Privacy Policy

1. Controller and roles

Pro Sicht Yapay Zeka Yazılım Arge ve Proje Danışmanlık Sanayi ve Ticaret Anonim Şirketi ("Pro Sicht"), Sakarya Teknokent, Esentepe Mah. Akademiyolu Sk. Teknoloji Geliştirme Bölgeleri Sitesi D Blok No: 10b İç Kapı No: 205, Serdivan / Sakarya, Türkiye. Email: [email protected].

Pro Sicht is the controller of the data in your Kairo account. For the leads you add to Kairo or find through lead research, and the conversations with them, the company using Kairo (you) is the controller; Pro Sicht processes that data only on your instructions and only to provide the service.

2. Data we collect

• Account: name, email address, password (stored only as a one-way hash), company profile (company name, description, tone, language, instructions).
• Mailboxes: email address, SMTP/IMAP server details and passwords (encrypted with AES-256-GCM), signature.
• Leads and conversations: the lead details you add (name, email, company, title, country, city, time zone, LinkedIn URL, notes, travel periods), emails sent and received, AI classifications; whether an email was opened, only if open tracking is explicitly turned on for a campaign.
• Lead research: the web addresses you ask Kairo to research and your description of who you are looking for; business contact details published openly on those pages (name, title, company, business email address, city, country, LinkedIn URL), the source page and a fit score. See section 6.
• Calendar: meetings you create in Kairo, your meeting settings and your travel periods.
• Google user data: only if you connect Google Calendar; see section 3.
• Technical data: session and preference cookies, server logs (IP address, request time), AI usage metering (token counts).

3. Google user data (Google Calendar)

Kairo accesses your Google account only after you choose "Connect Google Calendar" in Settings > Calendar and approve it on Google's consent screen. The permissions it asks for and what each is used for:

• Your email address (openid, userinfo.email): to show you which Google account is connected.
• Events on calendars you own (calendar.events.owned): to show the events of your primary calendar (title, time, location, description, Meet link, guests' responses) in the panel calendar; to write, update and cancel the meetings you create in Kairo on your calendar with a Google Meet link; and, when you ask for it, to send the lead an invitation through Google.
• Free/busy information (calendar.freebusy): to read the busy times of the calendars you select, so that proposed meeting times do not clash. This permission reads only busy and free ranges, not event content.
• Calendar list (calendar.calendarlist.readonly): to list your calendars' names so you can choose which ones count as busy.

Storage: the access and refresh tokens Google issues are stored encrypted with AES-256-GCM. A copy of your events covering only the last 30 days and the next 120 days is kept to show your calendar in the panel, and it is refreshed on every sync.

Use and sharing: Google user data is not sold, not used for advertising and not used to train AI models. Humans do not read it, unless you allow it or it is needed for a security investigation or by law. The content of your events (title, description, guests) is never sent to AI providers; only the free time slots Kairo computes for you may be used to write the email draft that proposes meeting times to a lead.

Limited Use: Kairo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy

Removing access: Settings > Calendar > "Disconnect" revokes Kairo's access at Google and deletes the tokens and the copies of events taken from Google. You can also remove access at any time at https://myaccount.google.com/permissions.

4. Why we process data

• To provide the service (performance of the contract): running campaigns, sending and reading emails, managing meetings, running the lead research you ask for.
• Security and abuse prevention (legitimate interest): session security, bot protection, sending limits.
• Legal obligations.
• Google Calendar connection: your request and the permission you grant at Google.

The company using Kairo determines the legal basis for contacting its leads and for the data of people found through lead research, and is responsible for informing them and handling their requests.

5. Processing with AI

Campaign emails, reply drafts and lead research results are produced through the AI provider chosen for the platform (Google Gemini, OpenAI or Anthropic). For this, your company profile, the campaign goal, the relevant lead details and the conversation history, and for lead research the text of the pages read and your description of who you are looking for, are sent to that provider. Kairo uses these providers' commercial API services, which do not use data sent through the API to train models. Replies that touch risky topics (pricing, legal, complaints, commitments) always wait for your approval.

6. Lead research

Lead research helps you find potential business contacts by reading the web addresses you give and the sites of the companies those pages link to or name, finding those companies through web search when needed. For this feature:

• Only public web pages are read; pages behind a login, social network profiles and pages a site's robots.txt asks crawlers not to read are not.
• Only email addresses openly published on the page are taken; addresses are never guessed or generated. Registered e-mail (KEP) and automated addresses (no-reply and the like) are left out. Whether the address's domain accepts email is checked through DNS; no message is sent to the person.
• The text of the pages, your description and your company profile are sent to the AI provider to find people and score their fit (section 5). Web searches are also made through that provider's search service; search queries may contain company names and the role you are looking for.
• People found do not become leads and receive no email until you approve them. Candidates you do not approve are kept until you delete the research or your account is closed.

The company that runs the research and contacts these people (you) is the controller of the personal data collected this way. Informing the people concerned (Article 10 of KVKK, Article 14 of the GDPR), having a legal basis to contact them (for example legitimate interest and the rules on commercial electronic messages) and handling objections and erasure requests are your responsibility. The unsubscribe link Kairo adds to every email and the suppression list support this.

7. Service providers and transfers

• Amazon Web Services: server hosting (Frankfurt, Germany).
• Cloudflare: domain, network security and bot protection (Turnstile).
• AI provider: Google, OpenAI or Anthropic (including the web searches of lead research).
• Google: only when you connect Google Calendar.
• Your own email provider: emails are sent and read through your SMTP/IMAP servers.

Some of these providers may process data outside Türkiye and the European Economic Area; such transfers are made with the safeguards the applicable law requires. Your data is not sold.

8. Retention

Data is kept while your account is open. When you ask us to close your account, data not subject to a legal retention duty is deleted within 30 days. Messages deleted in Kairo disappear from every screen and from the AI context; their record is kept for the life of the account so that sending limits and statistics stay correct.

9. Security

Passwords are stored as one-way hashes; mailbox passwords and Google tokens are encrypted with AES-256-GCM. All connections use HTTPS, the database is not reachable from the internet, and access is limited to authorized people.

10. Cookies

• kairo_session: keeps you signed in (30 days).
• kairo_conversation_view: your sort and filter preferences for conversations (1 year).
• kairo_google_oauth: only while connecting Google Calendar, 10 minutes.
• Cloudflare Turnstile: bot protection on the sign-in and sign-up forms.

No advertising or tracking cookies are used.

11. Your rights

Under Article 11 of KVKK and the GDPR you may ask to access, correct or delete your data, object to processing, receive your data in a portable form, and complain to a supervisory authority (the Personal Data Protection Authority in Türkiye, your local authority in the EU). Contact: [email protected].

People who receive email through Kairo or are found through lead research can unsubscribe with the link in every email, and should first send requests about their data to the company that wrote to them. We forward such requests that reach us to that company.

12. Changes

We may update this policy and will announce material changes in the app or by email. The current version is always on this page.