Privacy Policy

Klaie is where teams do some of their most important work, so we know you're trusting us with information that matters. This policy explains what we collect, why, who helps us process it, how long we keep it, and the choices and rights you have. We've tried to write it plainly. Where a term has a specific meaning, it's in bold the first time it appears.

1. Who we are and what this policy covers

[Klaie legal entity name] ("Klaie", "we", "us") provides Klaie, an AI workspace for organizations, through our website, web app, browser extension and related services (together, the "Service"). This policy applies when you visit our website, create or use a Klaie account, install the Klaie Call extension, or contact us. It doesn't cover third-party websites or apps, including apps you connect to Klaie, which have their own policies.

Klaie is a business service. Most personal information in Klaie is put there by, or on behalf of, an organization that uses Klaie (a "Customer"): for example, an employee's account, their conversations, and the company documents they work with. For that information ("Customer Data"):

• the Customer is the controller (under US state privacy laws, the "business") and decides what is processed and why; and
• Klaie is a processor (or "service provider") and processes it only to provide the Service, following the Customer's instructions in its agreement with us, including any data processing agreement ("DPA").

If your account belongs to your employer's or another organization's workspace, that organization controls your account and the content in its workspace. Its administrators may be able to access and manage it, and its own privacy notice applies too. Questions and requests about that information are best sent to the organization; if you contact us instead, we'll pass your request on and help them respond.

Klaie is the controller for a smaller set of information that we handle for our own purposes: website visits, sign-up and sign-in, communications with us, billing contacts, security and abuse prevention, and aggregated service metrics. If you create a workspace for yourself rather than join one, you are the Customer for that workspace.

2. Information we collect

We collect only what we need to provide, protect and improve the Service. What we collect depends on how you use Klaie.

Information you and your organization provide

Account information. Your name, email address, password (stored only as a salted hash by our authentication provider; we never see it in plain text), job title or role, profile picture, the organizations and groups you belong to, invitations you send or receive, and your preferences, such as theme, default intelligence tier and notification settings.

Your content. What you and your colleagues put into the Service or create with it, including:

• messages and prompts, and the answers Klaie generates;
• files you upload, and the documents, notes and collections added to your organization's shared knowledge;
• documents, presentations, spreadsheets, charts, diagrams, images and other artifacts Klaie creates or edits, with their version history;
• tools Klaie builds for you (small interactive apps such as trackers, calculators or games) and what they save;
• memories Klaie keeps about your working preferences and context, which you can review and delete at any time;
• agents, deep research, routines and their results; and
• sharing settings, links, access requests, approvals and comments.

Feedback. If you rate an answer or tell us what went wrong, we keep your rating, the reason you picked, any comment you add and a short excerpt of the answer. Your organization's administrators can see this feedback, and we use it to fix problems and improve Klaie.

Communications. What you send us when you ask for support, send feedback or take part in a pilot, and records of the service emails we send you, such as account confirmations, password resets, invitations and notifications.

Information from connected apps

If you or your administrator connect Google Workspace or Microsoft 365, Klaie stores encrypted access tokens and reads email, calendar events, files, chats and sites that your account can already open. It reads them only when it needs to: to answer you, to run a routine you set up, or to index documents your administrator chose to make searchable. Klaie never sends, posts, schedules or changes anything in a connected app without your approval, or an approved routine your administrator set up. Section 13 describes our additional commitments for Google user data.

Information collected automatically

Usage and device information. Which features and intelligence tiers are used, which AI model answered, token counts, response times and errors, and the IP address, browser and device used to sign in or use the Service. We use this to run, secure and improve the Service, to apply usage limits and, for paid plans, to bill accurately.

Audit records. An append-only log of security-relevant events, such as sign-ins, sharing and permission changes, access to protected documents, tool use, approvals and administrative actions, with the person, time, IP address and outcome. Your organization's administrators rely on it. The log doesn't contain the text of your messages or documents.

Cookies and similar technologies. We use a small number of cookies to keep you signed in and remember your choices. We don't use advertising or analytics trackers. Our Cookie Policy lists every one.

Information from other sources

• Your organization and colleagues, for example when someone invites you to a workspace (your email address and the role they give you) or shares something with you.
• Sign-in providers. If you sign in with Google or Microsoft, that provider sends us your name, email address and profile picture.
• Security services. If bot protection is turned on for sign-up, Cloudflare tells us whether a sign-up attempt looks automated.

Klaie Call

When you start a voice call, your microphone audio is streamed to the AI provider in real time so Klaie can listen and answer. Only while you choose to share a screen, window or tab, still images of it (about one per second when the picture changes) are streamed too, so Klaie can see what you mean and point at it. In standard calls, when Klaie points at something, the image it pointed on also passes through Klaie's servers to the same provider for a closer look, so the pointer lands on the right spot; it isn't kept.

