Cookie Policy

Introduction

KLNR Labs P.S.A. ("KLNR", "we", "us" or "our"), a Polish prosta spółka akcyjna seated in Gdańsk, Poland, acts as the single data controller for the KLNR group of websites and products, including the master site klnr.ai and the products Search, Lexor, FRRE.ai, Sign, Comms, CoLab, AgentOS and Bill (together, the "Services").

This Cookie Policy describes how we, our service providers and our business partners use cookies and similar technologies — such as web beacons, pixels, tags, software development kits (SDKs), local storage and device identifiers (collectively, "cookies") — when you visit our websites, sign in through our single sign-on ("klnr-gate"), or otherwise interact with the Services.

Capitalised terms that are not defined in this Cookie Policy have the meaning given to them in our Privacy Policy. This Cookie Policy supplements, and should be read together with, that Privacy Policy. Where there is a conflict between this Cookie Policy and a product-specific notice or a separate agreement that governs a particular Service, the more specific document prevails for that Service.

Our approach. KLNR is built on an "evidence, not words" philosophy: AI assists, while a qualified human authors and decides. Consistent with that, we use cookies that are necessary to operate the Services, and we use optional cookies only where you have given consent (in the EU/EEA/UK) or where you have not opted out (in the United States). We do not use cookies to train artificial-intelligence models on client or legal content, and we design our cookie practices to respect professional secrecy and attorney–client privilege.

What are cookies and similar technologies?

A cookie is a small text file that a website places on your device (computer, tablet or mobile) when you visit it. Cookies are widely used to make websites work, to make them work more efficiently, and to provide information to the operator of the site.

We also use technologies that function similarly to cookies, including:

• Web beacons / pixels / tags — tiny graphics or snippets of code embedded in pages or emails that record whether content was viewed or interacted with.
• Local storage — data stored by your browser (for example, HTML5 local storage or IndexedDB) that lets us remember your preferences and keep you signed in.
• Software development kits (SDKs) and device identifiers — used within apps and integrations to recognise a device or session.

Cookies may be:

• First-party (set by KLNR) or third-party (set by a service provider or business partner acting on our behalf or under their own terms);
• Session cookies (deleted when you close your browser) or persistent cookies (remaining for a defined period or until you delete them).

How KLNR uses cookies

We use cookies and similar technologies to:

• operate, secure and authenticate the Services, including through klnr-gate single sign-on;
• detect, prevent and investigate fraud, abuse and malicious activity, and to protect the integrity of the Services;
• remember your settings, language and preferences;
• understand how the Services are used so that we can maintain, improve and develop them;
• measure the performance and reliability of our pages and features; and
• where permitted, promote our products to people who may be interested in them and measure the effectiveness of those efforts.

We group cookies into three categories — Necessary, Analytics and Marketing — described below. A detailed inventory of the specific cookies we set, their providers, purposes and retention periods is set out in the Cookie Table further down this page.

Categories of cookies we use

1. Necessary cookies (always active). These cookies are essential for the Services to function and cannot be switched off in our systems. They are typically set in response to actions you take, such as signing in, setting your privacy preferences, or completing a form. Examples include authentication and session cookies, single sign-on (klnr-gate) cookies, security and fraud-prevention cookies, load-balancing cookies and cookies that record your cookie-consent choices. Because these cookies are strictly necessary, we rely on them without consent (in the EU/EEA/UK) and they are not subject to opt-out (in the US). If you block them, parts of the Services may not work.

2. Analytics cookies (optional). These cookies help us understand how visitors use the Services — for example, which pages are visited, how often, and whether errors occur — so that we can measure and improve performance and usability. The information is used in aggregated and, where feasible, pseudonymised form. We set Analytics cookies only with your consent (EU/EEA/UK) or where you have not opted out (US).

