Legal / Legal Changelog

Legal Changelog

Last updated: 22 September 2026

22 September 2026

Updated the Security & Trust page and the Data Processing Addendum:

Security & Trust page: stated EU (Germany) data residency; made multi-factor authentication mandatory for all users; clarified that Kraylo staff cannot read customer operational data and that support runs only through customer-approved, 60-minute auto-expiring, configuration-only sessions; linked the public status page; added personal data breach and ICO notification wording; added dependency vulnerability monitoring; removed the point-in-time recovery statement.
DPA Annex 2: removed point-in-time recovery; added mandatory multi-factor authentication; scoped staff support access to product and deal configuration only, without access to operational data.

Updated the Service Level Schedule:

Monthly Uptime Targets are 99.0% for Growth and 99.5% for Enterprise.
Uptime is measured by Kraylo's third-party monitoring service, and current and historical availability is published on the status page.
Planned maintenance will not exceed eight hours in aggregate in any calendar month. Emergency maintenance may be carried out with shorter or no notice. Scheduled Maintenance, including emergency maintenance, does not count against the Uptime Target.
Support is provided during Business Hours only (09:00–17:30 UK time, Monday to Friday, excluding public holidays in England and Wales). An incident reported outside Business Hours is treated as received at 09:00 on the next Business Day.
Service credit bands are aligned to the revised Uptime Targets.
Quarterly performance summaries are drawn from Kraylo's monitoring and status page.

Updated the Data Processing Addendum retention, deletion and return terms:

DPA section 2: where Customer documents a retention period through the Services or in writing, Kraylo will apply that instruction subject to applicable law, disclosed technical limitations and any overriding legal requirement.
DPA section 7 retitled Retention, deletion and return: necessity-based retention, documented retention schedule, Customer choice of return or deletion on termination, backup beyond-use wording, and account deactivation distinguished from historical-record deletion.
Annex 1 Duration updated to cover the agreement term plus return, deletion, backup lifecycle and legal retention requirements.

Updated the Terms of Service, Data Processing Addendum and legal pack:

DPA section 2: Kraylo will not use Customer Data to train, fine-tune or improve any AI or machine learning model, except with Customer's prior written consent.
Terms section 4: the same AI/ML restriction, alongside the existing no-sale principle.
Terms section 6: ownership of Professional Services and Success Credit work product, with a licence for Customer-specific deliverables.
Terms section 1: Service Level Schedule added to the agreement documents for Growth and Enterprise only.
Terms section 7: 60-day renewal fee-increase notice; late-payment interest at 4% above Bank of England base rate on undisputed overdue invoices.
Terms section 9: beta/preview features excluded from warranty and SLA unless expressly stated otherwise.
Terms section 14: 30-day non-renewal notice where the Order Form provides for automatic renewal.
Terms section 16: customer marketing only with prior written consent; mutual 12-month non-solicitation with general-advertising carve-out.
DPA section 4: Kraylo remains liable for subprocessors as if performing the services directly.
DPA section 6: Personal Data Breach notification no later than 48 hours after becoming aware.
Published the Service Level Schedule for Growth and Enterprise.
Added PostHog as an EU-region analytics provider and Sentry as an EU-region application monitoring provider. Updated the Subprocessor List accordingly.
Privacy Notice and Cookie Notice updated to name those providers and to publish current analytics cookie details.

Published the current UK legal pack for KRAYLO LTD: