Privacy policy

1. Introduction

Kiaro ("we," "us," or "our") is a SaaS operating system built for independent client work. We provide tools for client management, project tracking, invoicing, document creation, and AI-powered assistance to help you run your practice.

This Privacy Policy describes how we collect, use, disclose, and protect information when you use our website, application, and services (collectively, the "Service"). By using Kiaro, you agree to the collection and use of information in accordance with this policy.

Kiaro is the data controller responsible for your personal information. If you have questions about how we process your data, please contact us at hello@kiaro.io.

2. Information We Collect

2.1 Account Information

When you register for Kiaro, we collect your name, email address, and a password (stored as a secure hash). If you create a workspace, we also collect your workspace name and organizational details you choose to provide.

If the link you used to reach Kiaro carried campaign tags (the utm_ parameters in the address, such as utm_source=linkedin), we record those tags against your workspace when you register, so we know which post, community or email led to the signup. The tags describe the link, not you. They are read from the page address and, unless you accept analytics cookies, are not stored on your device.

2.2 Business Data You Provide

As you use the Service, you may provide information about your clients, projects, tasks, invoices, proposals, and other business data. This content is created and controlled by you. We process it solely to provide the Service to you.

2.3 Payment Information

Subscription payment processing is handled by Lemon Squeezy LLC, who acts as the Merchant of Record. We do not store your full credit card number, CVV, or bank account details on our servers. Lemon Squeezy processes your billing information, handles tax collection, and manages subscription status.

Invoice payments from your clients are processed by Stripe via Stripe Connect. Stripe receives your clients' payment method details and transaction amounts for the purpose of collecting invoice payments on your behalf.

2.4 AI Interaction Data

When you use AI-powered features (such as content generation, AI search, or AI-assisted document drafting), we send relevant context to our AI providers (Anthropic, OpenAI, and Google) to generate responses. This may include portions of your business data that are relevant to the specific request. See Section 6 for full details on AI data processing. If you connect an AI app of your own, the data it reads is handled as described in Section 6, "Connected AI apps".

2.5 File Uploads

You may upload files (documents, images, attachments) to the Service. These files are stored securely on Cloudflare R2 and are associated with your account and workspace.

2.6 Usage Data

We automatically collect information about how you interact with the Service, including pages visited, features used, time spent, browser type, device information, IP address, and referring URLs. This data helps us improve the Service and diagnose issues.

2.7 Error & Performance Data

We use Sentry for error tracking and performance monitoring. When an error occurs, Sentry may collect technical information such as stack traces, browser details, and anonymized user identifiers to help us diagnose and fix issues.

2.8 Roadmap Requests and Notifications

If you send a feature request from our public roadmap, we receive the request and, only if you add it, your email address so we can reply. If you ask to be told when a roadmap item ships, we store your email address against that item, send you one email when it ships, and then delete the address. Neither form adds you to a mailing list.

3. How We Use Your Information

We use the information we collect to:

• Provide and operate the Service : manage your account, workspace, clients, projects, invoices, and all core functionality.
• Power AI features : generate content, provide AI search results, and deliver AI-assisted recommendations based on your business data.
• Process payments : manage subscriptions through Lemon Squeezy and facilitate client invoice payments through Stripe Connect.
• Send transactional communications : email you about account activity, invoice status changes, client portal notifications, and important service updates.
• Improve the Service : analyze usage patterns to fix bugs, optimize performance, and develop new features.
• Ensure security : detect and prevent fraud, abuse, and unauthorized access.
• Comply with legal obligations : respond to lawful requests and enforce our terms.

4. Legal Basis for Processing

We process your personal information under the following legal bases:

• Contract performance: Processing necessary to provide the Service you signed up for, including account management, data storage, and feature delivery. This includes sending data to an AI app you have connected to your workspace when you, through that app, ask for it.
• Legitimate interests: Processing necessary for our legitimate business interests, including improving the Service, ensuring security, preventing fraud, and conducting analytics. We balance these interests against your rights and freedoms.
• Consent: Where required, we obtain your consent before processing, such as for optional marketing communications. You may withdraw consent at any time.
• Legal obligation: Processing necessary to comply with applicable laws, regulations, or legal processes.

5. Data Sharing & Third Parties

We do not sell your personal information. We share data with third-party service providers only as necessary to operate the Service:

AI apps that you connect to your workspace yourself, such as Claude or ChatGPT, are not our service providers and are not listed here. See Section 6, "Connected AI apps".

6. AI & Data Processing

Kiaro uses third-party AI providers to power its built-in AI features, such as the AI command bar. We want to be transparent about how your data is handled in this context. This section also explains what happens when you connect an AI app of your own.

