Privacy notice
Last updated 10 June 2026. This notice explains how Koja Datarobot handles your personal data — the email you give us if you join the waitlist, the account you sign in with, the questions you type into the agent, and any documents you upload for review. It follows the EU General Data Protection Regulation (GDPR) and Norwegian law.
Who is responsible (data controller)
The data controller is Koja Research, the company behind both products. Koja Datarobot is part of Koja Intelligens (kojai.no) and shares one account and one data controller across both. For any privacy question or request, contact personvern@kojai.no.
What we collect, and why
- Waitlist email. If you join the waitlist we store your email address, the fact that you gave consent, and the date and time you did so. We use it only to contact you about access to Koja Datarobot and Koja Intelligens (for example, to tell you when private accounts or dedicated capacity open). We never sell or share your address.
- Account. If you sign in, we process your email address and an authentication token to operate your account, which is shared with Koja Intelligens (kojai.no).
- Your questions to the agent. When you ask the agent something, your question and the recent turns of that conversation are sent to our server and to the language-model provider so an answer can be generated (see Where your data is stored and Transfers outside the EEA below). We do not use your questions to train AI models. For anonymous visitors the conversation is held only transiently in the server’s memory and is not retained; if you are signed in, your Chief of Staff runs are saved to your own area of our EEA storage so they survive between visits.
- Documents and code you upload for review. If you are signed in, the Reviewer lets you upload a thesis or paper (and, optionally, code) to be reviewed. The uploaded files and the text we extract from them are stored in your own area of our EEA storage (Fly.io, Stockholm), tied to the conversation you uploaded them in, so the Reviewer can keep working on them across visits. Two things you should know before uploading:
- The text of your document is sent to the language-model provider to produce the review — the same US transfer described under Transfers outside the EEA applies to it. Do not upload documents containing other people’s personal data, or anything sensitive or confidential you would not put in the chat.
- A text copy of the uploaded document (not the code) is also added to your personal Files on Koja Intelligens (kojai.no) — same account, same controller, same EEA storage — so your material is in one place across both products. If you want it removed from either place, see Your rights.
Legal basis
- The waitlist email is processed on the basis of your consent (GDPR Article 6(1)(a)), which you give by ticking the box on the waitlist form. You can withdraw it at any time (see Your rights) — withdrawing does not affect anything done before you withdrew.
- Operating your account and answering your questions are processed to perform the service you asked for (Article 6(1)(b)) and on our legitimate interest in running and securing the service (Article 6(1)(f)).
Where your data is stored
Your waitlist email, account and saved runs are stored in a database and on servers hosted by Fly.io in Stockholm, Sweden (within the EEA), acting as our data processor. We make no third-party tracking or advertising calls from this site.
Transfers outside the EEA
To generate answers, the agent sends your question (and the recent conversation turns) to our language-model provider, OpenRouter, Inc. (United States), which routes the request to a European Mistral model. This involves a transfer of that text to the United States. The provider is instructed not to retain or train on the data (data_collection: deny), and the transfer relies on the EU Standard Contractual Clauses. Because the text is processed by a provider in the US, please do not enter personal, sensitive or confidential information into the chat.
How long we keep it
We keep your waitlist email until access opens and we have contacted you, or until you ask us to remove it or withdraw your consent — whichever comes first. Account data and saved runs are kept while your account is active and deleted on request. Uploaded documents and code are kept in your storage area so you can continue the review across visits; uploading a new document to the same conversation replaces the old one, and you can have everything you uploaded deleted at any time by emailing personvern@kojai.no — we delete both the copy here and the mirrored text copy on kojai.no. Anonymous chat is not stored beyond the brief processing of your request.
Your rights
You have the right to access the data we hold about you, to have it corrected or erased, to withdraw consent, and to object to or restrict our processing. To exercise any of these — or to be removed from the waitlist — email personvern@kojai.no and we will act without undue delay. You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).
A note on the agent’s answers
Koja Datarobot’s answers are generated by AI and grounded in deployed data and a validated research corpus, with a Validator that checks citations and numbers. They may still be inaccurate or incomplete, and they are provided as information only — not professional, legal, financial or investment advice. Verify anything important against the cited primary sources before relying on it.