Privacy Policy

Who operates Kairo

Kairo is an independent AI assistant operated by Anir Laslami. For privacy questions, support, or data requests, email [email protected].

Information you provide

We store account usernames, password hashes, invite and account records, and sign-in information. Kairo also stores the chats, uploaded files and extracted text, saved memories and profile details, study activity, projects, trip plans, created files, drafts, calendar proposals, and reminders you choose to use. Preferences may be saved in your browser or with your account.

We use these records to authenticate you, answer your requests, remember your saved work, personalize features, and operate the service. Passwords are hashed; Kairo does not store them as readable passwords.

Optional Google account access

Google access begins only after you choose Connect Google and grant permission. Kairo requests Gmail read access to find messages and read their headers, snippets and available text; Gmail send access to send an email you review and confirm; and Calendar event access to read your primary-calendar agenda and add an event you review and confirm. The current integration does not download Gmail attachments or automatically delete mailbox messages or calendar events.

Google provides access and refresh tokens so Kairo can make authorized requests, together with your connected account email. Tokens are encrypted with Windows account protection on the server and are not included in AI prompts. Google message and calendar content needed for a task is processed by local AI on the operator’s server. Connecting Google is optional; email drafts, calendar handoffs and in-app reminders also work without it.

Fetched Google content is held in bounded task memory. Requested summaries, drafted content, and outputs can be saved with your Kairo work. Kairo does not maintain a separate permanent copy of your whole mailbox or calendar.

Limits on Google data use

Google API information is used for the connected features you request, subject to Google’s user data policy and Limited Use requirements. We do not sell Google data, use it for advertising or credit decisions, or use it to train shared or general-purpose AI models.

Human review of Google content is limited to your explicit permission for specific support, necessary security investigations, legal obligations, or aggregated anonymized operations allowed by that policy. Agent chats are excluded from the operator’s routine feedback excerpts and optional training logs.

Other feedback and learning features

Ordinary answer ratings may appear with short question and answer excerpts in the operator’s quality dashboard. Optional owner-controlled learning records can store ordinary interactions for evaluation or model improvement when explicitly enabled. This does not apply to Agent conversations or connected Google data. The separate Internet Explorer experiment researches public websites; it does not automatically read member inboxes or private chats.

Other services and sharing

Cloudflare handles the public connection to Kairo and may process network information such as IP addresses and request metadata. Google receives requests needed for your connected account actions. Web searches send search queries to search services; reading a website contacts that website. Information you ask Kairo to include in an email or event is sent to Google and, for email, to the recipients you approve. Opening an external handoff or downloading and sharing a file is under your control.

We do not sell personal data or provide it to advertising networks. Other disclosure is limited to operating features you request, necessary service security, and applicable legal requirements. Third-party services have their own policies.

Storage, security and retention

Saved app records are hosted on the operator-managed server. Access in the app is scoped to your signed-in account. The public service uses HTTPS, protected session cookies and checks on authenticated changes. Google tokens are encrypted, but chats and saved files are not end-to-end encrypted: the server operator has technical access for operating the service. No system can promise absolute security.

Uploaded images and generated images/videos normally expire after 24 hours; physical cleanup runs while the server is operating. Document uploads ordinarily stay until removed unless an expiry setting is enabled. Chats, projects, memories, study records and created documents/sites do not have a general automatic expiry. Expiring an image does not erase earlier chat text or saved outputs. Existing operational backups, if maintained, may contain earlier copies until those backups are removed.

Your controls and deletion requests

You can delete supported chats, uploads and creations using the app, and clear saved personal memory using its Forget control. Assistant lets you edit or dismiss reminders and drafts. Dismissing an action hides it but does not permanently erase its saved record; contact us for permanent action-record or account deletion and other access or correction requests. We may need to verify that a request belongs to the account before acting.

Assistant → Disconnect Google removes locally saved Google tokens and pending connection states. It does not erase Google-derived summaries or drafts already saved in Kairo. Delete those records or request their removal separately. To revoke Google’s authorization as well, remove Kairo from your Google account connections. Revoking access prevents future authorized account reads, but does not delete messages already sent or events already added in Google.

Changes and contact

Changes to this policy will be posted here with a revised date. For questions or requests about your data, contact [email protected]. Rights available under applicable privacy law are not limited by this policy.