Klaie does not record or store call audio or screen images. The live transcript stays in your browser during the call. It reaches our servers only if you ask for a recap, and it's stored only if you turned on "Keep the transcript" before the call and then save the recap. We keep operational details of each call, such as when it started and ended, why it ended and how many screen images were sent or searches made, to run the Service and apply call limits.

During a call, Klaie can also look things up and start work for you. When it searches your organization's documents or the web, the search words go to Klaie's servers and, for the web, to our search providers, as they do in chat; the results aren't kept with the call. When you ask Klaie to make something (a document, an email draft, research), it writes your request into a new chat in your account, which is stored and deleted like any other chat.

The Klaie Call browser extension

If you install the optional Klaie Call extension for Chrome, it runs on the websites you visit so that, when you share one of those tabs in a Klaie call, Klaie can draw its pointer directly on the page and show call controls there.

• On each page, it sets a random identifier that only Klaie's own pages can see, and only while they are capturing that tab.
• To line a mark up with the element Klaie means (a button, a card, a line of text), it looks at the layout and visible text of the shared page, inside your browser, while it draws.
• It does not collect or send the content of the pages you visit, your browsing history or anything you type. The only thing it stores is the list of sites where you paused it, in your browser.

Screen images of a shared tab are sent by the Klaie web app as described above, not by the extension.

Information we ask you not to share

We don't knowingly collect special categories of personal information (such as health, biometric, religious or political information) or government identification numbers. Please don't put them into Klaie unless your organization has a lawful basis and suitable safeguards for doing so, and consider Sensitive mode for confidential material.

3. How we use information

We use personal information to:

1. Provide the Service: authenticate you, apply your organization's settings and permissions, answer your requests, run the tools you ask for, store and show your content, and send service emails.
2. Keep access controls working: check what you're allowed to see before any document or connected-app content is retrieved or sent to a model, and keep the audit log your administrators rely on.
3. Keep Klaie safe and reliable: detect and prevent abuse, fraud and automated sign-ups, apply rate and usage limits, investigate incidents, and monitor capacity and errors.
4. Support you: answer your questions and fix problems you report.
5. Improve the Service: understand which features are used and where Klaie falls short, using aggregated or de-identified metrics and the feedback you choose to give.
6. Communicate with you about your account and the Service. We'll send marketing emails only if you've agreed to receive them, and each one will include a way to unsubscribe.
7. Manage our relationship with Customers, including billing for paid plans.
8. Meet legal obligations and protect our rights and the rights, safety and property of our users and others.

Our team doesn't look at your organization's content unless that's needed to give you support you asked for, to investigate a security or abuse issue, to comply with the law, or the Customer has given permission.

What we never do:

• We don't sell or rent personal information.
• We don't use it for targeted or cross-context behavioral advertising, and there are no ads in Klaie.
• We don't use Customer Data to train or fine-tune Klaie's own AI models. Any model we train, for example for Sensitive mode, is trained on synthetic or licensed data, not on your content, unless a Customer agrees otherwise in writing.
• We don't make decisions that have legal or similarly significant effects on you based solely on automated processing.

4. How AI works in Klaie

To answer a request, Klaie sends the relevant parts of the conversation to an AI model, together with any files, documents or connected-app content that the request needs and that you're allowed to see, and then shows you the answer. Where that processing happens depends on what you're doing.

Klaie 1, Kai 1 and Mol 1. These intelligence tiers send each request to a model from one of the third-party AI providers listed in section 5. Providers process requests to generate answers under their own terms. Some providers offer their models to us on terms (often free tiers) that allow them to use prompts and responses to improve their products, which can include review by their staff. Klaie says so in the intelligence picker whenever this applies to a tier. An administrator can ask us to turn off any tier for their organization, and anyone can choose Sensitive mode instead. If your organization needs every request handled under terms that rule out provider training, please talk to us before adding confidential material.

Searching your documents. To make your organization's documents searchable, Klaie creates embeddings (numeric representations of the text) using Google's Gemini API, under the same Google terms as other Gemini requests. Sensitive mode uses a separate, private index built on infrastructure Klaie operates.

Images. When you ask Klaie to generate a picture, the description is sent to Cloudflare Workers AI. Charts, diagrams and other graphics that Klaie draws with code are rendered on Klaie's own servers.

Klaie Call. Standard calls use Google's Gemini Live API for real-time voice and screen understanding. Under the API plan Klaie currently uses for calls, Google may use call audio, transcripts and screen images to improve its products. The call screen tells you when this applies, so you can avoid sharing confidential material. Sensitive calls run only on infrastructure Klaie operates, and aren't available where none is set up.

