Privacy Policy

Effective date: October 28, 2026

Operator: TriKro LLC, doing business as Kromatic ("we," "us," "our")

This Privacy Policy describes how TriKro LLC, doing business as Kromatic, collects, uses, shares and retains information in connection with the Fermi service ("Service"): the REST API, the MCP server, and the web pages at fermi.kromatic.com.

1. Information We Collect

1.1 Account Information

When you create an account, we generate and store:

• A unique account identifier (account_id)
• A hashed API key (we do not store your API key in plain text after initial issuance)
• Account creation timestamp and credit balance

Creating an account through the API does not require an email address, password or name. Some optional features do collect more:

• Kromatic sign-in: if you connect through a Kromatic account (sign-in at api.kromatic.com), we store the account identifier ("subject") from your sign-in token, linked to your Fermi account.
• Purchases: if you buy credits, our payment processor, Stripe, collects your email address and payment details, and saves your card with Stripe so later credit purchases (for example through the buy_credits tool) can be charged without re-entering it. We store the Stripe customer identifier and purchase records; we never receive or store your full card number.
• Feedback: if you send feedback through the feedback tool or endpoint, we collect the message, your email address, your name if you give it, and your account_id. See section 1.6.

1.2 Content You Submit and Results

When you use the Service, we collect and store:

• The natural-language questions you submit
• Estimation parameters (tier, unit, horizon, coverage) and any free-text context or source material you include
• The estimation results returned to you, including reasoning summaries, assumptions and the web sources consulted
• Actual outcomes you later record against an estimate
• Credit transaction records (charges, refunds, balances)
• Request timestamps, idempotency keys and the stored responses used to replay idempotent requests
• Any callback URL you supply, to which we send results

Please do not include personal data about yourself or others in questions, context or source material. The Service treats them as estimation inputs, not as protected personal data, and sends them to the AI model providers listed in section 4.

1.3 Anonymous Usage Data

For unauthenticated (anonymous) requests, we collect:

• A fingerprint computed as a SHA-256 hash of the caller's IP address and user-agent string, used to enforce the free daily allowance
• A daily request count associated with that fingerprint
• For account-creation rate limiting, a SHA-256 hash of the caller's IP address
• The questions and results of anonymous estimates, linked to that fingerprint

We do not store the raw IP address in these records. The hashes are not salted, so they are pseudonymous rather than anonymous: someone holding a candidate IP address could test whether it matches. We therefore treat them as personal data, and delete fingerprints and their daily counts after 30 days. After that, anonymous questions and results are kept without the fingerprint, so they are no longer linked to the caller.

1.4 Arrival Attribution

The first time an account or anonymous fingerprint uses the Service, we record one attribution record so we can see which channels bring people to Fermi. It contains: the account identifier or anonymous fingerprint; the channel or referral code you arrived with (for example a ref parameter); the referring page; the user-agent string; the endpoint first called; the AI platform the request appears to come from (for example Anthropic, OpenAI or xAI); and the time. We infer the platform from the client name an MCP client sends when it connects and from whether the request comes from a network range published by that platform. The IP address used for that check is not stored in the record. We keep the user-agent string so we can see which client software (for example which MCP client, SDK or browser) people arrive with, and to check the platform classification. Arrival records are kept for 24 months; the anonymous fingerprint in them is removed after 30 days.

1.5 Server Logs

Our hosting provider's request logs record the IP address, request path and status code of each request. They are used for security and troubleshooting.

1.6 Feedback

Feedback messages are emailed to us through Mailchimp Transactional (Mandrill), with a copy sent to the email address you provide. They are not stored in the Service's database.

1.7 Web Analytics and Cookies

The Service's web pages (the homepage, the API documentation pages, this Privacy Policy and the Terms of Service) load Google Analytics 4 through Google Tag Manager. This sets first-party cookies and collects standard page-view and session data. Google Analytics is not loaded on the API (/api/v1/*) or MCP (/mcp/*) endpoints, so programmatic and AI-agent usage is not measured by it. The Service sets no other cookies.

