Kilter Products and Services Privacy Policy
Kilter Remote | Kilter Farm Platform | Kilter Live | Kilter Data Collector | AX-1 Robot
Version 2.1 | Effective date: September 2026
Privacy at a glance
Kilter AS processes personal data to provide and support its products and services, administer user accounts and subscriptions, maintain security and reliability, improve its products, and develop AI models and future functionality.
Depending on which Kilter products you use, we may process:
your name, business contact details, organisation, role, account information, and service activity;
technical information from your device, application, AX-1 Robot, or other Kilter product;
location, operational, diagnostic, and telemetry information where it relates to you;
camera imagery that may incidentally include identifiable individuals;
information submitted in connection with support, incidents, maintenance, or warranty claims; and
website and cookie information.
We may share relevant personal data with authorised dealers, distributors, and service partners where necessary for installation, support, maintenance, warranty administration, troubleshooting, security, and related services. Kilter, its authorised dealers, distributors and service partners may also communicate with existing business users about relevant updates, improvements, new functionality, and closely related products or services.
You may object to processing based on legitimate interests and may always object to direct marketing.
Many categories of information generated by Kilter products are machine, operational, agronomic, or product data and do not themselves constitute personal data. This Privacy Policy applies to such information only where it relates to an identified or identifiable individual.
You may exercise your data protection rights by contacting privacy@kiltersystems.com.
Who we are
Kilter AS is the controller for the processing of personal data described in this Privacy Policy.
Org. no.: 925 328 715
Address: Berghagan 3, 1405 Langhus, Norway
Email: privacy@kiltersystems.com
Website: kiltersystems.com
Kilter has assessed whether it is required to appoint a Data Protection Officer under Article 37 GDPR and has concluded that a formal appointment is not required.
Questions about privacy or the exercise of data protection rights may be directed to privacy@kiltersystems.com.
Who this policy applies to
This Privacy Policy applies to:
individual account holders;
employees and operators of business customers;
users of Kilter Farm, Kilter Live, Kilter Remote, the AX-1, and the Kilter Data Collector;
authorised dealers, distributors, and service partners using Kilter systems; and
visitors to kiltersystems.com.
Kilter's products are intended for professional and agricultural use and are not directed at children. Kilter does not knowingly collect personal data from children.
Controller and processor roles
This Privacy Policy principally describes processing for which Kilter determines the purposes and essential means and therefore acts as controller.
A business customer may act as controller where it independently determines why and how personal data relating to its employees or operators is processed. Where Kilter processes such information solely on the customer's documented instructions, Kilter acts as processor, and the processing will be governed by a data processing agreement.
Kilter may nevertheless act as an independent controller for separate purposes, including account administration, security, legal compliance, diagnostic analysis, support, incident investigation, warranty administration, product development, and AI model development.
Dealers, distributors, and service partners may act as Kilter's processors or as independent controllers, depending on the relevant processing activity and the purposes and means they determine.
Personal data we process:
Account, contact and subscription information
When a Kilter account or subscription is created, we will process:
name;
business email address;
telephone number;
organisation and role;
account identifiers;
authentication and access information;
account activity and settings;
subscription and payment status; and
billing and transaction information, where applicable.
Payment-card details may be processed directly by Kilter's payment-service provider rather than stored by Kilter.
We use this information to:
create and administer accounts;
authenticate users and manage access;
provide products and services;
administer subscriptions and payments;
maintain security; and
communicate with users about the relevant service.
Required account information is necessary to create and maintain access. If it is not provided, or is erased, Kilter may be unable to create the account or continue providing the relevant service.
Kilter Farm and Kilter Live
Kilter Farm and Kilter Live provide connected services for account, farm, field, fleet, robot, classifier, software-update, connectivity, and service administration.
