Privacy

This page explains what data Karmik and Polyglyph Analytica have, and where it goes.

Last updated 16 October 2026.

Karmik isn't sold by checkout until an Enterprise agreement exists.

What stays on your computer

Your employees' records, their own details, the documents they gave you, your contracts and templates, the payroll files you add, the sanctions lists you load and your settings are kept in your Karmik folder. Each employee's own details are locked with a key of their own, kept in your computer's keychain where it has one. The dashboard is served by your own computer to your own computer. None of it is uploaded to us.

If you add a branch or subsidiary, its details stay on your computer with everything else. So do the details of anyone who works for it. None of it is sent to us.

What leaves your computer

• A licence check-in, at most once a day. It sends your licence ID, an installation ID and the version you run to Karmik's licence server. The server uses them to tell whether your copy is licensed, and which version you're entitled to. Nothing about your employees is in it. Each time Karmik checks its licence, it also tells our licence server whether your copy has been changed from the one we supplied: yes or no. It never sends what was changed, or any of your files. We keep the latest answer with your licence.
• Update downloads, from the same server, when a new version is ready.
• A check for corrections to the rules, once a day, from the same server. Your computer downloads one list of known corrections and announced changes to the employment rules it works to, and checks that we signed it. The list is the same for everyone. Nothing about your employees is sent. With it, your computer asks the licence server for your licence's settings. That sends your licence ID and an installation ID, as the check-in does.
• Your own Claude. When you ask Karmik's agents to check a starter, draft a contract or read a payroll run, they read what their job needs, such as a starter's documents, in your own Claude session. That happens under your Claude account and Anthropic's terms. It never passes through us.
• Other products on your computer. If you use other Polyglyph products, Karmik can tell them that someone started or left, the totals of a payroll run, or that a document was issued. It tells them a reference, dates and totals. It never tells them a name or one person's pay. This stays on your computer.
• Your phone, if you pair one. A paired phone reaches your dashboard through our relay server. The connection is encrypted end to end, between your phone and your computer. It's checked by six digits that both screens show. So the relay passes it on without being able to read it, and keeps none of it.
• Notifications, if you turn them on. You choose them on the dashboard's Notifications page, which every Polyglyph product on your computer shares. A push notification goes from your computer to your browser's push service, which is run by the company that makes your browser. It passes it on to the dashboard, or the paired phone, you turned notifications on for. Each one is encrypted for that device, so the push service can't read it. It names a person by their reference, never by their details.
• Notification emails, if you choose email for a topic. Your computer asks our licence server to send one short email to the address on your licence. It says which product and which topic need you, such as "Something needs you in Karmik (approvals)". It also says how many things are waiting. It never has anyone's details. You see those when you open Karmik. Our server sends it through ZeptoMail, our email service.

Your employees' data

Your employees' details are yours to look after. We never receive them. You are responsible for them under the data protection law that applies to you, as you would be with any HR tool.

What we hold

When you buy, Stripe processes the payment for us and tells us your name, email address, country and the order. We keep that to deliver and look after your licence. That covers the licence file, the purchase email, the update notices that go to every licence holder, the notification emails you choose, refunds and the seat. For notification emails we keep a count of how many we sent for your licence each day, so we can stop at ten. If you use the link in one to stop a topic, we keep that choice. We keep nothing else about them.

We keep the Checkout Session id and Stripe customer id Stripe gives us, your email address, and which version of the checkout wording you agreed to and when.

Stripe (Stripe Payments UK Ltd, with Stripe, Inc.) process the payment for us. Stripe uses your name, email address, billing address and card details to take the payment, to work out the tax (from your billing address, and, for price previews in the US and Canada or where your country isn't known, your IP address) and to check for fraud. Stripe's privacy policy covers what it holds.

We use Stripe to send our invoices and take payments, by card or by bank transfer. Stripe keeps your name, email address, billing address and VAT number, and the invoices and payments, for us. For each invoice, we keep only Stripe's reference numbers, whether it is paid, and what it pays for. Your choice about news from us is kept by us, not by Stripe. You can ask Stripe about its own records of your payments.

Stripe may process your data in the United States. That transfer is covered by the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, and Stripe is certified under the EU-US, UK Extension and Swiss-US Data Privacy Frameworks.

Your licence account is on our licence server. It's where you choose whether your agents stop when the list of rule corrections hasn't been checked for 14 days. To sign in, you enter the email address on your licence, and we email a link to it. We keep when we last sent you one, so we send at most one every 15 minutes. Opening the link keeps a cookie on this site for 12 hours. It's sent only to the account page. If you change a setting there, we keep a record of the change: which setting, what it was, what it became, the email address you signed in with, and when.

