Privacy notice

• Status: DRAFT for the lawyer (Track L, L-6), 5 Nov 2026. Drafted in step 7-2 for the public page /privacy (screen PUB-8), from the supervisors' short notice in legal/consent-and-notices-draft.md, part (c). The lawyer reviews it at L-4, before Gate RD (Q4). It is not final, and it is not legal advice.
• Placeholders are in square brackets. Nothing in brackets may be published as written.

Who is in charge

Your institution is in charge of the data in its space in the software. KineticIQ ([KineticIQ legal entity name]) runs the software for your institution, under a written agreement.

What we keep about you

• Your email address, to sign you in and to send you notices.
• Your name, as your institution's admin entered it.
• Your password, stored only in a form that cannot be turned back into the password.
• Your two-step sign-in settings, if you set it up.
• A record of what you do in the software, such as uploads, views, exports and decisions. It holds no thesis content.
• Your IP address, in the web server's log, for 30 days.
• The case labels, notes, decisions and ratings you enter.

Why

To run the service, to keep it secure, and to keep a record that your institution can check later.

What your browser keeps

Your browser keeps two choices only: the theme (light, dark or your device's) and the help language (English or Malay). Signing in uses cookies that only this site can read. Nothing else is stored in your browser, and the site loads nothing from any other site.

Quality figures

KineticIQ keeps figures about the questions the checks raise, such as the check, its colour and your decision. They hold no numbers, text or labels from any thesis. KineticIQ uses them only in totals, to make the questions more useful.

Emails

Notices are sent by Postmark, an email service based in the United States. Postmark sees your email address and a short notice with a link. No email holds thesis content, findings, student names or labels.

Where

On a server in Germany, run by KineticIQ with the hosting company Hetzner. The stored content is encrypted. The checks run on that server: no thesis is sent to an outside AI service.

How long

• Your account data: while your account exists.
• Thesis content: your institution's setting, by default 12 months.
• Logs: 30 days.
• The activity record: [audit-chain retention, from the agreement].

Who can see your work

• Only the supervisors you add to a case.
• Your institution's admins see counts and dates, and users' names and emails. They do not see thesis content, reports or labels.
• KineticIQ staff do not see your cases, unless your institution asks in writing for help with one case. That access is limited in time, needs the lead supervisor's approval, and is recorded.
• One trusted operator holds root on the server, and could technically reach data while it is processed.

What we ask of you

• Do not type a student's name or number into a label or a note.
• Keep downloaded reports confidential.
• Remember that a question is a question. It shows the arithmetic. The supervisor decides what, if anything, it means.

Your rights

Ask your institution's data protection officer: [the institution's DPO name and contact].