Privacy Policy
Updated 22 October 2026
This page explains what personal data we process, why, for how long, and how to exercise your rights. We process only what Kernel Security needs to work, and we never sell it.
Who is responsible
The data controller is José Manuel Ramírez Sánchez, founder of Kernel Security, based in Galicia, Spain. For anything about your data, write to [email protected].
What we process and why
You ask for a demo or investor information
- Data
- Email, request type, message and the page you wrote from
- What for
- To reply and send you what you asked for
- Legal basis
- Your request (GDPR art. 6(1)(b))
- How long
- Up to 12 months after the last contact, or until you ask us to delete it
You have a Kernel account
- Data
- Name, email, organization and the public key of your Kernel ID
- What for
- To give you access and provide the signing service
- Legal basis
- The service contract (GDPR art. 6(1)(b))
- How long
- While the account is active
You sign content
- Data
- The signing record (author, organization, date and a fingerprint of the content) and the signed file, so you can download it
- What for
- So anyone can later check who signed it
- Legal basis
- The service contract (GDPR art. 6(1)(b))
- How long
- While the content must remain verifiable, or until you delete it from your console
You verify a file
- Data
- The file you upload
- What for
- To check whether it carries a Kernel signature
- Legal basis
- Your request (GDPR art. 6(1)(b))
- How long
- Deleted as soon as the check ends; we don't keep it
You visit the site or use the service
- Data
- IP address and technical logs of each request
- What for
- To protect the service, apply usage limits and stop abuse
- Legal basis
- Legitimate interest in the security of the service (GDPR art. 6(1)(f))
- How long
- About two weeks
You visit the site
- Data
- Page views, as aggregate data, without cookies and without identifying you
- What for
- To learn which parts of the site are used, to improve them
- Legal basis
- Legitimate interest (GDPR art. 6(1)(f))
- How long
- Only aggregate data is kept
What people who verify can see
When someone verifies a file you signed, they see the name and organization of your Kernel ID. That is the point of the service: proving who published a piece of content. Your email is not shown.
Your private key never reaches us
The key you sign with is created in your browser and never leaves it. We don't have it and can't recover it.
Who helps us run the service
The servers, the database, sign-in and the analytics are our own. We also rely on these providers, which process data only on our behalf:
- IONOS: server hosting, in Spain.
- Cloudflare: the site's delivery and protection network. It may process data outside the European Union under the EU-US Data Privacy Framework and the European Commission's standard contractual clauses.
- Brevo: sending the service's emails, from the European Union.
Your rights
You can ask to access, correct or delete your data, object to or restrict its processing, or take your data with you. Write to [email protected] and we'll reply within one month. If you think we haven't handled your request properly, you can complain to the Spanish Data Protection Agency (aepd.es).
What we store in your browser is explained in the cookie policy.
Changes
If we change this policy, we'll update the date above and, if the change matters, we'll tell you.