT and Claude connect to, and a website at the same address. It is operated by Zaliton Ltd, a company registered in Cyprus, the controller of the personal data described here. Contact: info@kornial.ai. The operator's registered address and company number are available on request at that address.
People sign in with their own accounts through WorkOS, our sign-in provider, with a one-time code sent to their email address or a password.
What we collect
- What you put in: your strategies, meaning their files (Python code and data files such as JSON, CSV or model weights), names, descriptions and notes, and every version of them. The backtests you start, with their instrument, date range, configuration, starting balance and role.
- What we compute for you: each backtest's results, meaning the reports, trades, positions, chart data, the lines your strategy logged, and the scores computed from them.
- Sign-in data: you sign in at WorkOS (workos.com), a company in the United States, with a one-time code WorkOS sends to your email address or a password. WorkOS holds your account: your email address, the name you give it, and your sign-in sessions, and the apps (ChatGPT, Claude, the website) you allowed to connect. It handles that under its own privacy policy, https://workos.com/privacy. Our server receives a signed token and stores only your WorkOS user id, as the owner of your strategies and backtests. We store no password, and no email address or name of yours.
- Request logs: Cloudflare, which runs the service, logs each request (its time, address and outcome) with request details Cloudflare adds, which include your IP address, approximate location and browser or client name. Error reports our server writes carry the request's id and outcome, never your strategy's content.
- Payment: there is nothing to pay today, and we do not ask for payment details. If paid plans come, Stripe takes the payment and holds your card and billing details under its own policy, https://stripe.com/privacy; we receive only your plan and its status.
- In your browser: the website keeps its sign-in tokens in your browser's local storage, on kornial.ai only, and sets no cookies. The sign-in page at WorkOS sets its own cookies, under WorkOS's policy.
We do not use analytics, advertising or tracking of any kind, we do not build profiles of you, and we do not sell or share your personal data with anyone for their own purposes. Because we do no tracking, we do not react to a browser's Do Not Track or Global Privacy Control signal: there is nothing to turn off.
Why we use it, and on what basis
Only to run the service: to store your strategies and results, run your backtests, show them to you and to the apps you approved, keep the service secure and fix problems. We do not use your strategies to train models, ours or anyone's.
- Providing the service you asked for, including your account, your strategies and your backtests: performance of our contract with you.
- Request logs, error reports and abuse prevention: our legitimate interest in keeping the service secure and working, which you can object to at info@kornial.ai.
- Payment and tax records, if paid plans come: our legal obligations.
You need an account to use the service; nothing else is required of you. We have no data protection officer; write to info@kornial.ai for anything about your data. The verdicts and scores are computed about your strategies, at your request, never about you: no decision with a legal or similar effect on you is made automatically.
Who receives it
- WorkOS holds your account as described above. We send it nothing from your strategies or backtests.
- Cloudflare hosts the service: the server, the database (Cloudflare D1) that holds your strategies, versions and backtest records, the file storage (Cloudflare R2) that holds results and backups, and the request logs.
- Modal runs each backtest: your strategy's files and the backtest's settings are sent to an isolated Modal sandbox in the United States, which has no network access and no secrets, and the results come back to Cloudflare. Modal also keeps its own operational logs.
- Stripe, if paid plans come, for payment: it handles your payment details as a controller in its own right, under its own policy.
- The AI assistant you use (ChatGPT, Claude or another) receives what its tool calls return, and what you write in its chat stays under that assistant's own privacy policy.
These companies work for us under data processing agreements. WorkOS, Modal and Stripe are in the United States and Cloudflare runs a worldwide network, so your data leaves the European Economic Area and the United Kingdom; the transfers rest on the European Commission's standard contractual clauses and, for Cloudflare and Stripe, their certification under the EU-US and UK-US Data Privacy Framework. Ask at info@kornial.ai for a copy of the safeguards.
Market data comes from historical price records we hold; nothing of yours is sent to the source of that data. We share nothing else with anyone, except where the law requires it.
How long we keep it
- Strategies, their versions, backtests and results: until you ask us to delete them. Versions do not change once made, so that a result can always be traced to the exact code it ran.
- Sign-in: your account and sessions stay at WorkOS under its policy; access tokens expire after five minutes and are refreshed by the app you connected. We keep your user id for as long as we keep your strategies.
- Backups: a nightly copy of results and files and a weekly copy of the database, kept for disaster recovery. A deleted strategy or backtest leaves the nightly copy within 30 days; the weekly database copies are never read except to restore the service, and we are setting the period after which each is destroyed.
- Cloudflare's request logs: 7 days. Modal's logs: as long as Modal's own retention.
- The browser data stays in your browser until you sign out or clear it.
Your rights
- Read and download your strategies and results at any time, through your assistant or the website.
- Disconnect an app in the assistant's settings, or sign out of the website. With WorkOS, your account details can be corrected or removed with WorkOS as well as with us.
- Ask us at info@kornial.ai for a copy of your data in a machine-readable form, a correction, a restriction, an objection to the processing we base on our legitimate interests, or the deletion of your strategies, backtests and the sign-in data we hold. We answer within 30 days, and we may ask you to confirm the request from the email address of your account.
- If you think we handle your data wrongly, complain to us at info@kornial.ai: we acknowledge within 30 days and tell you the outcome. You can also complain to the Commissioner for Personal Data Protection of Cyprus (dataprotection.gov.cy), where we are established, or to the data protection authority where you live, such as the Information Commissioner's Office in the United Kingdom.
Kornial is suitable for people aged 13 and over: it is research software that places no trades and gives no investment advice. It is not meant for children under 13, and we do not knowingly collect their data; if we learn that we hold a child's data, we delete it. Where the law where you live sets a higher age for agreeing to a service like this on your own, you need a parent's or guardian's consent until that age.
Changes
We will change this policy when the service changes, and show the date of the latest version at the top of this page.