Trust & Data Practices

1. What is actually live today

Kinobi is in early access. Some of what we describe on the home page exists and runs every day; some of it is in development. Here is the line between them, and we keep this table current.

2. Where our data comes from

Every fact in the graph stores the URL it came from and the timestamp it was read. If we cannot cite it, we do not keep it. Our sources:

What we never do: we do not scrape content behind logins, paywalls, or CAPTCHAs; we do not buy contact lists from data brokers; we do not use personal email addresses or home addresses; we do not collect special-category data.

3. How to opt out

You should not have to ask permission to be left alone, and you should not have to explain why. Either of these works:

• A whole domain — email the domain to ankit@kinobi.so and we will stop collecting from it and delete what we already hold for it.
• Yourself specifically — use the data request form, whatever your employer does.

We stop collecting within 7 days and delete existing records within 30. We keep a one-way hash of your identifiers afterwards for one purpose only: so that the next collection run does not silently add you back.

4. Accuracy, citations, and being wrong

Automated extraction gets things wrong. Ours will too. What we commit to:

• Every fact is cited. Each record carries its source URL and read date, so you can check it rather than trust us.
• Every fact has an age. We show when something was last verified. Stale records are re-checked or dropped, not quietly kept.
• Inference is labelled as inference. Technology detected from a DNS record is a signal, not a confirmed purchase, and we mark it that way.
• Scores are not facts. Path and fit scores are model output. We show what went into them and we do not present them as ground truth.
• Corrections are free and fast. Anyone — customer or not — can report an error at ankit@kinobi.so, and we fix or remove within 30 days.

5. How we use AI

Kinobi uses large language models to read public web pages and turn them into structured, cited records, and to power search over that structure. Concretely:

• Models see public page content that our crawler fetched, and customer queries.
• Our model providers are contractually barred from training on data we send through their APIs.
• We do not sell or license personal data to anyone for model training.
• Model output is never the final word on a person: automated processing does not produce legal or similarly significant effects about individuals, and we do not make automated decisions about anyone’s employment, credit, housing, or insurance.
• Extraction errors are treated as defects — see section 4.

6. Subprocessors

These providers process data on our behalf. The list below is current as of the date at the top of this page. We will post changes here at least 14 days before a new subprocessor starts processing customer data — to be notified, or to request our current list in writing, email ankit@kinobi.so.

7. Security posture

We are early-stage, so we will tell you plainly what we have and what we do not.

What we do today

• TLS 1.2+ everywhere in transit; encryption at rest for databases and backups
• Multi-factor authentication required for all production and cloud-console access
• Least-privilege access to production data, logged and reviewed
• Secrets in a managed secret store — never in source control
• Automated dependency and vulnerability scanning on every change
• Strict Content-Security-Policy, HSTS, and hardened response headers on this site — no third-party scripts can execute
• Daily encrypted backups with periodic restore tests

What we do not have yet

• No SOC 2 Type II, ISO 27001, or HIPAA attestation
• No third-party penetration test yet published
• No formal 24/7 on-call rotation — we are a small team, and incident response is best-effort during business hours plus paging
• No customer-facing status page yet

If your procurement process requires any of the above, tell us before you invest time — we would rather lose a deal than misrepresent our posture.

Reporting a vulnerability

Email ankit@kinobi.so with “Security” in the subject, or see security.txt. We acknowledge within 3 business days. We will not pursue legal action against good-faith research that respects user privacy, avoids service degradation, and gives us reasonable time to fix.

Incident notification

If personal data we hold is breached, we notify affected customers without undue delay and within 72 hours of becoming aware, and we notify regulators where required.

8. Who is behind Kinobi

Kinobi is built by Ankit Pansari and operated by Kinobi, Inc., a Delaware corporation, from San Francisco. There is no anonymous team behind this — if something we do is wrong, there is a named person to hold responsible.