Skip to content
legal

Privacy Policy

Effective as of September 30, 2026.

This Privacy Policy explains how kenari handles personal data when you use kenari.id and its services. kenari is the data controller for your account data.

1. Who we are

kenari provides an LLM gateway, dashboard Chat, Pods, subscriptions, balance services, and domain registration services. kenari is the data controller for account data. Questions and requests can be sent to [email protected].

2. Data we collect

Account data

We collect your email address. If you create a password, we store only an argon2 hash of that password. If you choose Google sign-in, Google provides your email address, basic profile name, and OpenID sub. We do not request Gmail, Drive, contacts, or other Google data.

API usage

For requests made through the /v1 API, we store metadata including the selected model, input token count, output token count, cache token count, time, and cost. We do not store prompt or response content. Request content is forwarded to the selected model provider and is not stored by kenari after forwarding.

Dashboard Chat

Messages you send in dashboard Chat and the replies are stored on your account so you can reopen and search them. Deleting a conversation deletes those messages. Dashboard Chat is separate from the /v1 API.

Payment data

We collect payment and balance records such as the order number, amount, and service purchased. QRIS payments are processed through Pakasir. Crypto payments are completed on the OxaPay payment page. kenari does not store card numbers or payment credentials.

BYOK keys

When you use bring your own key, we store the provider key in encrypted form using AES-256-GCM. We decrypt it only to forward a request to the provider. Virtual API keys beginning with kn- are stored as hashes.

Pod data

For a Pod, we store application data such as history, files, and configuration on kenari servers while the Pod is active. We do not read Pod data unless needed for an incident or required by law. Sensitive Pod configuration, including API keys, is encrypted using AES-256-GCM. When you delete a Pod, or when it is deleted after the suspension grace period, all Pod data is permanently deleted.

Domain registration

For domain registration, we collect the registrant's name, email address, address, phone number, and organization if provided. We send this information to the domain registrar. A successfully registered .id domain publishes the registrant data in public WHOIS under PANDI rules.

3. How we use data

  • To authenticate you and maintain sessions.
  • To forward API requests to the selected model provider.
  • To measure usage and debit your balance.
  • To show usage, balance, account, and service information.
  • To send transactional email such as verification messages, password resets, and payment receipts.
  • To send marketing email. You can turn marketing email off in Settings. Transactional email will still be sent.
  • To store and provide access to dashboard Chat.
  • To register domains and publish .id WHOIS information where required.
  • To prevent abuse and protect the service, users, and providers.

kenari does not sell personal data and does not use personal data for advertising.

4. Third parties

AI model providers receive request content under their own privacy policies. Pakasir processes QRIS payments. OxaPay processes crypto payments, which are completed on the OxaPay payment page. Brevo or Mailketing sends email, with each message handled by the provider configured for that send. Google provides data when you choose Google sign-in. Cloudflare checks a Turnstile token during login and signup to reject automated sign-ups. The domain registrar receives domain registrant details. kenari servers are located in Europe.

These providers may process data under their own terms and privacy policies. kenari does not control their processing.

5. Cookies

kenari.id uses the essential, httpOnly kn_session cookie to keep you signed in. A Pod is served on its own domain and uses a separate kn_pod cookie. The Pod domain does not receive kn_session. Cookies are not used for advertising.

6. Retention and security

Account and usage data are kept while your account is active. Pod application data is stored while the Pod is active and is permanently deleted when the Pod is deleted by you or after the suspension grace period. You may request account data deletion by emailing [email protected].

Passwords are stored only as argon2 hashes. Virtual API keys are stored as hashes. BYOK keys and sensitive Pod configuration are encrypted using AES-256-GCM. kenari decrypts BYOK keys only to forward a request.

7. Your rights

You can access your account data and usage history in the dashboard, and you can update your email or password there. You may request deletion of your account data by emailing [email protected]. You can delete dashboard Chat conversations from your account. You can turn off marketing email in Settings, while transactional email continues to be sent. Rights that apply under Indonesian law are not limited by this Privacy Policy.

8. Changes to this policy

kenari may update this Privacy Policy. Material changes are notified by email or in the dashboard, and the effective date on the page is updated. Your continued use of the service after a change means you accept the updated policy.

9. Contact

For privacy questions or data requests, contact [email protected].