3. Marketing cookies (optional). These cookies, often set by our advertising and business partners, are used to deliver content and advertising that may be relevant to you, to limit how often you see an ad, to measure the effectiveness of campaigns and to provide aggregated reporting. They may be used to build a profile of your interests across sites. We set Marketing cookies only with your consent (EU/EEA/UK) or where you have not opted out, including in response to a valid opt-out signal (US). Use of these cookies for cross-context behavioural advertising may constitute a "sale" or "sharing" of personal information under certain US state laws (see the United States supplement below).

Cookie Table

The table below lists the cookies and similar technologies used across the Services. It is a placeholder and will be completed and kept up to date following our cookie audit. [Cookie inventory to be finalised.]

Because cookies may change as we add or update features and partners, this table may not always list every cookie at every moment. For the most current view, use the cookie preference centre accessible from the "Cookie settings" link in our website footer.

Third-party cookies and partners

Some cookies are placed by third parties that provide services to us or with whom we partner — for example, analytics providers, content delivery networks, security and anti-fraud vendors, and advertising and measurement partners. These third parties may receive information about your use of the Services and may combine it with other information they hold, in accordance with their own privacy notices.

Where third parties act on our instructions and only on our behalf, they are our processors / service providers. Where a third party determines its own purposes for the data it collects through its cookies, it acts as an independent controller (EU/EEA/UK) or as a third party / recipient (US), and you should review that party's own policy. We do not control, and are not responsible for, the content of third-party policies, but we list our principal cookie partners and link to their notices in the Cookie Table. [Third-party links to be inserted.]

Managing your cookie settings

You can control cookies in several ways:

• Cookie preference centre. Use the "Cookie settings" link in our website footer to review categories and to give or withdraw consent (EU/EEA/UK) or to exercise opt-out choices (US) at any time. Your choice is stored in a Necessary cookie so we can honour it on future visits.
• EU/EEA/UK consent banner. When you first visit from these regions, a consent banner lets you "Accept all" or "Reject all" with equal prominence, or make granular choices by category. See the European Union, EEA and United Kingdom supplement below.
• United States "Your Privacy Choices". If you are in the US, use the "Your Privacy Choices" link in our footer to opt out of Analytics and Marketing cookies and of any "sale" or "sharing" / targeted advertising. See the United States supplement below.
• Browser controls. Most browsers let you view, block or delete cookies and clear local storage through their settings. General guidance is available at aboutcookies.org and allaboutcookies.org. Note that blocking all cookies — including Necessary cookies — may prevent parts of the Services from working, including sign-in.

Consent: EU opt-in and US opt-out

We operate a dual consent model so that we comply with both EU and US requirements:

EU/EEA/UK — prior opt-in. For visitors in the EU, EEA and the UK, we set optional cookies (Analytics and Marketing) only after you have given your consent. Until you choose, non-essential cookies and similar technologies are blocked ("prior blocking"); only Necessary cookies are active. Our banner offers "Accept all" and "Reject all" options of equal prominence (same visual weight, no pre-ticked boxes), together with the ability to accept or reject by category. You can withdraw or change your consent at any time, as easily as you gave it, via the cookie preference centre.

United States — opt-out. For visitors in the United States, optional cookies may operate by default, and you may opt out at any time using the "Your Privacy Choices" link, our cookie preference centre, or a recognised opt-out preference signal such as Global Privacy Control (GPC).

Global Privacy Control (GPC) and Do Not Track

Global Privacy Control (GPC). GPC is a browser- or extension-based signal that communicates a user's choice to opt out of the sale or sharing of personal information and of targeted advertising. Where required by applicable US state law, we treat a valid GPC signal as a request to opt out of "sale"/"sharing" and targeted advertising for the browser or device from which it is sent, and — where we can reasonably associate it with you — for your account. Because a GPC signal is tied to a specific browser or device, you may need to enable it on each browser and device you use.

Do Not Track (DNT). There is no common industry standard for how websites should respond to browser "Do Not Track" signals. For that reason, KLNR does not currently respond to DNT signals. We do, however, honour GPC and the opt-out choices described in this Cookie Policy.