Sensitive mode. Sensitive requests are processed only on infrastructure that Klaie operates. They are never sent to a third-party AI provider and never fall back to another tier, and tools that would send your content outside Klaie are switched off. Web search and reading connected apps are off by default in Sensitive mode. If an administrator turns them on, only the search query or read request leaves Klaie (search queries are checked to keep company details out, and every one is logged); the conversation itself stays on Klaie's infrastructure.

Web search and browsing. When Klaie searches the web or reads a page, it sends search queries to search providers and fetches pages from Klaie's servers. When Klaie writes a search query from your conversation, it leaves out internal figures and your organization's name unless you typed them yourself. The browser agent visits sites from Klaie's servers or a cloud browser service, never from your device, and hands control back to you at sign-in pages, CAPTCHAs and payment forms.

Tools Klaie builds run in a locked-down sandbox in your browser with no network access, so they can't send information anywhere. What a tool saves is stored with your conversation.

AI can be wrong. Klaie shows its sources and labels its own analysis, but answers can still be inaccurate or incomplete. Please check important answers before relying on them; our Terms of Service explain more.

5. How we share information

We share personal information only as described here, and we don't sell it.

Within your organization. Administrators can manage accounts, see usage, feedback and the audit log, set policies and, depending on the organization's settings and the law, access content in its workspace. What you share with colleagues, or through a link, is visible to the people you share it with.

Service providers (sub-processors). We rely on carefully chosen companies to host Klaie, run AI models, search the web and send email. They may process personal information only to provide their services to us, under contracts that require confidentiality, security and appropriate data-protection terms. For AI providers, the terms described in section 4 also apply.

You can ask [privacy email address] for the current list. Customers with a DPA are told before we add or replace a sub-processor that handles Customer Data.

Apps you connect. When you approve an action in a connected app, such as sending an email, Klaie sends what's needed to that app's provider.

Websites you ask Klaie to search or visit receive the query or page request from Klaie's servers, as they would from any visitor.

Legal requests and safety. We disclose information when the law, a court order or other valid legal process requires it, or when it's necessary to protect the rights, property or safety of Klaie, our users or others. We review each request carefully, and where the law allows, we tell the affected Customer first and refer the requester to them.

Business transfers. If Klaie is involved in a merger, acquisition, financing or sale of assets, information may transfer as part of that deal. The information remains subject to this policy, and we'll tell affected Customers before it becomes subject to a different one.

With your permission or at your direction, for example when you make a link public.

Aggregated or de-identified information that can't reasonably be used to identify you or your organization, such as overall usage statistics.

6. Where information is stored and transferred

Klaie's database and file storage are hosted in Sydney, Australia, and our application servers run in the same region, delivered through our hosting provider's global network. The AI, search and email providers listed in section 5 may process information in the United States, the European Union and other countries.

When we transfer personal information from the European Economic Area, the UK or Switzerland to a country that doesn't have an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum and Swiss amendments where needed) or another lawful transfer mechanism, together with supplementary measures where appropriate. You can ask us for a copy of the relevant safeguards.

7. How long we keep information

We keep personal information only for as long as we need it for the purposes in this policy, and then delete it or make it anonymous.

• Your organization's content is kept while the workspace exists, unless a user or administrator deletes it sooner.
• Deleted conversations disappear from your history straight away and Klaie stops using them. We permanently erase them within 30 days.
• Temporary chats aren't stored on our servers at all by default. If your organization chooses to keep them for a while, they're deleted automatically at the end of the period it sets (at most 30 days).
• Memories are kept until you or your administrator delete them.
• Klaie Call: no audio or screen images are kept. A transcript is kept only if you saved it, like other content. Call details (start, end, counts) are kept with usage records.
• Connected apps: disconnecting an app deletes its stored access tokens and the content Klaie indexed from it.
• Usage records and the audit log are kept while the workspace exists, so administrators can review activity and limits and billing stay accurate, unless a Customer's agreement sets a different period.
• When you delete your account, we delete your profile, conversations, memories and connections, and any workspace you're the only member of. Files you added to your organization's shared knowledge stay with the organization, and audit entries about your past actions stay with it under an anonymous identifier rather than your name or email.
• When a workspace is deleted, its content is deleted with it. When a Customer's subscription or pilot ends, we give the Customer 30 days to export its content and then delete it.
• Backups: deleted information can remain in encrypted backups for up to 35 days, until they're overwritten.

We may keep information for longer where the law requires it, or where we need it to resolve a dispute, prevent fraud or abuse, or enforce our agreements. Where we do, we keep only what's needed and use it only for that purpose.

