Legal

Privacy policy

Last updated 11 October 2026

Kromla is a service for running epigenomics data pipelines. It is currently in early access: you can create an account and join the waiting list, but no pipelines run for customers yet. This policy explains what personal data we handle today and why.

Who is responsible

Kromla is operated by Sudden Sun Holding AS (organisation number 927 246 708), Silurveien 44, 0380 Oslo, Norway, which is the data controller for the processing described here. Contact us at hello@kromla.com.

What we collect

• Account data: your name, email address and sign-in details: a password hash or passkey, any two-factor method you set up, or the fact that you signed in with Google. If you sign in with Google, Google tells us your name, email address and profile picture. An email address is required to create an account.
• Messages: anything you send to hello@kromla.com or another @kromla.com address.
• Technical data: our providers keep request and security logs (IP address, browser, time of request) to keep the service secure and to fix problems.

Cookies and browser storage

kromla.com sets no cookies. When you sign in, it keeps your sign-in state (name, email address and a sign-in token) in your browser's session storage until you close the tab, plus a temporary sign-in code in local storage that is valid for 30 minutes. The sign-in pages at kromla-sl9u4g.eu1.zitadel.cloud, and Google if you use it, set the cookies needed to sign you in. All of this is strictly necessary for signing in, and none of it is used for analytics, tracking or advertising.

Why we use it

• To create and secure your account, and to send you the early-access messages you signed up for (performance of a contract, GDPR art. 6(1)(b)).
• To answer your messages, and to send service and security notices (our legitimate interest in running the service, art. 6(1)(f)).
• To keep the service secure and fix problems (legitimate interest, art. 6(1)(f)).

We never sell your data, use it for advertising or make automated decisions about you. You can stop early-access emails at any time by replying to one or writing to hello@kromla.com.

Who handles it

These providers process data on our behalf, under data processing agreements:

• ZITADEL (Zitadel, Inc. and its affiliates): account and sign-in service, hosted in the EU region.
• Google Cloud: hosting of kromla.com in Finland (europe-north1).
• Cloudflare: domain name service, and forwarding of email sent to @kromla.com addresses.

These act under their own terms rather than on our behalf:

• Google, for Sign in with Google: if you choose it, Google handles your sign-in under Google's privacy policy.
• Google, for Gmail: email sent to @kromla.com addresses is forwarded to a Gmail mailbox, where Google also processes it under its own terms.

Transfers outside the EEA

Zitadel may give its US company and support staff access to account data; this is covered by the European Commission's standard contractual clauses. Cloudflare and Google are US companies and may process data in the US, covered by the EU–US Data Privacy Framework and standard contractual clauses. Email in Gmail may be stored outside the EEA. Contact us for a copy of the safeguards that apply to our processors.

How long we keep it

We keep your account data while your account exists. If you ask us to delete your account, we delete it within one month, except where the law requires us to keep something longer. We keep email correspondence for as long as we need it to handle your request, and at most 24 months after the last exchange. Google Cloud keeps our request logs for 30 days; Zitadel and Cloudflare keep their security logs under their own retention rules.

Your rights

You can ask for access to, correction of or deletion of your personal data, and for a copy of it in a portable format. You can also ask us to restrict processing, and you have the right to object at any time to processing based on our legitimate interest. Email hello@kromla.com and we will reply within one month. If you think we handle your data unlawfully, you can complain to Datatilsynet, the Norwegian Data Protection Authority (datatilsynet.no), or the authority in your own country.

Changes

We will update this policy before Kromla starts processing research data for customers, and we will tell account holders by email about any material change.