Privacy policy

1. Introduction

Kiaro ("we," "us," or "our") is a SaaS operating system built for independent client work. We provide tools for client management, project tracking, invoicing, document creation, and AI-powered assistance to help you run your practice.

This Privacy Policy describes how we collect, use, disclose, and protect information when you use our website, application, and services (collectively, the "Service"). By using Kiaro, you agree to the collection and use of information in accordance with this policy.

Kiaro is the data controller responsible for your personal information. If you have questions about how we process your data, please contact us at hello@kiaro.io.

2. Information We Collect

2.1 Account Information

When you register for Kiaro, we collect your name, email address, and a password (stored as a secure hash). If you create a workspace, we also collect your workspace name and organizational details you choose to provide.

2.2 Business Data You Provide

As you use the Service, you may provide information about your clients, projects, tasks, invoices, proposals, and other business data. This content is created and controlled by you. We process it solely to provide the Service to you.

2.3 Payment Information

Subscription payment processing is handled by Lemon Squeezy LLC, who acts as the Merchant of Record. We do not store your full credit card number, CVV, or bank account details on our servers. Lemon Squeezy processes your billing information, handles tax collection, and manages subscription status.

Invoice payments from your clients are processed by Stripe via Stripe Connect. Stripe receives your clients' payment method details and transaction amounts for the purpose of collecting invoice payments on your behalf.

2.4 AI Interaction Data

When you use AI-powered features (such as content generation, AI search, or AI-assisted document drafting), we send relevant context to our AI providers (Anthropic, OpenAI, and Google) to generate responses. This may include portions of your business data that are relevant to the specific request. See Section 6 for full details on AI data processing.

2.5 File Uploads

You may upload files (documents, images, attachments) to the Service. These files are stored securely on Cloudflare R2 and are associated with your account and workspace.

2.6 Usage Data

We automatically collect information about how you interact with the Service, including pages visited, features used, time spent, browser type, device information, IP address, and referring URLs. This data helps us improve the Service and diagnose issues.

2.7 Error & Performance Data

We use Sentry for error tracking and performance monitoring. When an error occurs, Sentry may collect technical information such as stack traces, browser details, and anonymized user identifiers to help us diagnose and fix issues.

3. How We Use Your Information

We use the information we collect to:

• Provide and operate the Service : manage your account, workspace, clients, projects, invoices, and all core functionality.
• Power AI features : generate content, provide AI search results, and deliver AI-assisted recommendations based on your business data.
• Process payments : manage subscriptions through Lemon Squeezy and facilitate client invoice payments through Stripe Connect.
• Send transactional communications : email you about account activity, invoice status changes, client portal notifications, and important service updates.
• Improve the Service : analyze usage patterns to fix bugs, optimize performance, and develop new features.
• Ensure security : detect and prevent fraud, abuse, and unauthorized access.
• Comply with legal obligations : respond to lawful requests and enforce our terms.

4. Legal Basis for Processing

We process your personal information under the following legal bases:

• Contract performance: Processing necessary to provide the Service you signed up for, including account management, data storage, and feature delivery.
• Legitimate interests: Processing necessary for our legitimate business interests, including improving the Service, ensuring security, preventing fraud, and conducting analytics. We balance these interests against your rights and freedoms.
• Consent: Where required, we obtain your consent before processing, such as for optional marketing communications. You may withdraw consent at any time.
• Legal obligation: Processing necessary to comply with applicable laws, regulations, or legal processes.

5. Data Sharing & Third Parties

We do not sell your personal information. We share data with third-party service providers only as necessary to operate the Service:

6. AI & Data Processing

Kiaro uses third-party AI providers to power its AI command bar and related features. We want to be transparent about how your data is handled in this context.

AI Providers We Use

Kiaro routes AI requests to the most suitable provider depending on the task. The providers we use are:

• Anthropic (Claude) : Used for complex generation tasks such as proposals, contract analysis, email drafting, and multi-step command orchestration.
• OpenAI (GPT) : Used for lightweight queries, search, and classification tasks.
• Google (Gemini) : Used for batch processing, fallback operations, and cost-optimized tasks.

What Data Is Sent

• When you use the AI command bar, we send the minimum context necessary to fulfill your request. This may include client names, project descriptions, task details, invoice totals, and time entry summaries.
• We never send email addresses, phone numbers, bank details, tax IDs, Stripe account information, authentication tokens, or file download URLs to any AI provider. These fields are stripped before processing.
• Data is only sent when you actively use an AI feature. If you do not interact with the AI command bar, no data is sent to any provider.

Your Data Is Not Used for Training

• All three providers are bound by commercial API terms and Data Processing Agreements (DPAs) that explicitly prohibit the use of your data to train or improve AI models.
• Anthropic may temporarily retain API inputs for up to 30 days for trust and safety purposes, then deletes them. OpenAI offers zero-retention options. Google's paid API tier does not use data for training.

