Privacy Policy

Last updated 2026-08-01

This policy explains what Kipple Labs, Inc. ("Kipple Labs", "we") collects and stores when you visit kipplelabs.com or use Owyhee, our hosted agent governance service at console.kipplelabs.com, and what we do with it. It also covers the related hosted services we operate, including the AXIS Prime agent identity registry.

1. What we collect

Account data

• Your email address and name, received from your sign-in provider when you sign in with single sign-on. Authentication is handled by our identity platform; we never see or store your password.
• Your organization membership inside Owyhee: which organization your account belongs to and your role in it.

Credentials you place in custody

• Owyhee's core feature is credential custody: you hand it the API keys and credentials your agents use, and it holds them so your agents do not. Those credentials are stored encrypted at rest with per-organization encryption keys (envelope encryption backed by a cloud key management service).
• We use custodied credentials only to execute the actions you have authorized your agents to take. We do not read, mine, or use them for any other purpose, and staff access to production systems is restricted and logged.

Agent activity records

• Owyhee records what your agents do through it: which agent acted, under what permission, when, what it cost, and whether it was allowed or denied. This audit trail is the product. You see it in your console, and it is retained per your plan (see pricing).
• We also keep standard service and security logs (IP addresses, request metadata) to operate the service and prevent abuse.

Agent registry data (public by design)

• Agents governed through Owyhee are registered in the AXIS Prime identity registry. Registry records (agent name, agent ID, operator, public keys, and revocation status) are published publicly. That is what lets other platforms verify your agent. Do not put anything in an agent name or profile that you do not want public.

Email

• We send transactional email (sign-in, security, and service notices) through an email delivery provider, which processes your email address for that purpose.

Website visits

• kipplelabs.com runs no advertising trackers and no third-party analytics scripts. Our hosting providers keep standard server logs.
• Pages on this site load fonts from Google Fonts, which means Google receives your IP address when a page loads.

What we do not collect

• No payment information. Owyhee is currently free and we have no billing system; we do not collect card numbers or payment details.
• We do not collect your agents' conversations or prompts. We see the calls your agents route through Owyhee, because governing those calls is the service, and nothing beyond that.
• We do not sell or rent personal data, and we do not use your data to train models.

2. How we use it

• To operate the service: authenticate you, hold credentials in custody, enforce the permissions you set, and record the audit trail you rely on.
• To secure the service: rate limiting, abuse prevention, and investigating violations of the Terms of Service.
• To contact you about the service: security notices, breaking changes, and, with a clear opt-out, product updates.

3. Who processes it

Your data is processed by the infrastructure providers that run the service under contract with us, on our instructions:

Provider	What for
Amazon Web Services	Hosting, database, and key management for the Owyhee service (US West region).
Cloudflare	Serving our websites and the public registry.
WorkOS	Single sign-on and authentication.
Resend	Transactional email delivery.

Beyond these providers, we share personal data only when the product is designed to (public registry records, as described above) or when we are legally required to disclose it, in which case we will tell you unless we are prohibited from doing so.

4. Retention

Data	Kept
Account data	While your account is active; deleted within 30 days of account deletion.
Custodied credentials	Until you remove them or delete your account; destroyed on removal.
Agent activity records	Per the retention period of your plan (see pricing).
Public registry records	Registration and revocation records persist even after account deletion, because platforms must be able to check that a credential was revoked. Personal details are removed; the cryptographic record remains.
Service and security logs	Up to 12 months, then deleted or anonymized.

5. Security

Custodied credentials are encrypted at rest with per-organization keys. Customer data is isolated per organization at the database layer. Transport is TLS everywhere. Access to production systems is restricted and logged. Owyhee is a young product and we say so plainly: we take custody seriously because custody is the product, but we do not yet hold formal security certifications and we will not claim otherwise.

6. Your rights

• You can access, correct, export, or delete your account data. Some of this is self-service in the console today; for the rest, email us and we will do it.
• You can remove any custodied credential and revoke any agent at any time from your console.
• Depending on where you live, you may have statutory rights to access, correct, delete, or port your personal data, or to object to certain processing, under laws such as the GDPR or the CCPA. To exercise them, email [email protected] and we will honor them.

7. Children

Our services are built for professional use and are not directed to children. We do not knowingly collect personal data from anyone under 16.

8. Changes

We will post updates to this policy here with a new "last updated" date, and we will email account holders about material changes before they take effect.

9. Contact

Privacy questions and rights requests: [email protected]. Kipple Labs, Inc., Washington, USA.