Where information processed through these services relates to an individual user, Kilter may process:
account, organisation, and subscription information;
user access, activity, and service-interaction information;
information associating a user with a farm, field, fleet, or AX-1;
connectivity, service-status, and diagnostic information;
software, firmware, classifier, update, and configuration information; and
support, maintenance, troubleshooting, and security information.
We use this personal data to provide connected functionality, administer organisations and subscriptions, manage access and associated devices, deliver updates, provide support, maintain security and reliability, and improve Kilter's services.
AX-1
The AX-1 generates operational, technical, diagnostic, location, camera, sensor, and system-log information. Much of this information will not constitute personal data.
It may, however, become personal data where it relates to or is associated with an identifiable user or another identifiable individual. Personal data processed in connection with the AX-1 may include:
the user account, organisation, farm, field, or robot associated with an operation;
commands submitted by a user and corresponding robot responses;
session, access, route, navigation, and location information;
device identifiers, IP addresses, connectivity, and configuration information;
crash reports, diagnostic information, security events, and system logs;
information supplied through support requests, incident reports, or warranty claims; and
camera imagery containing identifiable individuals.
Kilter may use this information to operate and support the AX-1, deliver software and firmware updates, maintain cybersecurity and system integrity, diagnose technical issues, investigate incidents and suspected malfunctions, administer warranties, implement safety-related measures, and establish or defend legal claims.
Cameras
The AX-1 uses downward-facing cameras directed towards the field surface. These cameras are designed to capture soil and vegetation and are not intended to capture individuals during normal operation.
The AX-1 also has a forward-facing camera. Imagery from this camera may be retained for the development and testing of future functionality, including obstacle detection and navigation assistance. Because the camera is oriented in the direction of travel, it may incidentally capture individuals in or near the field.
Where imagery relates to an identifiable individual, Kilter treats it as personal data. Kilter restricts access to authorised personnel and applies safeguards appropriate to the associated risks.
Kilter relies on its legitimate interests in product development, testing, safety, and improvement where it uses personal data contained in forward-facing imagery for these purposes. Kilter periodically reviews whether continued retention remains necessary and deletes or anonymises personal data when it is no longer required, unless further retention is required or permitted by law.
Kilter does not intentionally use imagery containing identifiable individuals for AI training where the relevant purpose can reasonably be achieved using anonymised, de-identified, or non-personal information.
Kilter Data Collector
The Kilter Data Collector captures ground-level imagery of fields and associates it with location and session information.
The device is designed to photograph soil and vegetation and is not intended to capture individuals. If imagery nevertheless relates to an identifiable individual, Kilter treats it as personal data.
Kilter may use Data Collector imagery to provide field-mapping and documentation services and to train, test, validate, and improve AI models for weed detection and field analysis.
Kilter does not intentionally include imagery containing identifiable individuals in AI-training datasets where the relevant purpose can reasonably be achieved using anonymised, de-identified, or non-personal imagery.
Where personal data is used for Kilter's own AI training or product development, Kilter acts as an independent controller and relies on an appropriate lawful basis. Where Kilter relies on legitimate interests, affected individuals may object.
Kilter Remote
Kilter Remote is used to control, monitor, and configure AX-1 robots and/or Kilter Data Collector associated with a user's account.
When Kilter Remote is used, we may process:
account and authentication information;
information about AX-1 devices associated with the account;
GPS information from the mobile device, tablet, data collector or AX-1;
user commands and robot responses;
route, navigation, and operational status information;
configuration settings and preferences;
camera imagery transmitted from the data collector or AX-1;
IP address, device identifier, device name, operating-system version, and application version;
application usage, crash reports, diagnostics, and connectivity information; and
security events and support information.
We process this information to authenticate users, administer access, enable remote operation, display status and navigation information, show camera imagery, provide updates and support, diagnose technical issues, and maintain security and reliability.
Camera imagery displayed through Kilter Remote may originate from one or more data collector or AX-1 cameras.
Where live imagery is transmitted without being recorded or otherwise retained by Kilter, temporary technical buffering may occur to provide the transmission.