We send marketing email only if you said yes to it, anywhere, for any of our products. Saying yes means you agree to hear from Polyglyph Analytica about any of its products and apps, not only Karmik. It's one preference across all of them. Every marketing email has a one-click way to say no. Using it, or writing to us, stops marketing email from all of them. Update notices are part of the licence and aren't marketing.

The box to hear from us is ours, on our own page before checkout, and starts unticked. Ticking it means you agree to hear from Polyglyph Analytica about any of its products and apps. You can withdraw at any time from the link in any of our emails, or by writing to us.

Polyglyph Analytica keeps one customer list across all its apps, on our own servers. It holds who our customers are and what each chose about marketing.

This website

This site uses analytics cookies only if you say yes. If you press "Allow analytics" on the cookie notice, Google Analytics records which of our pages you visit. It also records the steps you take towards buying:

• seeing the prices;
• completing a purchase;
• starting a trial or a demo.

This is recorded without your name or email. We use it to learn which pages help. Nothing is used for advertising. If you don't say yes, no analytics runs at all.

Apart from analytics and the currency you choose (below), the site keeps two things in your own browser. One is whether you chose light or dark. The other is your answer to the cookie notice. Neither is sent anywhere. To answer again, use "Cookie settings" at the bottom of every page.

To show prices in your currency, our sites use the country your connection comes from, which our hosting provider, Cloudflare, tells us. We don't store it. On a page that shows prices, you can change the currency at its foot, and your browser remembers your choice.

To show the price in your currency, the page asks our licence server, and the server asks our store. The prices come from our own price list. The store asks Stripe Tax what tax it will add. Our licence server tells the store which country your request comes from, and the store tells Stripe. If you're in the US or Canada, or the country isn't known, your IP address is passed on instead, so Stripe can work out where you are. We don't store your IP address for this. When you buy, you pay on Stripe's own checkout page.

Our store

You buy at our store. Polyglyph Analytica runs it, as it runs this site.

The store has its own cookie notice. If you press "Allow analytics" there, Google Analytics records which store pages you visit, the links you follow from them, and when you open the checkout. It's recorded without your name or email. We use it to learn which pages help people buy. Nothing is used for advertising. Your answer on this site doesn't carry over to the store. If you don't say yes there, no analytics runs on the store.

When you pay, Stripe tells the store about the payment. The store keeps a copy of what Stripe sends: what you bought, the amounts and the tax, your name, email address and billing address, and any tax number you gave. For a refund, it can also include the card's type, its last four digits and its expiry date. It never includes the full card number. The store uses it to tell Karmik's licence server about your purchase, and later about a renewal or a refund. It keeps it with our purchase records.

If you ask the store for your price as a returning customer, it keeps your email address and when it last sent you the link, so it sends at most one every 15 minutes. If you open the price link, your browser keeps a cookie on the store's site for 30 days. It lets the store show your price as a returning customer. It's sent only to the store.

If you ask for an invoice, the store keeps what you typed with our sales records, to send the invoice and, once it's paid, what it pays for.

How long we keep it

We keep licence and purchase records, including the record of changes to your licence's settings, for as long as the licence exists, and then for as long as tax law requires. Stripe keeps payment records, and we keep invoices, for as long as tax law requires. For the daily check-in, we keep only the latest one for each installation. We keep your marketing consent until you withdraw it.

Your rights

Write to hello@polyglyphanalytica.com if you want to:

• ask for a copy of what we hold about you;
• have it corrected or deleted;
• object to its use;
• withdraw a consent.

When you ask us to erase your details and confirm it, we erase them from the records of every Polyglyph Analytica product you've used. We keep an invoice for as long as tax law says we must, and nothing else about you with it.

If you're unhappy with how we handle it, you can complain to the Information Commissioner's Office (ico.org.uk) or your own data protection authority.

Changes

If this policy changes, the date at the top changes with it.

Who you are dealing with

Polyglyph Analytica Ltd is the controller of the personal data this policy describes.

Karmik is made and sold by Polyglyph Analytica Ltd.
Polyglyph Analytica Ltd, trading as Polyglyph Analytica
Registered in England and Wales, company number 17495579
polyglyphanalytica.com
hello@polyglyphanalytica.com

You buy from Polyglyph Analytica Ltd. Stripe processes the payment.