Privacy Policy

Last updated: October 7, 2026

This Privacy Policy explains what information Kalulu Inc, a Missouri limited liability company ("Kalulu", "we", "us"), collects when you use Antivenom PromptWAF ("Antivenom" or the "Service"), including the API at https://antivenom-promptwaf.fly.dev, the website at https://antivenomwaf.com, the customer dashboard, and the public playground. It also explains how we use and share that information and the choices and rights you have.

1. Summary

We scan the text you send us and return a verdict. We do not store that text in full.
For each scan we keep metadata: a hash of the content, the verdict and score, and short excerpts of the specific text that triggered a detection rule.
We store a hash of your API key, never the key itself. Stripe handles card payments; we never see your full card number.
Our website has no analytics or advertising trackers.
We do not sell personal information.

2. Our role

When a customer sends content to the API for scanning, the customer decides what to send and why. For that content, and for the scan results tied to it, the customer is the controller and we act as a processor (or "service provider") on the customer's behalf. If you are an end user of one of our customers' applications, please contact that customer about your data.

We are the controller for account and API key information, billing information, website use, feedback reports, and our own use of scan metadata to secure and improve the Service.

3. Information we collect

Content you submit for scanning

This means prompts, model responses, datasets, and tool-call names and arguments you send to the API or the playground. We process it to produce a verdict. We do not write the full content to our database. It may be held briefly in server memory (for example, in caches that speed up repeated scans); it is not written to disk from those caches and is dropped when it is replaced by newer entries or when the server restarts.

Scan metadata we store

For each scan we store:

a request ID and the date and time;
a non-secret identifier for the API key used (the key's short prefix), or a shared "demo" marker for playground scans;
the scan type, the policy used, the risk score, and the verdict;
the length of the content and a one-way SHA-256 hash of it;
for dataset scans, the number of records;
the names of any obfuscation techniques detected, such as "base64" or "homoglyphs";
processing-time measurements and whether a cached result was used;
a two-letter country code supplied by Cloudflare, when the request reached us through Cloudflare (we do not store your IP address in our database);
the findings: each finding's category, confidence, and a short detail.

Finding details can include parts of your content. When a detection rule matches, the detail is the matched text, cut to at most 80 characters. Some other findings quote short items from your content, such as a few flagged words, role markers, an agent ID and tool name, or, for datasets, a repeated phrase and up to 50 record IDs. If you send personal data in scanned content, an excerpt of it could be stored this way.

We may compare the hash of new content with hashes of content previously blocked for any customer, to flag known attacks. Only hashes are compared; no customer's content is shared with another customer.

Conversation and agent signals

If you include a session_id with prompt scans, we store that session ID, your key identifier, and each message's risk score with a timestamp, to detect attacks spread across several messages. Only the last 30 minutes of a session are used, and older records are deleted by an automatic cleanup that runs periodically as new session scans arrive. If you include an agent_id with tool-call scans, we keep the agent ID and the tool names it has used in server memory, to spot unusual tool use; if a finding is raised, its detail names the agent ID and tool.

API keys

When you create a key, we store a SHA-256 hash of the key, its short prefix, an optional label, your plan, whether the key is revoked, which key it replaced (if rotated), and when it was created and last used. The full key is shown to you once and is not stored. Getting a free key does not require your name or email address.

Billing information

If you subscribe to a paid plan, Stripe collects your payment details and the billing information it needs, such as your name, email address, billing address, and, where applicable, tax ID. We store only your Stripe customer ID, subscription ID, plan, subscription status, and dates. We share with Stripe your key's non-secret identifier, your plan, and your monthly usage counts so that you can be billed correctly.

Feedback reports

If you report a false positive or false negative, we store the report type, the disputed category, any scan reference you give, your comment, the optional contact email you choose to provide, and the time.

Network and log information

To enforce rate limits on the playground (10 requests per minute), free-key signup (3 per day), and feedback (20 per hour), we use your IP address in server memory only. Our hosting and network providers, and our own server logs, may record IP addresses and request details (such as the URL path and time) as part of their normal operation.

Website

Our website uses no analytics, advertising, or tracking cookies. It saves your light or dark theme choice in your browser's local storage; this stays on your device. Our status page link opens a third-party site with its own privacy policy.

4. How we use information

We use the information above to:

provide the Service: scan content, return results, and show you usage in the dashboard;
meter usage, enforce plan limits, and bill you;
secure the Service: authenticate keys, enforce rate limits, detect abuse, and alert our team to unusual activity;
improve detection, for example by tuning thresholds and rules using verdicts, finding categories, and timings;
review feedback reports and respond if you gave us an email address;
comply with legal obligations and enforce our Terms of Service.

