Privacy Notice

1. What Information Do We Collect?

Personal information you disclose to us

We collect personal information that you voluntarily provide to us when you register on the Website, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Website, or otherwise when you contact us.

The personal information we collect may include the following:

• Names
• Email addresses
• Job titles
• Usernames and passwords
• Contact preferences
• Billing addresses and payment data

Sensitive Information. We do not process sensitive information.

Payment Data. We may collect data necessary to process your payment if you make purchases, such as your payment instrument number and associated security code. All payment data is stored and processed by Stripe. You may find their privacy notice at stripe.com/privacy.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Information automatically collected

We automatically collect certain information when you visit, use, or navigate the Website. This information does not reveal your specific identity but may include device and usage information such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, and information about how and when you use our Website. This information is primarily needed to maintain the security and operation of our Website, and for our internal analytics and reporting purposes.

The information we collect includes log and usage data, device data, and general location data.

2. How Do We Process Your Information?

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To facilitate account creation, authentication, and manage user accounts
• To deliver and facilitate delivery of services to you
• To respond to user enquiries and offer support
• To send administrative information to you
• To send you product updates, feature announcements, and other communications about Kyo
• To fulfil and manage your subscription
• To request feedback
• To protect our Services and prevent fraud
• To enforce our terms, conditions, and policies
• To respond to legal requests and prevent harm
• To comply with our legal obligations

3. What Legal Bases Do We Rely On?

EU and UK residents

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on in order to process your personal information. We may rely on the following legal bases:

• Consent — where you have given us permission to process your data for a specific purpose
• Performance of a Contract — where processing is necessary to deliver our Services to you
• Legal Obligations — where we are required to process data to comply with applicable law
• Legitimate Interests — where processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights

Canadian residents

We may process your information if you have given us specific permission (express consent) to use your personal information for a specific purpose, or in situations where your permission can be inferred (implied consent). You can withdraw your consent at any time by contacting us at hello@trykyo.com.

4. When and With Whom Do We Share Your Personal Information?

We may share your personal information in the following situations:

• Business Transfers — in connection with any merger, sale of company assets, financing, or acquisition
• Affiliates — with our affiliates, who are required to honour this privacy notice
• Business Partners — with trusted partners to offer you certain products, services, or promotions
• Vendors and Service Providers — including Supabase (database and authentication), Stripe (payment processing), Vercel (hosting), and Anthropic / OpenAI (AI processing for Kyoshi)

We do not sell your personal information to third parties.

5. Google API Data

If you choose to connect your Google account with Kyo, we may access certain information from your Google account — such as your name, email address, and profile picture — strictly for the purpose of providing and improving our Services. We do not sell, rent, or share your Google user data with third parties for their own uses. We retain your Google user data only as long as necessary to provide our Services or as required by law.

Our use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

If you wish to delete your Google account data from Kyo, please contact us at hello@trykyo.com and we will promptly remove your information as required.

6. Do We Offer AI-Based Products?

Yes. Kyo offers AI-powered features through Kyoshi, your team's AI agent. When you use these features, your workspace data may be processed by third-party AI providers (Anthropic and OpenAI) solely to generate responses, summaries, and insights for your use. Your data is not used to train AI models.

By using Kyoshi and other AI-powered features, you acknowledge that relevant workspace data may be transmitted to and processed by these third-party AI providers in accordance with their respective privacy policies. For more information, please contact us at hello@trykyo.com.

7. How Do We Handle Your Social Logins?

Kyo offers you the ability to register and log in using your third-party social media account details (such as your Google login). Where you choose to do this, we will receive certain profile information about you from your social media provider, which may include your name, email address, and profile picture.

We will use the information we receive only for the purposes described in this privacy notice. Please note that we do not control, and are not responsible for, other uses of your personal information by your third-party social media provider. We recommend you review their privacy policies to understand how they collect, use, and share your information.

8. Is Your Information Transferred Internationally?

Our infrastructure is hosted primarily in the United States via Vercel and Supabase. If you are accessing our Services from outside the US, please be aware that your information may be transferred to, stored, and processed in the United States and other jurisdictions where our service providers operate.