Where we obtain personal data
Kilter may obtain personal data:
directly from you;
from your employer or organisation;
from a dealer, distributor, or service partner;
automatically through your use of Kilter products, applications, and websites;
from an AX-1, Kilter Data Collector, or associated device;
from payment, infrastructure, support, or communications providers; and
from another person submitting a support request, incident report, or warranty claim.
Where Kilter obtains personal data from another organisation rather than directly from you, we will provide or make this Privacy Policy available no later than:
one month after receiving the information;
our first communication with you, if earlier; or
the first disclosure to another recipient, if earlier,
unless you already have the relevant information or another exception under Article 14 GDPR applies.
For users provisioned by an employer, dealer, distributor, or other business customer, Kilter may provide this Privacy Policy through an account-activation email or another appropriate channel.
Why we process personal data and our legal basis
Kilter processes personal data only where it has an appropriate lawful basis.
Contract, Article 6(1)(b) GDPR
Kilter may process personal data where necessary to provide a product or service requested by an individual or perform a contract with that individual.
Where the contractual counterparty is an employer or another organisation, Article 6(1)(b) does not automatically apply to the individual user. Kilter will then rely on another appropriate lawful basis, normally legitimate interests, for processing the user's business account and service information.
Legitimate interests, Article 6(1)(f) GDPR
Kilter may process personal data for the following legitimate interests:
operating, securing, maintaining, and troubleshooting its products and services;
administering business-user accounts and customer relationships;
providing customer support;
delivering updates and maintaining system integrity;
preventing misuse and managing cybersecurity or safety risks;
diagnosing faults and investigating incidents, warranty claims, and security events;
improving product performance, safety, reliability, and functionality;
developing and validating AI models and future product features;
operating an effective dealer, distributor, and service network;
communicating with business users about relevant updates, improvements, new functionality, and closely related products or services;
maintaining appropriate audit trails and resolving disputes; and
establishing, exercising, or defending legal claims.
Before relying on legitimate interests, Kilter assesses whether the processing is necessary and whether its interests are overridden by the interests, rights, or freedoms of affected individuals. Safeguards are applied according to the nature and risks of the processing.
Individuals may object to processing based on legitimate interests by contacting privacy@kiltersystems.com.
Consent, Article 6(1)(a) GDPR
Kilter relies on consent for non-essential cookies and similar technologies and for other processing where consent is identified as the appropriate lawful basis.
Consent may be withdrawn at any time. Withdrawal does not affect processing carried out lawfully before withdrawal.
Legal obligations, Article 6(1)(c) GDPR
Kilter processes personal data where necessary to comply with applicable accounting, tax, record-keeping, product-safety, regulatory, and other legal obligations.
AI development and use of non-personal data
Kilter develops and improves agricultural products and AI models, including models for weed detection and field analysis.
Kilter seeks to use anonymised, de-identified, or non-personal information where the relevant purpose can reasonably be achieved without personal data. Information that is merely pseudonymised remains personal data and continues to be subject to GDPR.
Kilter may create aggregated, statistical, anonymised, or other derived datasets from information generated through its products and services. Where such datasets do not relate to an identified or identifiable individual and therefore no longer constitute personal data, Kilter may use, share, license, or otherwise make them available for:
research and analytics;
agricultural or operational benchmarking;
product and AI development;
commercial partnerships; and
other legitimate business purposes.
Before treating information as anonymous, Kilter assesses whether individuals are identifiable by means reasonably likely to be used.
Kilter does not sell personal data. This does not prevent Kilter from licensing or otherwise making available information that does not constitute personal data. This is consistent with internal AX-1 terms that contemplate product development and sharing of anonymised or aggregated data where the user or farm cannot reasonably be identified.
Further information concerning machine-generated, agronomic, and other product data may be provided in Kilter's Product Data and Data Act Notice, Terms of Use, or applicable service agreement.