AI Providers We Use

For its built-in AI features, Kiaro routes requests to the most suitable provider depending on the task. The providers we use are:

• Anthropic (Claude) : Used for complex generation tasks such as proposals, contract analysis, email drafting, and multi-step command orchestration.
• OpenAI (GPT) : Used for lightweight queries, search, and classification tasks.
• Google (Gemini) : Used for batch processing, fallback operations, and cost-optimized tasks.

What Data Is Sent

• When you use Kiaro's built-in AI features, we send the minimum context necessary to fulfill your request. This may include client names, project descriptions, task details, invoice totals, and time entry summaries.
• For built-in AI features, we never send email addresses, phone numbers, bank details, tax IDs, Stripe account information, authentication tokens, or file download URLs to any AI provider. These fields are stripped before processing.
• Data is only sent to these providers when you actively use a built-in AI feature. If you do not interact with the AI command bar, no data is sent to them.

Your Data Is Not Used for Training

• The three providers behind Kiaro's built-in AI are bound by commercial API terms and Data Processing Agreements (DPAs) that explicitly prohibit the use of your data to train or improve AI models.
• Anthropic may temporarily retain API inputs for up to 30 days for trust and safety purposes, then deletes them. OpenAI offers zero-retention options. Google's paid API tier does not use data for training.

AI Usage Logs

• We log AI interactions (action type, model used, token count) for usage metering and cost tracking. These logs do not contain the content of your requests or responses.
• AI usage logs are automatically purged after 90 days.
• Logs are included in data exports and are deleted when you delete your account.

Connected AI apps

You can connect an AI app that you use, such as Claude, ChatGPT, Cursor or VS Code, to your Kiaro workspace from Settings → Connected apps. This is separate from Kiaro's built-in AI features above.

• You choose the app and approve the connection. You sign in to Kiaro and choose whether the app can only read your workspace or can also make changes. You can revoke a connection at any time. Workspace owners and admins can turn connected apps off for the whole workspace and, on the Team plan, revoke any member's connection.
• The app's provider processes what you ask it to read. When you ask a connected app to read something in Kiaro, we send that data to the app. Its provider (for example Anthropic for Claude or OpenAI for ChatGPT) processes it under your own account with that provider, and under that provider's terms and privacy policy, not ours.
• The provider is not our sub-processor. We do not choose these providers and have no data processing agreement with them for connected apps. Whether a provider may keep or train on your data depends on your settings and agreement with that provider.
• More data can reach a connected app than our built-in AI. The field stripping described above applies to Kiaro's built-in AI only. A connected app receives the data you ask it to read, which can include your clients' contact names and email addresses.
• Sends, payments and deletions wait for you. Anything a connected app asks Kiaro to send to a client, record as paid, void or delete waits for your approval inside Kiaro.
• What we record. For each request a connected app makes, we record which tool it used, whether it worked, the names of the fields it sent (never their contents), the records involved, which app made the request and when. We use these records to keep the service reliable and delete them after 90 days.

Opting Out

AI features can be disabled entirely from Settings → Workspace. When disabled, Kiaro operates in manual-only mode and no data is sent to Kiaro's AI providers. All features remain accessible through the sidebar navigation.

Turning off AI features does not disconnect AI apps you have connected yourself. To stop those, revoke them in Settings → Connected apps. Workspace owners and admins can also switch off Allow AI apps (MCP) there, which blocks every connected app in the workspace.

7. Data Storage & Security

We take the security of your data seriously:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher.
• Encryption at rest: Your data is encrypted at rest in our database (Neon) and file storage (Cloudflare R2).
• Access controls: We implement role-based access controls and multi-tenant isolation. Your data is logically separated from other customers' data using tenant-level access controls enforced at the database query level.
• Authentication security: Passwords are hashed using industry-standard algorithms. Session tokens are securely generated and managed.
• Provider compliance: Our infrastructure providers (Neon, Cloudflare, Vercel, Stripe, Lemon Squeezy) maintain SOC 2 Type II compliance and undergo regular independent security audits.
• Incident response: In the event of a data breach, we will notify affected users within 72 hours as required by applicable law.

8. Data Retention

We retain your personal information and business data for as long as your account is active and as needed to provide the Service.

• Active accounts: Your data is retained for the duration of your subscription. You may export or delete your data at any time.
• Account deletion: When you close your account, we initiate deletion of your personal and business data within 30 days. Some data may be retained for up to 90 days in encrypted backups before being permanently purged.
• Legal requirements: We may retain certain data for longer periods where required by law (e.g., invoice records for tax compliance, typically 7 years).
• Anonymized data: We may retain anonymized, aggregated usage statistics that cannot be used to identify you, for product improvement purposes.