AI Usage Logs

• We log AI interactions (action type, model used, token count) for usage metering and cost tracking. These logs do not contain the content of your requests or responses.
• AI usage logs are automatically purged after 90 days.
• Logs are included in data exports and are deleted when you delete your account.

Opting Out

AI features can be disabled entirely from Settings → Workspace. When disabled, Kiaro operates in manual-only mode and no data is sent to any AI provider. All features remain accessible through the sidebar navigation.

7. Data Storage & Security

We take the security of your data seriously:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher.
• Encryption at rest: Your data is encrypted at rest in our database (Neon) and file storage (Cloudflare R2).
• Access controls: We implement role-based access controls and multi-tenant isolation. Your data is logically separated from other customers' data using tenant-level access controls enforced at the database query level.
• Authentication security: Passwords are hashed using industry-standard algorithms. Session tokens are securely generated and managed.
• Provider compliance: Our infrastructure providers (Neon, Cloudflare, Vercel, Stripe, Lemon Squeezy) maintain SOC 2 Type II compliance and undergo regular independent security audits.
• Incident response: In the event of a data breach, we will notify affected users within 72 hours as required by applicable law.

8. Data Retention

We retain your personal information and business data for as long as your account is active and as needed to provide the Service.

• Active accounts: Your data is retained for the duration of your subscription. You may export or delete your data at any time.
• Account deletion: When you close your account, we initiate deletion of your personal and business data within 30 days. Some data may be retained for up to 90 days in encrypted backups before being permanently purged.
• Legal requirements: We may retain certain data for longer periods where required by law (e.g., invoice records for tax compliance, typically 7 years).
• Anonymized data: We may retain anonymized, aggregated usage statistics that cannot be used to identify you, for product improvement purposes.

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

Under GDPR (European Economic Area)

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your personal data ("right to be forgotten").
• Right to restrict processing: Request that we limit how we use your data.
• Right to data portability: Receive your data in a structured, machine-readable format (CSV export is available).
• Right to object: Object to processing based on legitimate interests.
• Right to lodge a complaint: File a complaint with your local data protection authority.

Under CCPA (California)

• Right to know: Request information about what personal data we collect, use, and disclose.
• Right to delete: Request deletion of your personal information.
• Right to opt-out of sale: We do not sell personal information, so this right is automatically satisfied.
• Right to non-discrimination: We will not discriminate against you for exercising your rights.

To exercise any of these rights, contact us at hello@kiaro.io. We will respond within 30 days.

10. Cookies & Tracking

Kiaro groups cookies and similar browser storage into three purposes. You choose the second and third when you first visit, and you can change or withdraw that choice at any time using the Cookie settings link in the footer of any public page.

• Strictly necessary: Required for authentication, session management, security and bot protection, and to remember your cookie choice itself. These cannot be disabled because the Service does not work without them.
• Analytics: Used on the public marketing site (kiaro.io and kiaro.io/docs) to understand aggregate usage and improve the site. We use Google Analytics, PostHog, Contentsquare, and Vercel Analytics for this. PostHog, Contentsquare and Vercel Analytics do not load at all until you accept this category.
• Advertising: Used to measure which advertisements led to a signup, so we do not keep paying for ads that do not work. This covers Google Ads conversion measurement and the storage of a Google click identifier (the gclid) in a first-party cookie for up to 90 days. Nothing is stored for this purpose until you accept this category.

How the Google tag behaves before you choose. We use Google Consent Mode v2. The Google tag itself is present on our public pages before you answer the banner, but until you accept it is not permitted to write or read cookies, and it sends only an anonymous, cookieless signal that a page was viewed. That signal contains your IP address, the page address and your browser type, which Google uses to estimate aggregate results. It does not identify you and it is not used to build an advertising profile. If you visit from the EEA, the UK or Switzerland, every optional signal starts denied by default. If you reject, it stays that way permanently.

We do not run retargeting or remarketing audiences, we do not sell or share cookie data with data brokers, and we do not track you across other websites. Every script named above runs only on Kiaro’s public marketing and documentation pages. None of them load inside the authenticated app or the client portal, so your client names, project data and invoices are never exposed to them.

11. International Data Transfers

Our primary database is hosted in the European Union (Neon). However, some of our service providers operate in the United States. When your data is transferred outside the EEA, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Data Processing Agreements (DPAs) with all sub-processors.
• Providers who participate in recognized data protection frameworks.

12. Children's Privacy

Kiaro is a business tool designed for professionals. The Service is not intended for individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected data from a child under 16, we will take steps to delete that information promptly. If you believe a child under 16 has provided us with personal information, please contact us at hello@kiaro.io.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Notify you via email or an in-app notification for significant changes.
• Provide at least 30 days' notice before material changes take effect where required by law.

Your continued use of the Service after changes become effective constitutes acceptance of the updated policy.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We aim to respond to all privacy-related inquiries within 30 days.