Privacy policy

Who we are

Kanon Labs writes clause-traced evaluation tasks for audit, QA/QC and safety, and vets the experts who write them. The contact for privacy requests is hello@kanonlabs.co.

What we collect

We collect what the forms and the client login ask for, and a visit count that does not name the person.

• Client request. Name, work email, company, what you need, the disciplines you name, and the brief you write.
• Expert application. Name, email, discipline, years of practice, the credentials and the profile link you give us, and your answers on a discipline paper when that paper is open.
• Client login. The email address used for the sign-in link, and the licence on that account: organisation, pack, dates.
• Spam check. A honeypot field that people leave blank, and, when it is switched on, a Cloudflare Turnstile token. The token is a check that the sender is a person. It is not the contents of the form.
• Visit count. The page, the site that referred the visit, the browser, and a coarse location such as country. This is not a name, and it is not tied to a form.

We do not ask for a date of birth, a government identifier, or payment card details. Payment is by invoice, outside this form.

Why

• To reply to a request for a sample, a scorecard, a pack, a licence, grading, or a pod.
• To decide an expert application: credential check, the written paper, and the later gates.
• To give a signed-in buyer the pack their licence covers, and to keep them out of packs it does not cover.
• To keep a record of what was agreed, for as long as the tax and licence records need it.
• To see which pages are used, and which sites send people here.

A failed paper is stored as a rejected application. The correct answer is not sent back.

Who else sees it

The form contents are stored in Supabase and emailed to Kanon Labs. Those two processors, and Cloudflare when the spam check is on, are the only ones who handle the record in the ordinary course.

• Supabase stores the form rows, the login, and the licence. The project may sit outside Australia.
• Resend sends the alert email to Kanon Labs. It may process that email outside Australia.
• Cloudflare checks the Turnstile token when the keys are set.
• Vercel hosts the site and keeps the visit count. That count is not sold and is not used to build an advertising profile.

We do not sell personal information. We do not use it to train a model. A buyer’s model outputs, if they send them for a scorecard, are used to write that scorecard and are kept with the request.

How long

Enquiries and applications that do not become a licence or an engagement are kept for 24 months from the last contact, then deleted. Licence and invoice records are kept for the licence term and then seven years. You can ask for deletion sooner where we do not still need the record for a licence, a dispute, or the tax law.

Access and correction

Write to hello@kanonlabs.co to ask what we hold about you, to correct it, or to ask for deletion. We will answer within 30 days. If you think we have handled it wrongly, you can also contact the Office of the Australian Information Commissioner.

The site

The visit count is first-party and does not use an advertising tracker. The login uses a cookie to keep the session. You can use the sample tasks on the homepage without an account.