European Union, EEA and United Kingdom supplement

This supplement applies to visitors in the European Union, the European Economic Area and the United Kingdom and prevails over any conflicting statement elsewhere in this Cookie Policy for those visitors.

Legal basis. Storing or accessing information on your device through non-essential cookies requires your prior consent under the ePrivacy rules (as implemented in national law, including Polish law) and is processed under the General Data Protection Regulation (GDPR) / UK GDPR. Necessary cookies that are strictly required to provide a service you have requested do not require consent. We rely on your consent as the legal basis for Analytics and Marketing cookies, and we rely on our legitimate interests and/or the necessity of performing our contract with you only for strictly necessary processing.

Consent mechanics. Non-essential cookies are blocked until you act on the banner. Consent is freely given, specific, informed and unambiguous; "Accept all" and "Reject all" are presented with equal prominence; no boxes are pre-ticked; and we record and time-stamp your choice. You may withdraw consent at any time through the cookie preference centre, with effect for the future.

Your rights. Subject to applicable law, you have the right to access, rectify, erase, restrict or object to processing, the right to data portability, and the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO), and in the UK, the Information Commissioner's Office (ICO). To exercise your rights, contact us using the details below.

International transfers. Some cookie partners may process data outside the EEA/UK. Where they do, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum / International Data Transfer Agreement) and applicable adequacy decisions. [Transfer mechanisms to be confirmed per partner.]

Data Protection Officer. Our Data Protection Officer / contact for data protection matters can be reached at [dpo@klnr.ai]. [DPO details to be confirmed.]

United States supplement (CCPA/CPRA and other state laws)

This supplement applies to visitors in the United States and prevails over any conflicting statement elsewhere in this Cookie Policy for those visitors. It addresses the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), and comparable state privacy and consumer-protection laws (including, for example, those of Virginia, Colorado, Connecticut, Utah, Texas, Oregon and Montana).

Sale / sharing and targeted advertising. Our use of Marketing (and certain Analytics) cookies may involve the disclosure of identifiers and online activity to advertising partners in a way that may be considered a "sale" or "sharing" of personal information, or "targeted advertising" / "cross-context behavioural advertising", under these laws. We do not knowingly sell or share the personal information of consumers we know to be under 16 without authorisation.

Your Privacy Choices. You can opt out of such sale/sharing and targeted advertising using the "Your Privacy Choices" link in our footer, the cookie preference centre, or by sending a recognised opt-out preference signal such as Global Privacy Control (GPC), which we honour as described above. We do not respond to Do Not Track signals.

Your rights. Depending on your state, you may have the right to know/access, to delete, to correct, to obtain a copy/portability, to opt out of sale/sharing and targeted advertising, to limit the use of sensitive personal information, and to be free from discrimination for exercising your rights. You may use an authorised agent where the law allows. We will verify requests as required and respond within the timeframes set by applicable law.

How to exercise your rights. Submit a request through the "Your Privacy Choices" link or by contacting us at [privacy@klnr.ai]. [State-specific request channels and metrics to be added.]

Changes to this Cookie Policy

We may update this Cookie Policy from time to time to reflect changes in technology, law, our Services or our practices. When we make material changes, we will take appropriate steps to notify you — for example, by posting a notice on the Services or, where required, by re-presenting the consent banner — and we will update the "Effective date" below. We encourage you to review this page periodically.

Effective date: [effective date].

Contact us

If you have questions about this Cookie Policy or our use of cookies, you can contact us at:

• General enquiries: [kontakt@klnr.ai]
• Privacy and data protection: [privacy@klnr.ai]
• Data Protection Officer: [dpo@klnr.ai]
• Security: [security@klnr.ai]

Controller: KLNR Labs P.S.A. (prosta spółka akcyjna), seated in Gdańsk, Poland.
Registered office: [address].
KRS: [KRS] · NIP: [NIP] · REGON: [REGON] · Share capital: [share capital].