KLEINML / PRIVACY

Privacy policy

Effective 17 October 2026

This policy describes how Klein ML, the operator of kleinml.com, handles personal information when you visit the website, create an account, or communicate with us about early access.

For questions or privacy requests, contact the operator at banaxitech@gmail.com. Account support is also available at mail@kleinml.com.

Information we handle

• Account details: your email address, a salted password hash, email-verification status, account creation time, and any administrator role. We do not store your password in plain text.
• Security details: session-token hashes, temporary verification and password-reset token hashes, sign-in challenges, and rate-limit records. If you enable authenticator 2FA, we store an encrypted authenticator secret, the last accepted code time step, and hashes of your recovery codes.
• Emails and early-access correspondence: recipient addresses, subjects, message types, timestamps, sending administrator, message identifiers, and sending outcomes. Custom email content is retained in the administration history. Verification and password-reset email bodies are not retained in that history because they contain private security links. We also handle information you provide when applying for early access or contacting us.
• Technical information: our hosting and network services may process your IP address, requested pages, timestamps, browser information, and referring pages to deliver and protect the service.

Why we use it

We use this information to create and operate your account, verify your email address, authenticate sign-ins, provide optional 2FA, restore account access, review early-access requests, send requested or account-related messages, and protect the service against abuse.

Where the GDPR applies, account operation and responding to your requests rely on taking steps at your request or performing our agreement with you. Security, abuse prevention, and necessary service records rely on our legitimate interests in operating a secure service. Where separate consent is required for optional promotional communication, that consent is the relevant basis. Creating an account does not itself subscribe you to a marketing list.

Service providers and external links

The website runs on hosting infrastructure used by Klein ML. Cloudflare provides DNS, proxying, and network security. Brevo sends our account and administrator-composed emails and receives the recipient address and message content for that purpose.

The logo in our HTML emails is loaded from a Hugging Face-hosted image URL. Loading a remote image may disclose technical information to its host, depending on your email application and its image proxy or privacy settings.

The early-access link uses TinyURL and leads to an external application form. External websites may collect their own information under their own privacy notices. Their information is separate from your Klein ML account unless you provide it to us for your request.

Cloudflare, Brevo, and other infrastructure providers may process information in countries outside your own. Their privacy notices describe their processing locations and available safeguards.

Cookies and tracking

When you sign in, we use an essential, host-only session cookie named __Host-kleinml_session. It is marked Secure, HttpOnly, and SameSite=Lax and expires after seven days unless you sign out or it is revoked sooner. Blocking it prevents signed-in features from working.

Cloudflare may use its own essential security cookies. The website’s application code does not include advertising trackers or an analytics library. Our account email templates do not add an open-tracking pixel; email providers may separately process delivery or interaction information under their own settings and policies.

Retention and security

Account and 2FA settings are kept while your account is in use or until we process an applicable deletion request. Email history and early-access correspondence are kept while needed to manage requests, resolve delivery issues, maintain service records, or meet legal obligations, and can be reviewed for deletion on request.

Verification links expire after 24 hours, password-reset links after one hour, authenticator setup after ten minutes, and unfinished 2FA sign-in challenges after five minutes. Expired records are removed during subsequent service activity. Used recovery codes are removed immediately. Rate-limit records are temporary. The server’s standard access logs rotate daily with 14 rotated files retained. Private backups may contain earlier copies of records until those backups are replaced or removed.

We restrict administrator access, require HTTPS, hash passwords and bearer tokens, encrypt authenticator secrets, and keep email credentials outside the public website files. Authorized administrators can see account email addresses, account status, and email history; the admin panel does not expose password hashes, authenticator secrets, recovery-code hashes, or verification tokens.

Your choices and rights

You can sign out, reset your password, and enable or disable authenticator 2FA from your account. To request access to your information, correction, deletion, a portable copy, or a restriction or objection to processing, contact banaxitech@gmail.com. We may ask you to verify account ownership before fulfilling a request.

Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. Where applicable, you may complain to your local data-protection authority. Some information may need to be retained for security, resolving disputes, or legal obligations.

Changes to this policy

We will update the effective date when this policy changes. Material account-related changes may also be communicated through the service or by email.