We do not sell personal information, and we do not use it for advertising.

We share information only with the service providers we use to run Antivenom, as described below, and only as they need it:

Fly.io: hosts our API servers and database (primary region: United States). It processes everything the API receives and stores.
Cloudflare: provides DNS and network services for antivenomwaf.com, and runs part of our detection at its global edge for requests sent to antivenomwaf.com/v1/scan/prompt. It processes the full request, including your content, at the location closest to you. Requests sent directly to antivenom-promptwaf.fly.dev do not pass through Cloudflare.
Vercel: hosts our website and relays other API requests made through antivenomwaf.com to our API servers.
Stripe: processes payments and subscriptions, as described in section 3.
Hugging Face: we run our machine-learning classifier on our own servers. However, the tool name and arguments of tool-call scans (when they total 800 characters or fewer) are sent to Hugging Face's Inference API for a second-opinion score. Prompt and response text is sent to Hugging Face only if our own classifier is unavailable.
Slack: receives our internal operational alerts, which may include an API key's non-secret identifier and request counts, but not scanned content.
GitHub: runs our scheduled maintenance jobs (such as usage reporting and alert checks). Their logs may include non-secret key identifiers and usage counts, but not scanned content.

If we turn it on, we may also forward scan metadata (not content or finding details) to a security-monitoring system that we operate.

We may also disclose information if required by law or to protect our rights, users, or the public, and to a successor if our business is merged, acquired, or sold, subject to this policy.

6. How long we keep information

Scan metadata and findings, API key records, billing records, and feedback reports: kept while your account is active and as long as needed for the purposes above. We do not currently delete these automatically after a set period. You can ask us to delete them at any time (see section 9); we may keep billing records as long as tax and accounting law requires.
Session-tracking records: used for 30 minutes, then removed by the periodic automatic cleanup described in section 3.
Content held in server memory and IP addresses used for rate limiting: kept only in memory, and dropped when replaced or when the server restarts.
Stripe and other providers: keep information under their own retention policies.

7. Security

All API traffic uses HTTPS. API keys are stored only as hashes, administrative functions require a separate key, and requests are rate-limited. No system is perfectly secure, and we cannot guarantee the security of information sent to us.

8. Children

The Service is for businesses and is not directed at children. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

9. Users in the European Economic Area and the United Kingdom

This section applies if the EU General Data Protection Regulation (GDPR) or the UK GDPR applies to our processing of your personal data.

Controller and processor. For the information described in section 2 as ours, Kalulu Inc is the controller. For content and scan results we process on behalf of a customer, the customer is the controller and we are its processor; we process that data only on the customer's instructions, as set out in our Terms of Service. Customers who need a data processing agreement can request one at [email protected].

Lawful bases. We rely on:

contract: to provide the Service, manage your API keys and subscription, and bill you;
legitimate interests: to secure the Service, prevent abuse, enforce rate limits, alert our team to problems, and improve detection, in ways that do not override your rights;
legal obligation: to keep tax and accounting records and respond to lawful requests;
consent: when you choose to give us your email address in a feedback report. You can withdraw consent at any time.

Your rights. You have the right to access your personal data, correct it, delete it, restrict or object to its processing (including processing based on legitimate interests), receive a portable copy, and withdraw consent at any time. To exercise these rights, email [email protected]. We will respond within one month. If your request is about content a customer sent us, we will pass it to that customer and help them respond.

International transfers. Kalulu is based in the United States, and our main servers are in the United States, so your personal data is transferred to and processed in the United States. Some providers, such as Cloudflare, also process data in other countries. Where we transfer personal data from the EEA or the UK to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses and, for the UK, the UK International Data Transfer Addendum, or on another lawful transfer mechanism.

Complaints. You have the right to lodge a complaint with your local data protection supervisory authority, or in the UK with the Information Commissioner's Office (ICO). We would appreciate the chance to address your concern first.

Contact. For any privacy question or request, email [email protected] or write to us at the address in section 12.

10. Other privacy rights

Depending on where you live, including some U.S. states, you may have rights to know about, access, correct, or delete your personal information, and to not be discriminated against for using these rights. We do not sell or share personal information for targeted advertising. To make a request, email [email protected].

11. Changes to this policy

We may update this policy. We will post the new version on this page and change the "Last updated" date. If a change materially affects how we handle your information, such as storing full scanned content, we will give notice on our website and, where we have your email address, by email before the change takes effect.

12. Contact

Kalulu Inc
7 Country Grove Court
Lake St. Louis, MO 63367
United States

Email: [email protected]