Sharing of personal data
Kilter may disclose personal data to:
cloud hosting and infrastructure providers;
software, security, diagnostic, communications, CRM, analytics, and support providers;
payment and subscription-administration providers;
professional advisers, auditors, insurers, and public authorities;
authorised dealers, distributors, and service partners; and
other recipients where required by law or requested or authorised by the individual.
A recipient acts as Kilter's processor where it processes personal data solely on Kilter's documented instructions. A recipient acts as an independent controller where it determines its own purposes and essential means.
Dealers, distributors, and service partners
Authorised dealers, distributors, and service partners may receive personal data where necessary for:
installation and activation;
service planning;
maintenance and support;
warranty administration;
software or classifier updates;
troubleshooting and resolution of reported issues;
safety, security, or incident investigations; and
communication about relevant product improvements, upgrades, new functionality, and closely related products or services.
Access must be limited to personal data necessary for the relevant purpose.
Where disclosure is based on Kilter's legitimate interests, you may object by contacting privacy@kiltersystems.com. Kilter will stop the relevant processing unless it demonstrates compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary for legal claims.
You may object to direct marketing at any time. Kilter and the relevant recipient will then cease using your personal data for that direct-marketing purpose.
Kilter's distribution agreements already contemplate that distributors and dealers may handle customer and user personal data subject to applicable privacy and data-protection requirements.
International Transfers
Some recipients may process personal data outside Norway and the EEA, including in the United States.
Where an applicable adequacy decision exists, Kilter may rely on that decision. Otherwise, Kilter uses an appropriate transfer mechanism under Chapter V GDPR, such as the European Commission's Standard Contractual Clauses, together with supplementary technical, contractual, or organisational measures where required.
Information about relevant destinations, transfer mechanisms, and how to obtain a copy of applicable safeguards is available by contacting privacy@kiltersystems.com. Information may be redacted where permitted by law to protect commercial confidentiality or system security.
How long we retain personal data
Kilter retains personal data only for as long as necessary for the relevant purpose, including the time required to provide the service, maintain security, comply with legal obligations, resolve disputes, and establish or defend legal claims.
The following periods or criteria apply:
Account information: for the active account relationship and normally deleted or anonymised within 30 days after account closure, unless longer retention is required for security, legal compliance, disputes, or legal claims.
Subscription and billing information: for the subscription relationship and thereafter for the period required under applicable accounting, tax, payment, and limitation rules.
Location and operational personal data: for 12 months after the relevant operation, unless longer retention is required for customer history, support, an incident, a legal obligation, or a claim.
Kilter Remote live imagery: If imagery is retained, it is subject to the applicable camera-retention period below.
AX-1 identifiable camera imagery: for 30 days, after which personal data is deleted or anonymised unless continued retention is necessary and permitted.
Data Collector imagery used for customer services: for 30 days after collection or completion of the service unless longer retention is required for customer history, support, an incident, a legal obligation, or a claim.
Identifiable imagery used for documented AI development: only while necessary for the relevant training, validation, testing, or model-improvement purpose and subject to periodic review.
System logs and incident records: for the period reasonably necessary for operation, support, security, incident investigation, warranty administration, regulatory compliance, dispute resolution, or legal claims. Kilter periodically reviews whether continued retention remains necessary.
Marketing consent and objection records: for the period necessary to demonstrate compliance and normally for up to three years after withdrawal, objection, or the last relevant communication, subject to applicable limitation periods.
Website analytics and marketing information: according to the periods disclosed through the website's cookie-management interface.
Accounting records: for the period required by applicable Norwegian accounting and bookkeeping legislation.
Legal claims: until the applicable limitation period has expired and any dispute has been finally resolved.
Kilter deletes or anonymises personal data earlier where it is no longer necessary and no other lawful basis requires or permits continued retention.
Information that has been effectively anonymised and no longer constitutes personal data may be retained for longer periods.