If you are a resident in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, these countries may not have data protection laws as comprehensive as those in your country. We will take all necessary measures to protect your personal information in accordance with this privacy notice and applicable law.

9. How Long Do We Keep Your Information?

We will only keep your personal information for as long as it is necessary for the purposes set out in this privacy notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements).

Upon account deletion or termination, your data will be retained for 30 days before permanent deletion. During this period you may contact us to request account restoration. After 30 days, your account data will be permanently deleted, except where retention is required by law.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise such information, or securely store it and isolate it from further processing until deletion is possible.

10. How Do We Keep Your Information Safe?

We have implemented appropriate and reasonable technical and organisational security measures designed to protect the security of any personal information we process. These include encrypted data storage and transmission via Supabase and Vercel's security infrastructure.

However, despite our safeguards, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure. We cannot promise or guarantee that hackers, cybercriminals, or other unauthorised third parties will not be able to defeat our security measures. You use our Services at your own risk, and we encourage you to take steps to keep your account credentials secure.

11. Do We Collect Information from Minors?

We do not knowingly solicit data from or market to children under 18 years of age. By using the Service, you represent that you are at least 18 years of age. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at hello@trykyo.com.

12. What Are Your Privacy Rights?

Depending on your location, you may have rights that allow you greater access to and control over your personal information, including the right to:

• Request access to and obtain a copy of your personal information
• Request rectification or erasure of your personal information
• Restrict the processing of your personal information
• Data portability (where applicable)
• Object to the processing of your personal information in certain circumstances

To exercise any of these rights, please contact us at hello@trykyo.com. We will consider and act upon any request in accordance with applicable data protection laws.

Email communications and opt-out

By creating an account with Kyo, you agree to receive email communications from us, including transactional emails, product updates, feature announcements, and marketing communications. You may opt out of marketing emails at any time by clicking the "unsubscribe" link in any marketing email, or by contacting us at hello@trykyo.com. You will continue to receive transactional emails necessary for operating your Kyo account (such as password resets, receipts, and critical service notifications).

If you are a resident in the EEA or UK and you believe we are unlawfully processing your personal information, you have the right to complain to your local data protection supervisory authority. Details are available at ec.europa.eu.

13. Controls for Do-Not-Track Features

Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage no uniform technology standard for recognising and implementing DNT signals has been finalised. As such, we do not currently respond to DNT browser signals. If a standard for online tracking is adopted that we must follow in the future, we will inform you in a revised version of this privacy notice.

14. Do California Residents Have Specific Privacy Rights?

California Civil Code Section 1798.83 ("Shine The Light" law) permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please contact us at hello@trykyo.com.

If you are under 18 years of age, reside in California, and have a registered account with us, you have the right to request removal of unwanted data that you publicly post on the Website. To request removal of such data, please contact us using the contact information provided below, including your email address and a statement that you reside in California.

15. Do Australian Residents Have Specific Privacy Rights?

Kyo is an Australian company and complies with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). If you are located in Australia, you have the following rights in relation to your personal information:

• Access — You may request access to the personal information we hold about you
• Correction — You may request that we correct personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading
• Complaints — You may lodge a complaint with us if you believe we have breached the Australian Privacy Principles

We will respond to access and correction requests within a reasonable time. If we are unable to resolve your complaint, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

To exercise any of these rights, please contact us at hello@trykyo.com.

16. Do We Make Updates to This Notice?

We may update this privacy notice from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this page and will be effective as soon as it is accessible. If we make material changes to this privacy notice, we may notify you either by prominently posting a notice or by directly sending you a notification. We encourage you to review this privacy notice frequently to stay informed of how we are protecting your information.

17. How Can You Contact Us About This Notice?

If you have questions or comments about this notice, please contact us at:

18. How Can You Review, Update, or Delete Your Data?

Based on the applicable laws of your country, you may have the right to request access to the personal information we collect from you, change that information, or delete it in some circumstances. To request to review, update, or delete your personal information, please email us at hello@trykyo.com.