Who this is about
This notice covers the marketplace website — the catalogue you are reading and its install flow. It does not cover the Kiteworks platform itself, or the AI client you install an agent into. Those are governed by your existing Kiteworks agreement and by your agreement with your AI provider.
What the website stores about your visit
The site measures how the marketplace is used — which pages are visited, in which language, from which country and referring site — so that install journeys can be improved. Nothing in that measurement identifies you: your IP address and your full browser identifier are never stored, and the only repeat-visit marker is a value that cannot be traced back to you or linked from one day to the next.
Whether measurement is currently running, which fields it records, how long they are kept and who can see them are set out under Anonymous marketplace analytics below. Those details always reflect how this site is configured right now, not how it was configured when this notice was written.
What the website stores on your device
The site uses no advertising or cross-site tracking technology of any kind. It sets no analytics cookie. What it does store is limited to remembering your own choices so the install flow does not ask twice:
kw_langcookie — the interface language you chose, so the site is served in the language you picked. Kept for one year.kw_client_toolcookie — which AI client you told us you use, or that you declined to say, so the install instructions match your tooling. One year.kw_legal_acceptedcookie — the version of the marketplace terms you accepted and the date, so you are not asked twice and are asked again when the terms change. One year.kw_mcp_installed,kw_mcp_tenant_confirmed,kw_marketplace_addedcookies — which install prerequisites you confirmed, so completed steps are skipped. One year.kw-langandkw-lang-recentbrowser storage — your language choice and a short list of recently used languages, for the language picker. Kept until you clear site data. These never leave your device.kw_sessioncookie — a signed administrator session, set only for Kiteworks administrators signing in to the admin area. Lasts for the session.
Each of these exists because you asked for something — a language, an install path, an acknowledgement. None profiles you, none is read by any third party, and none follows you to another website.
Legal basis (EU and UK users)
We rely on Article 6(1)(b) of the GDPR — processing necessary to provide the service you asked for — for your language and install preferences and for answering your enquiry. We rely on Article 6(1)(f), our legitimate interests, for the record of which terms version you accepted, for securing the administration area, for aggregate usage measurement, and for audit records and backups; where we rely on legitimate interests you may object at any time. Storing the items listed above on your device is strictly necessary to deliver a service you explicitly requested and is therefore exempt from the consent requirement (ePrivacy Directive Article 5(3); PECR regulation 6(4)). We process no special-category data within the meaning of Article 9.
Telling us about an agent you want
If you use the "request an agent" form, we store the email address and message you type, so we can reply. That is the only place the website asks for anything about you, and it is entirely voluntary. It is kept until the request is dealt with.
Who can see it
Authenticated Kiteworks marketplace administrators, and Kiteworks staff who need it to run the site or answer your request. Any provider acting on our behalf does so as our processor under a written agreement and may not use the information for its own purposes. We disclose it to no one else for their own purposes.
What the website does not do
- It is not in the path of anything an agent reads or produces. Agents run in your own AI client, under your own provider account, and reach Kiteworks content through your own tenant. Files, scan results and generated reports never reach this website.
- It holds no AI provider credential and makes no request to an AI provider.
- It does not sell or share personal information, and does not use it for automated decision-making or profiling.
Where your information is processed
The cookies described above are sent to the site with each request so it can act on them — serve your language, skip completed steps — but they are not stored or logged server-side. The browser-storage items never leave your device. The website is hosted in AWS's eu-central-1 (Frankfurt) region; the controller is Kiteworks USA, LLC.
Your rights
Depending on where you live, you may have the right to ask what personal data we hold about you, to have it corrected or deleted, to object to or restrict its use, to receive a copy, and to complain to your data-protection authority. In the EU and the UK those rights come from the GDPR and UK GDPR. California residents have the corresponding rights under the CCPA, including the right not to be discriminated against for exercising them.
In the EU you may complain to the supervisory authority of your habitual residence or place of work; in the United Kingdom, to the Information Commissioner's Office. We reply within one month under the GDPR and UK GDPR, or forty-five days under the CCPA, and requests are free of charge.
Given how little the website holds, most requests resolve quickly: unless you have used the request-an-agent form, there is unlikely to be anything held about you that we can identify as yours.
To exercise any of these rights, or to ask anything about this notice, contact marketplace@kiteworks.com.
Controller and contact
Kiteworks USA, LLC, 1510 Fashion Island Blvd, Suite 100, San Mateo, CA 94404, United States. For privacy questions: marketplace@kiteworks.com.
Changes
This notice is versioned. The version and effective date at the top change whenever the wording does, and the marketplace terms are versioned separately at /legal/marketplace-terms.
Anonymous marketplace analytics
Analytics collection is enabled. The marketplace transiently processes request metadata, including raw IP address and full User-Agent, to derive the limited fields below.
Purpose: understand marketplace usage and improve install journeys.
Retention: 400 days. Access: authenticated marketplace administrators.
Daily visitor hash: derived transiently from IP, full User-Agent, host, and an in-memory random daily salt; the inputs and prior-day salt are discarded. It cannot be linked across days by this application.
Fields stored when analytics is enabled
- logical page path
- served locale
- coarse country
- referrer without query or fragment
- referrer domain
- acquisition channel
- coarse device, operating-system, and browser families
- primary language
- UTM source, medium, and campaign
- bot flag
- daily visitor hash
- AI-client selection, as an anonymous counter (free text if 'other')
- MCP-connector-installed confirmation, as an anonymous counter
Never stored by marketplace analytics or request logs
- raw IP address
- full User-Agent
- credentials
- Authorization header
- session cookie
Other processing
Administrator authentication, explicit agent requests, audit records, retention, and backup replication are documented in the repository data inventory.