Cookies and similar technologies
Kiltersystems.com uses cookies and similar technologies for:
necessary website functionality and security;
analytics; and
marketing and advertising measurement.
Necessary technologies may be used where required to provide the requested website or service functionality. To the extent personal data is processed, Kilter relies on its legitimate interest in providing a secure and functional website.
Non-essential analytics and marketing technologies are used only with valid consent. Visitors must be able to accept or reject non-essential technologies with equivalent ease and withdraw or change consent at any time.
The cookie-management interface or cookie overview provides information about the relevant technologies, including their provider, purpose, category, and duration.
Security
Kilter applies technical and organisational measures appropriate to the nature and risks of the processing. Depending on the relevant system and processing activity, these may include:
access controls and role-based permissions;
authentication and account-security measures;
encryption in transit;
logging and monitoring;
secure development and change-management practices;
vulnerability and incident management;
backup and recovery measures; and
periodic security and access reviews.
Kilter regularly reviews and, where appropriate, updates its security measures.
If a personal data breach is likely to result in a high risk to an individual's rights and freedoms, Kilter will inform the affected individual without undue delay where required by Article 34 GDPR.
Your rights
Subject to the applicable conditions and exceptions, you may have the right to:
obtain confirmation of whether Kilter processes your personal data and request access to it;
request correction of inaccurate or incomplete information;
request erasure;
request restriction of processing;
receive certain personal data in a structured, commonly used, machine-readable format and transmit it to another controller;
object to processing based on legitimate interests;
object at any time to processing for direct marketing;
withdraw consent at any time; and
lodge a complaint with a competent supervisory authority.
Where you object to non-marketing processing based on legitimate interests, Kilter will stop the processing unless it demonstrates compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary for legal claims.
Requests may be submitted to privacy@kiltersystems.com.
Kilter may request information reasonably necessary to verify your identity. Kilter will respond without undue delay and normally within one month. Where permitted by Article 12 GDPR, the period may be extended by up to two further months due to the complexity or number of requests. Kilter will notify you within the initial one-month period if an extension is required.
Requests are normally handled free of charge. Kilter may charge a reasonable fee or refuse to act only where a request is manifestly unfounded or excessive and the conditions of Article 12(5) GDPR are satisfied.
Automated decision-making
Kilter does not use personal data to make decisions based solely on automated processing that produce legal effects concerning an individual or similarly significantly affect an individual.
The AX-1's AI models classify agricultural targets, such as crops and weeds. They are not intended to evaluate individuals or make decisions about individuals.
Complaints
You may lodge a complaint with the Norwegian Data Protection Authority:
Datatilsynet
Postboks 458 Sentrum, 0105 Oslo
postkasse@datatilsynet.no
www.datatilsynet.no
You may also complain to another competent EEA supervisory authority, particularly in the country where you live or work or where the alleged infringement occurred.
Product data under the Data Act
The AX-1 and Kilter Data Collector generate product, operational, agronomic, imaging, telemetry, and machine data that does not constitute personal data.
Users of connected products and related services may have rights under Regulation (EU) 2023/2854, including rights concerning access to data generated through their use of connected products.
Where product data contains personal data, its access, disclosure, and use remain subject to GDPR and other applicable data-protection law
A request under the Data Act is distinct from a data-subject request under GDPR. Where a request concerns both product data and personal data, Kilter will assess it under both regulatory frameworks.
Changes to this policy
Kilter may update this Privacy Policy to reflect changes in its products, services, processing activities, or legal obligations.
Where changes are material, Kilter will notify affected individuals through an appropriate channel, such as email, an in-app notification, or a prominent website notice, before the changes take effect where required by law.
Continued use of a product or service will not constitute consent to new processing where GDPR requires separate consent. Where another lawful basis applies, Kilter will provide updated information within the period required by law.
The current version and effective date are stated at the beginning of this Privacy Policy.