2. Using Fermi Through Claude, ChatGPT, Grok or Other AI Assistants

When you use Fermi as a connector or app inside an AI assistant, the assistant's operator (for example Anthropic, OpenAI or xAI) is a separate, independent controller of your conversation. Its own privacy policy governs your chats with it. Fermi receives only what the assistant sends when it calls a Fermi tool (the tool arguments, such as a question and its parameters), the client name the assistant reports when it connects, and standard network metadata such as IP address and user agent. Fermi does not receive or request your conversation history or the assistant's memory.

3. How We Use Your Information

• Provide the Service: process estimation requests, manage your account, track credits and process purchases.
• Improve the Service: analyze estimates and recorded outcomes to improve estimation quality, calibration accuracy and reliability.
• Enforce limits and prevent abuse: apply the free allowance and rate limits.
• Measure where users come from: aggregate attribution reporting (section 1.4).
• Monitor errors: diagnose and fix technical issues.
• Respond to you: answer feedback and support requests.
• Comply with legal obligations: tax and accounting records, and lawful requests from public authorities.

No model training. We don't train AI models on your inputs, including your questions, context and source material.

Legal bases (EEA/UK users). We process personal data to perform our contract with you (providing the Service and processing purchases); for our legitimate interests in securing the Service, preventing abuse, measuring and improving it, and responding to feedback; with your consent where the law requires it for analytics cookies; and to comply with legal obligations.

4. Third-Party Service Providers

We share data with the following service providers, solely to operate the Service:

We do not sell, rent or trade your information, and we do not share it for cross-context behavioral advertising. We do not use advertising services. We may also disclose information when required by law or to protect the Service and its users.

5. Data Retention

• Account data, submitted content and results: kept until you delete your account. To delete it, email legal@kromatic.com with your account_id.
• Anonymous fingerprints and their daily counts: deleted after 30 days. Anonymous questions and results are kept without the fingerprint after that.
• Arrival attribution records: deleted after 24 months.
• Billing records: kept as long as required for tax and accounting purposes, even after account deletion.
• Feedback email: kept in our mailbox until no longer needed to handle your request.
• Error monitoring data: kept by Sentry under the retention period of our Sentry plan.
• Server logs: kept by our hosting provider for a limited period under its log-retention settings.

6. Data Security

We implement reasonable administrative, technical and physical safeguards to protect your information, including:

• API keys are stored only as keyed one-way cryptographic hashes
• All data in transit is encrypted via TLS
• Access to production systems is restricted to authorized personnel

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

7. Your Rights

Subject to applicable law, you may ask us to access, correct, delete or export the personal data we hold about you, and to object to or restrict its processing. Send requests to legal@kromatic.com with your account_id (or, for feedback or purchases, the email address you used) so we can locate your data. We may need to verify your request.

7.1 California Residents (CCPA/CPRA)

• Right to Know: request the categories and specific pieces of personal information we have collected about you.
• Right to Delete: request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Correct: request correction of inaccurate personal information.
• Right to Opt Out of Sale/Sharing: we do not sell or share your personal information for cross-context behavioral advertising, so there is nothing to opt out of.
• Right to Non-Discrimination: we will not discriminate against you for exercising any of these rights.

We will respond within 45 days, as required by law.

7.2 EEA and UK Residents

You have the rights listed above under the GDPR and UK GDPR, including data portability and the right to withdraw consent at any time. We will respond within one month. You may also complain to your local data protection authority.

8. Children

The Service is not directed to children. You must be at least 13 years old to use it. We do not knowingly collect personal information from children under 13. Because account creation does not require identifying information, we cannot determine users' ages. If you believe a child under 13 has provided us with personal information, contact legal@kromatic.com and we will delete it.

9. International Users

The Service is operated from the United States, and our service providers process data in the United States and possibly other countries. If you use the Service from outside the United States, your information will be transferred to, stored and processed in the United States, where data protection laws may differ from those of your country. For transfers of personal data from the EEA and UK, we rely on the standard data processing agreements, including their transfer terms, of our service providers: Fly.io, Anthropic, OpenAI, Sentry, Stripe, Mailchimp (Intuit) and Google.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Effective date" at the top of this page. Continued use of the Service after changes constitutes acceptance of the updated policy.

11. Contact Us

TriKro LLC, doing business as Kromatic
Privacy and deletion requests: legal@kromatic.com
General support: innovate@kromatic.com

This document was drafted with AI assistance (April 16, 2026; revised October 28, 2026).