Privacy Notice
Three different things carry three different answers: this website, the sandbox, and a KRISID installation running inside your own estate. We would rather separate them than give you one paragraph that is true of none of them.
Last updated: 23 October 2026
The short version
This website collects nothing about you beyond the request logs any web server keeps. The sandbox holds the email address you sign up with and whatever you type into it. A KRISID installation in your own estate holds your data under your control, not ours — in that arrangement you are the controller and we are not a processor at all unless you separately engage us for support.
1. This website
krisid.com is a set of static files. It sets no cookies, uses no local or session storage, runs no analytics of any kind, and loads no fonts, scripts, images or trackers from any third-party domain. There is no contact form and no newsletter sign-up, so there is nothing for you to submit.
You can verify all of that from your browser's network and storage panels, which is why we state it rather than ask you to trust it. It is also why you have not been shown a cookie banner: there is nothing to consent to.
What is unavoidably recorded
The site is served by Firebase Hosting, operated by Google. Like any web server, it records requests — IP address, timestamp, the page requested, your browser's user-agent string — for delivery, security and abuse prevention. We do not use these logs to build profiles, and we do not combine them with anything else.
| Processor | Purpose | Where |
|---|---|---|
| Google (Firebase Hosting) | Serving the website; request logs | Google's global CDN |
| Google Cloud DNS / your resolver | Resolving krisid.com | Global |
2. If you email us
Writing to contact@krisid.com, or calling one of the numbers on the contact page, means we hold what you send: your name, your email address or telephone number, your employer if you mention it, and the content of the enquiry. We use it to answer you and, if a conversation follows, to keep a record of it.
The lawful basis is legitimate interest — responding to somebody who contacted us about our services. We keep enquiry correspondence for as long as the commercial relationship or conversation remains live, and then for a reasonable period afterwards for business records. Ask us to delete it and we will, unless we are required to retain it.
3. The sandbox
metadata-sandbox.krisid.com is a running copy of the product that anybody may sign up for. It is a demonstration environment, and you should treat it as one.
- What it holds about you: the email address you register, a one-way hash of your password (never the password itself), and the record of your activity inside the application — what you created, edited and signed in to, which the product records in its own audit trail by design.
- What it holds that you put in: anything you type or upload while exploring. That is the point of a sandbox.
- Lawful basis: performing the service you asked for by signing up.
Do not put real or sensitive data in the sandbox
It is a shared demonstration environment, not a place to evaluate against live material. Do not upload personal data, client data, production metadata or anything confidential. If you want to see KRISID against your own estate, that is what a private deployment or a demo is for.
You can ask us to delete your sandbox account and its contents at any time by writing to contact@krisid.com.
4. A KRISID installation in your own estate
This is the case that matters most and is most often described badly by vendors, so to be explicit: when you license KRISID, it runs on infrastructure you control, against a database you control. It sends nothing to us. There is no telemetry, no usage reporting, no phone-home, and no mechanism by which your metadata reaches our systems.
In that arrangement you are the data controller for everything in the repository, and we are neither controller nor processor of it. We become a processor only if you separately engage us for implementation or support and, in the course of that work, give us access to an environment holding personal data — which is governed by the contract and data processing terms for that engagement, not by this notice.
The licence file itself is checked locally, per request, against the hostnames it names. That check involves no network call to us. See Security for how that works.
5. Your rights
Where data protection law applies to you — including the UK GDPR, the EU GDPR and India's Digital Personal Data Protection Act — you may ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, object to our processing of it, or ask us to restrict that processing. Write to contact@krisid.com and we will respond within the period the applicable law allows.
If you are unhappy with how we have handled a request, you may complain to your supervisory authority — the Information Commissioner's Office in the UK, your national authority in the EEA, or the Data Protection Board in India.
6. Changes
We will update this notice when what we do changes, and change the date at the top. We do not keep a mailing list, so there is nobody to notify; the current version is always the one on this page.
7. Who we are
Krisid Private Limited, a company incorporated in India, trading as KRISID. For any question about this notice, data protection, or a request about your own data, write to contact@krisid.com.
This notice describes our actual practice and is written to be checkable. It is not legal advice, and it is not a substitute for the data processing terms in a signed engagement.