Privacy Policy

1. Information We Collect

When you use Kamili One, we collect the following types of information:

• Account Information: Name, email address, and password when you create a Kamili account.
• Usage Data: How you interact with Kamili One, including features used, actions taken, pages viewed, and timestamps.
• Device Information: Browser type, operating system, device type, IP address, and screen resolution.
• Cookies and Tracking: Cookies, local storage, and similar technologies for authentication and analytics.
• Content Data: Mail messages and drafts, Calendar events, Tasks, files, notes, reminders, attachments, AI prompts and outputs, and other content you create or connect to Kamili One.
• Connected Accounts: Account identifiers, connection settings, OAuth tokens, or app-specific credentials needed for the Google, Microsoft, Apple iCloud, and other Mail and Calendar accounts you choose to connect.

2. How We Use Your Information

We use information for the purposes below, subject to the connected account restrictions in Section 3:

• Provide, maintain, and improve Kamili One
• Authenticate your identity and manage your account
• Process subscription payments via Stripe
• Send transactional emails (account confirmations, password resets, billing receipts)
• Send onboarding and product updates to your Kamili account contact address (opt-out available). We do not use connected account content or information derived from it to create, target, or personalize these communications.
• Provide AI features when you request or enable them. Relevant prompts, messages, events, tasks, or other selected content may be sent to the AI provider to generate a response. Connected account data is used only to deliver the feature you request or enable, subject to Section 3. We do not use or permit providers to use connected account data to develop, improve, or train general-purpose AI or machine-learning models.
• Measure website and app usage to improve product quality and performance, using activity measurements that exclude connected account data and information derived from it
• Detect and prevent fraud, abuse, and security incidents

3. Connected Accounts and Google API Data

These limits apply to every account you connect, including Google, Microsoft, Apple iCloud, and other email or calendar providers. Connected account data includes messages, drafts, attachments, contacts, calendar events, related metadata, connection credentials, and information derived from that data. We access only the information authorized for the features you use.

• Providing your features: We access, store, and process connected account data to sync, display, search, organize, and manage your mail and calendars, perform actions you authorize, and provide related AI assistance you request or enable. This processing is limited to features available to you in Kamili One.
• No analytics or marketing use: We do not use connected account data for Google Analytics, other usage analytics, marketing, advertising, sale to data brokers, or credit or lending decisions. This restriction also covers aggregated, anonymized, and derived connected account data.
• No general model training: Google Workspace APIs and data obtained through them are not used to develop, improve, or train non-personalized AI or machine-learning models. We do not retain connected account data for those purposes or permit our AI providers to use it for those purposes. The same restriction applies to every connected provider.
• Limited sharing: With your consent, we share only the connected data needed by service providers to deliver the features you request or enable, including AI responses. Providers must process it on our instructions for that purpose. Other disclosures are limited to necessary security purposes or legal requirements.
• Limited human access: Our personnel may view connected account content only with your affirmative permission to view specific content, when necessary for security, or when required by law. We restrict access and protect data in transit using encrypted connections.

Kamili One's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. These specific restrictions govern connected account data wherever this policy discusses analytics, communications, AI, sharing, or retention.

You can disconnect an account in Kamili One and revoke its access through the provider's account controls. Stored copies remain subject to the retention and deletion terms in Section 6. For iCloud or other connections using an app-specific password, you can also revoke that password with the provider.

4. Google Analytics

We use Google Analytics to understand visits and interactions on our website and in apps where analytics is enabled. With your consent, it measures activity such as page visits, feature interactions, session information, approximate location, and browser and device information. It may use cookies or similar identifiers to distinguish visits.

Analytics does not receive connected account data, including Google, Microsoft, or iCloud content, or information derived from it. We do not send message subjects or bodies, contacts, event details, attachments, connection tokens, passwords, or email addresses to Google Analytics. We do not use analytics for advertising personalization.

You can accept or reject optional analytics through the cookie controls on the website or app. See our Cookie Policy and how Google uses information from sites and apps for more information.

5. Third-Party Services and Data Sharing

We share data with the following categories of third parties only as necessary:

• Payment Processing: Stripe processes payment information. We do not store credit card numbers.
• Hosting & Infrastructure: IONOS hosts application services; Microsoft Azure provides selected storage and encrypted backup services.
• Analytics: Google Analytics processes the limited usage measurements described in Section 4, with your consent. Connected account data and its derivatives are excluded.
• Email Services: Transactional and onboarding email delivery via Resend or MailJet.
• AI Services: Model providers process the content needed for the AI feature you use. We limit the data sent to that feature and require providers to follow the connected account restrictions in Section 3, including the prohibition on general model training.

We do not sell your personal data to third parties.

6. Data Retention and Deletion

We retain your data while your account is active. When we receive a verified account deletion request:

• You may recover your account and cancel the deletion request during a 30-day recovery period. Recovery does not restart a subscription whose renewal was stopped.
• Unless you recover your account within that period, we delete your personal data and content from active systems after the period ends. Deletion can be delayed if an owned shared workspace must first be transferred or a product deletion task fails; we show the deletion job status and work to resolve a blocked task.
• Records owned by a shared workspace with other members remain available to that workspace. We remove your membership and replace your personal attribution with a deleted-user marker where needed.
• We purge completed deletion audit jobs seven years after deletion completes. We may retain limited billing, tax, and security records where needed for legal compliance, dispute resolution, or fraud prevention. We keep only the information needed for those purposes.
• Encrypted backup copies may retain deleted data after active-system deletion. We keep backups for disaster recovery, restrict access to authorized personnel, and apply retention controls that vary by backup system.
• We may retain aggregated website and app usage measurements for product improvement. These measurements exclude connected account data and information derived from it, even when anonymized or aggregated.

7. Your Rights

You have the right to:

• Access: Request a copy of all personal data we hold about you.
• Correction: Update or correct inaccurate personal data.
• Deletion: Request deletion of your account and all associated data.
• Portability: Request an export in a machine-readable format (CSV or JSON). Request an export before access ends where possible; after closure, contact us and we will provide any data still retained and available to you under applicable law.
• Objection: Object to processing of your data for specific purposes.
• Restriction: Request that we limit processing of your data.

To exercise these rights, contact us at privacy@kamililabsllc.com.

8. Children's Privacy

Kamili One is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If we learn that we have collected data from a child under 16, we will delete it promptly. If you believe a child under 16 has provided us with personal information, please contact us at privacy@kamililabsllc.com.

9. International Data Transfers

Kamili One is operated from the United States. If you access our service from outside the US, your data may be transferred to and processed in the United States or other countries where our service providers operate. We ensure appropriate safeguards (such as Standard Contractual Clauses) are in place for all international data transfers.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a prominent notice on our website. If a change introduces a new use of Google API data or requires consent, we will explain the change and obtain that consent before the new use begins. We review and update this policy at least annually.

11. Contact Us

For privacy-related inquiries, contact us at:

Kamili Labs LLC
Email: privacy@kamililabsllc.com