Privacy Policy

All files and inputs uploaded to this platform are used exclusively to generate Vertical Transportation (VT) design reports for your project. This includes any PDFs, Excel files, or other files you provide. Your uploaded data is stored in isolated storage paths tied to your user account and project, ensuring complete separation from other users' data. Customer data is not used to train, fine-tune, or improve any machine-learning or AI models.

Our retrieval-augmented generation (RAG) system is trained and operates on various subscribed resources. The compliance corpus contains only publicly available regulatory documents; this shared reference library helps ensure reports meet industry requirements. Your uploaded project documents are processed separately and their embeddings are stored per user ID, meaning they are never mixed with the compliance corpus and are never accessible to other users.

Your data is protected through multiple layers of security. All files are stored in Supabase Storage with path-based isolation, where every storage path is prefixed with your unique user ID to prevent cross-user access. Database access is enforced through Row-Level Security (RLS) policies that require your authenticated user ID for all operations on your projects, documents, embeddings, and reports.

File uploads undergo validation including magic byte checking to verify actual file types regardless of extension, filename sanitization to prevent path traversal attacks, and size limits per image. All data transmission between your browser, our servers, and third-party services occurs over HTTPS with TLS encryption. A four-layer rate limiting system protects the platform from abuse, including per-user cooldowns, daily quotas, and active job restrictions.

Your project files, generated reports, and associated data are retained for the duration of your account. You may download your reports at any time using time-limited signed URLs, and you can delete individual projects or reports whenever you choose. When you delete a project, all associated data is permanently removed including uploaded documents, vector embeddings, generated reports, processing job records, and any modification session history. There is no automatic purge of inactive projects—your data remains available until you explicitly delete it or close your account.

KARR AI integrates with specific third-party services to deliver its functionality. OpenAI processes your document text to generate vector embeddings using the text-embedding-3-small model and generates report content using GPT-5.4 mini. Text from your uploaded PDFs is sent to OpenAI for embedding generation, and relevant excerpts are sent during report generation to produce contextual responses. OpenAI's API does not retain input data for model training under their current API data usage policies.

Supabase provides authentication services (supporting email/password and Google OAuth), PostgreSQL database hosting with the pgvector extension for similarity search, and secure file storage. Your authentication credentials are managed by Supabase Auth with industry-standard password hashing. No customer data is shared with any third party for marketing, analytics, or any purpose other than providing the core report generation service.

KARR AI outputs are advisory in nature and intended to assist—not replace—professional engineering judgment. All generated reports, calculations, and recommendations should be reviewed and validated by qualified professionals before use in any design, construction, or regulatory submission. KARR AI does not guarantee the accuracy, completeness, or suitability of any output for a particular purpose. The compliance checking features reference publicly available standards but do not constitute official certification or approval from any regulatory body.

If you have questions about our data practices, wish to request deletion of your data, or have any privacy-related concerns, please contact us at info@karra-i.com.