How Karg handles your data

What happens to your files, who can access them, and the choices you have. A plain-English summary of our Data Handling and Retention Policy.

Policy effective August 26, 2026

What we use your data for

Customer Data includes files you upload or connect through a database, their values, and the previews, outputs, records, and logs created while processing them. Karg uses it to provide the cleaning service you request.

• We work on a copy and preserve your original during the job. Deterministic rules and Karg's own models handle values first; unresolved values may go to third-party AI for suggestions.
• Karg does not sell Customer Data or share it for advertising. Third parties receive data only to provide the services described here, subject to your AI preferences.
• Whole files are never used to train models. Customer Data is never used for third-party model training; Karg's own model improvement is limited to Review Labels you explicitly opt in to retain.

Retention and deletion

The standard 72-hour rule applies to active systems. Database backup expiry, templates you save, and consented Review Labels have separate rules, so deleting a job does not mean every copy disappears at that moment.

Completed or failed jobs

Files, outputs, logs, and associated Customer Data are deleted from active systems within 72 hours after the job completes or fails.

Later steps on the same job

Finalizing a review, exporting results, or refreshing them is a further step on the same job, and the 72-hour window is counted from the latest step to complete or fail. Later steps cannot extend it indefinitely: unless it is still processing, a job is deleted from active systems no later than 95 hours after it was created.

Uploads never processed

Deleted from active systems within 72 hours of upload.

Saved templates

A template you save keeps its cleaning rules until you delete it, including any value mappings, which can contain values from your file. It is not deleted with the job it came from; example values copied from that job are removed when the job is deleted. Templates are available only to your organization.

Stalled jobs

A job with no processing progress for 24 hours is marked failed, then enters the 72-hour deletion window. Jobs cannot remain running indefinitely.

Deletion on request

Inactive jobs are deleted from active systems immediately. For a running job, the request is recorded and deletion takes place when processing stops or finishes.

Database backups

Deleted database records may remain in backups for up to seven additional days. Backups are not used for normal processing or training; deletions are reapplied after a restore before normal use resumes.

• Deletion removes stored files and confirms they are gone before removing the associated active database records. A seven-day file cleanup safeguard catches residual job files; it does not extend the 72-hour deadline. We do not retain backup or versioned copies of job files.
• Workspace settings may shorten retention. They cannot extend it or disable the seven-day safeguard. Longer retention requires an explicit written customer agreement defining its scope and duration.
• On request, and automatically after active-system deletion for managed engagements, confirmations identify the job, deletion time, file and record counts, any retained opt-in Review Labels, and the latest database backup expiry. Confirmations contain no Customer Data. Managed email and local-copy cleanup are handled separately below.
• Account information is retained while your account is active and as required for billing or legal obligations. Operational metadata without Customer Data may remain for operations, billing, and proof of deletion.

Your choice on model improvement

Review Labels are a subset of Customer Data: an original value, the proposed change, and the final decision. They can contain personal or confidential information, even though they do not include the rest of the file.

• Training is opt-in. An authorized customer representative must explicitly consent before Review Labels are retained for Karg's model improvement. We record that consent and its scope.
• Without consent, labels are used only to review the job, never for model training, and are deleted with the job. A pre-processing opt-out prevents training use.
• Consented labels are stored in Supabase and accessible only to authorized Karg personnel working on model improvement. They are not sold or provided for third-party training.
• Consented labels have no fixed maximum retention period. We keep them until you withdraw consent or they are no longer needed. They are then deleted from active systems within 72 hours, with database backups expiring up to seven additional days later.
• Deleting a job alone does not withdraw consent for retained labels. Contact us to withdraw it. Withdrawal stops future training use; the standard process does not remove the influence of labels already used to train a model.

How third-party AI is used

Only unresolved values and the context needed to interpret them, such as a column name or cleaning instruction, are sent for inference. Entire files are not sent to AI providers.

• OpenRouter routes requests to endpoints hosting the open-weight DeepSeek v4 Flash and Pro and Kimi K3 models. DeepSeek models run only on independent hosts; Karg does not use DeepSeek's own API or services. You can also plug in your own API keys; requests sent with your key are covered by your own agreement with that provider.
• Requests are restricted to ZDR-classified endpoints under OpenRouter's zero data retention policy, with per-request ZDR enforcement and data collection denied. Providers do not train on these prompts or outputs.
• Account-level ZDR is enabled. Prompt and output logging, response caching, and third-party training are disabled, and settings are checked before use and after changes. We do not use plugins or tools that store Customer Data outside these controls.
• ZDR classification permits provider-side in-memory prompt caching. It does not guarantee immediate clearing of memory after a request. Eligibility is assessed at the endpoint level, rather than treating every service from a listed provider as zero retention.
• If no eligible endpoint is available, the AI step fails instead of relaxing the retention requirements.
• Tell us before processing if you want to opt out of third-party AI. We will confirm whether a mode using rules and Karg's own models is suitable; it may resolve fewer irregular values.