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

Under GDPR (European Economic Area)

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your personal data ("right to be forgotten").
• Right to restrict processing: Request that we limit how we use your data.
• Right to data portability: Receive your data in a structured, machine-readable format (CSV export is available).
• Right to object: Object to processing based on legitimate interests.
• Right to lodge a complaint: File a complaint with your local data protection authority.

Under CCPA (California)

• Right to know: Request information about what personal data we collect, use, and disclose.
• Right to delete: Request deletion of your personal information.
• Right to opt-out of sale: We do not sell personal information, so this right is automatically satisfied.
• Right to non-discrimination: We will not discriminate against you for exercising your rights.

To exercise any of these rights, contact us at hello@kiaro.io. We will respond within 30 days.

10. Cookies & Tracking

Kiaro groups cookies and similar browser storage into three purposes. You choose the second and third when you first visit, and you can change or withdraw that choice at any time using the Cookie settings link in the footer of any public page.

• Strictly necessary: Required for authentication, session management, security and bot protection, and to remember your cookie choice itself. These cannot be disabled because the Service does not work without them. When you click a vote button in one of our emails, a first-party cookie holding a random value lets us count your vote once per item, for up to a year. Votes are anonymous: we store only a one-way hash of that value with the item you chose, never your email or name, and the cookie is set only when you vote.
• Analytics: Used on the public marketing site (kiaro.io and kiaro.io/docs) to understand aggregate usage and improve the site. We use Google Analytics, PostHog, Contentsquare, and Vercel Analytics for this. Contentsquare and Vercel Analytics do not load at all until you accept this category. Before you answer the banner, and if you decline, PostHog only counts your visits, without cookies, as described below. If you accept it, the campaign tags from the link you arrived on (see Section 2.1) are also kept in a first-party cookie for up to 90 days, so a signup on a later visit is still credited to that link.
• Advertising: Used to measure which advertisements led to a signup, so we do not keep paying for ads that do not work. This covers Google Ads conversion measurement and the storage of a Google click identifier (the gclid) in a first-party cookie for up to 90 days. Nothing is stored for this purpose until you accept this category.

How the Google tag behaves before you choose. We use Google Consent Mode v2. The Google tag itself is present on our public pages before you answer the banner, but until you accept it is not permitted to write or read cookies, and it sends only an anonymous, cookieless signal that a page was viewed. That signal contains your IP address, the page address and your browser type, which Google uses to estimate aggregate results. It does not identify you and it is not used to build an advertising profile. If you visit from the EEA, the UK or Switzerland, every optional signal starts denied by default. If you reject, it stays that way permanently.

How PostHog behaves before you choose, or if you decline. On our public marketing and documentation pages, PostHog counts your visit so we know how many people reach each page, where they arrive from and how long they stay on it. Nothing else is recorded: not what you click, not how far you scroll. It does this without cookies and without storing any identifier on your device: visitors are counted with a privacy-preserving hash that PostHog calculates on its own servers, and IP addresses are discarded for our PostHog project. Before you answer the banner nothing at all is kept in your browser; once you decline, the only thing kept is a flag recording that choice, next to your cookie choice itself. Inside the authenticated app, declining means no browser analytics are sent at all.

We do not run retargeting or remarketing audiences, we do not sell or share cookie data with data brokers, and we do not track you across other websites. Google Analytics, Google Ads, Contentsquare and Vercel Analytics run only on Kiaro’s public marketing and documentation pages. PostHog also runs inside the authenticated app, as described in Section 5, with clicked text masked and page addresses stripped of their query string. None of these load in the client portal, and your client names, project data and invoices are never sent to them.

11. International Data Transfers

Our primary database is hosted in the European Union (Neon). However, some of our service providers operate in the United States. When your data is transferred outside the EEA, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Data Processing Agreements (DPAs) with all sub-processors.
• Providers who participate in recognized data protection frameworks.

12. Children's Privacy

Kiaro is a business tool designed for professionals. The Service is not intended for individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected data from a child under 16, we will take steps to delete that information promptly. If you believe a child under 16 has provided us with personal information, please contact us at hello@kiaro.io.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Notify you via email or an in-app notification for significant changes.
• Provide at least 30 days' notice before material changes take effect where required by law.

Your continued use of the Service after changes become effective constitutes acceptance of the updated policy.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We aim to respond to all privacy-related inquiries within 30 days.