8. How we protect information

Security is built into how Klaie works, not added later. Our safeguards include:

• encryption in transit (TLS) and at rest;
• connected-app tokens encrypted with a separate key and never sent to your browser;
• each organization's data kept separate in the database by row-level security;
• permission checks before any document or connected-app content is retrieved or sent to a model;
• your approval before any action in a connected app;
• a sandbox with no network access for tools that Klaie builds;
• an append-only audit log;
• rate limits and sign-up checks against automated abuse; and
• access by our team on a need-to-know basis only.

No system is perfectly secure. If a security incident affects your personal information, we'll notify the affected Customer and, where the law requires, you and the relevant authorities, without undue delay. If you think you've found a security issue in Klaie, please tell us at [legal email address].

9. Your choices and rights

Controls in Klaie

At any time, you can:

• delete conversations, or use temporary chats that aren't kept;
• review and delete what Klaie remembers about you;
• choose Sensitive mode for confidential work;
• disconnect connected apps;
• change your password and sign out on every device;
• leave a workspace; and
• delete your account in Settings → Privacy and data.

Your organization's administrators may manage some of these settings for everyone in the workspace.

Your privacy rights

Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, receive a portable copy, object to or restrict how we use it, withdraw consent you gave, and not be subject to decisions based solely on automated processing that significantly affect you. Section 10 adds details for some regions.

How to make a request. Email [privacy email address]. To protect your information, we'll verify your identity, usually by confirming the request from your account's email address. Where the law allows, you can ask an authorized agent to make a request for you. We'll respond within the time the law requires.

If your account belongs to an organization, we'll usually refer requests about that organization's Customer Data to it, as the controller, and help it respond.

We'll never treat you differently, or offer you a worse service, because you exercised your privacy rights.

Concerns and complaints. If you have a concern, please tell us first; we'd like the chance to put it right. You also have the right to complain to a data protection authority, such as your local supervisory authority in the EU, the UK Information Commissioner's Office or the Office of the Australian Information Commissioner.

10. Additional information for certain regions

European Economic Area, United Kingdom and Switzerland

Where Klaie is the controller, we rely on these legal bases:

Where Klaie processes Customer Data as a processor, the Customer determines the legal basis.

EU/UK representative: [EU/UK representative, if required]

United States

Some US state privacy laws, including California's, ask us to describe our practices in specific terms.

• Categories of personal information we've collected in the last 12 months: identifiers (such as name, email address and IP address); account login credentials; professional information (such as job title and organization); commercial information (such as plan and billing records); internet or other electronic network activity (such as usage records and logs); audio and visual information (such as profile pictures, and Klaie Call audio and screen images, processed live); and inferences in the form of memories about your working preferences, when memory is on.
• Sources: you, your organization and colleagues, your devices, and services you connect or sign in with (section 2).
• Purposes: the business purposes in section 3.
• Disclosures: we disclose each category to the service providers in section 5, for the business purposes in section 3.
• No sale or sharing. We don't sell personal information or share it for cross-context behavioral advertising, and haven't in the last 12 months. We don't knowingly collect personal information from anyone under 16. Because there's nothing to opt out of, Klaie has no opt-out link, but we treat a Global Privacy Control signal as a valid request anyway.
• Sensitive personal information: we use account login credentials only to authenticate you, and don't use sensitive personal information to infer characteristics about you.
• Retention: section 7.
• Appeals. If we decline your request, we'll explain why. You can appeal by replying to our decision, and if you're unhappy with the outcome of your appeal, you can contact your state attorney general.

11. Children

Klaie is for business use and is not directed to children. You must be at least 18, or the age of majority where you live, to use it. If we learn that we hold personal information about a child, we'll delete it.

12. Pilots and early access

If your organization takes part in a pilot or early-access program, this policy applies in full. We may contact pilot users to ask about their experience. Any feedback we publish is anonymized unless you agree otherwise.

13. Google user data

Klaie's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Google user data only to provide and improve the user-facing features you use it for; we don't use it for advertising or sell it; we don't use it to develop, improve or train generalized AI or machine-learning models; and nobody at Klaie reads it unless you've asked us to, it's needed for security or to comply with the law, or it has been aggregated and anonymized.

14. Changes to this policy

We'll update this policy as Klaie changes. When we do, we'll post the new version here and change the "last updated" date. If a change is material, we'll tell Customers' administrators by email or in the product before it takes effect. Previous versions are available on request.

15. Contact us

If you have a question about this policy or how we handle your information, we'd like to hear from you.

[Klaie legal entity name]
[Registered office address]
Privacy questions and requests: [privacy email address]
EU/UK representative: [EU/UK representative, if required]