Isolation and access controls

Each organization's data is separated from other organizations. Access is limited to signed-in members of your organization and authorized Karg personnel providing the service.

• Organization authorization is checked on every Customer Data request, with database row-level security and automated checks for non-public routes and cross-organization access.
• Staff may access Customer Data only to run the service, review uncertain items, provide support, troubleshoot, or meet legal obligations. Access to retained training labels is limited separately as described above.
• Connections between your browser, Karg, and service providers use HTTPS. High-cost and abuse-prone actions are rate-limited, and secrets are kept outside source code.
• Application logs are designed to exclude customer values, prompts, and model outputs.

Where data is handled

Karg uses managed infrastructure for storage, processing, accounts, and billing. Different services handle different parts of the workflow.

• The Supabase database is hosted in AWS us-east-1, Northern Virginia, and Karg's processing engine runs in US East, Virginia. R2 file storage uses the Eastern North America (ENAM) location; this is not a promise that all Customer Data stays in the United States.
• Managed email messages and attachments are stored through Zoho Mail and follow the mailbox deletion windows below. This summary does not make a US-only email storage commitment.
• AI processing occurs at the independent endpoint selected through OpenRouter. Zero data retention does not establish a processing location, and the policy does not guarantee US-only AI processing.

Google Cloud

Processing engine and temporary files during a job.

Supabase

Job, transformation, and review records, plus Review Labels retained with customer consent.

Cloudflare R2

Uploaded files, outputs, and audit logs.

OpenRouter

Limited values and context routed to eligible AI inference endpoints.

Zoho Mail

Messages and attachments for managed email processing.

Vercel · Clerk · Stripe

Frontend hosting, account authentication, and billing respectively. Customer Data is not stored in the frontend or sent to Clerk or Stripe.

When we process files for you

By mutual agreement, you can send a file by email or share a file link without creating an account. We process it in a separate workspace, review uncertain values, and return results through the agreed channel.

• Email is typically encrypted in transit, but is not end-to-end encrypted. You can use an encrypted file with a separately shared password or a suitable file-sharing link instead.
• Original email messages and attachments are deleted from all Karg mailbox folders, including trash, within 24 hours of upload to the platform. Sent results and their attachments are deleted from all folders, including sent mail and trash, within 24 hours of sending.
• Temporary local copies needed to prepare or deliver results are deleted as soon as delivery is complete. Files and records in the platform still follow the job retention rules above.
• Copies in your own inbox, downloads, or storage remain under your control.

Your results, with a record of changes

You can see what changed and why, then take your results with you. Uncertain values go to human review instead of being guessed.

• Export cleaned data in the original format, CSV, XLSX, or JSON, with an audit log showing the column, change, and reason.
• Signed download links expire after one hour by default, with a maximum of 24 hours. Link expiry is separate from deletion of the underlying files.
• Download the files you need before retention expires. Share only the minimum data needed, manage your organization's access, and protect the copies you keep.

Scope and compliance

Karg is an early-stage, student-founded service. This page summarizes our policy commitments and does not represent an independent security certification.

• Karg does not currently hold SOC 2, ISO 27001, or other security certifications, and does not claim HIPAA compliance. Do not submit data that requires certifications or compliance Karg does not have.
• Do not submit health information, payment card numbers, Social Security numbers, government identification numbers, or bank account numbers.
• We can review confidentiality or data processing terms before you submit data. The policy becomes part of a customer agreement only when explicitly incorporated in writing.

Questions, requests, and incidents

Contact us before uploading if you have specific confidentiality requirements, want to discuss AI preferences, or need help with deletion or training consent.

• If a confirmed security incident affects Customer Data, we notify affected customers without undue delay and no later than 72 hours after confirmation, describing the incident, data involved, and our response.
• The policy is reviewed every six months and after relevant system changes. We notify customers of material changes beforehand where practical.

Try Karg on your own data.

Request platform access to run it yourself, or ask our team to clean it for you. Contact us first if you want to discuss your data requirements.