Privacy Policy — Kira AI

1. Introduction

This Privacy Policy explains how Kira ASI Inc, a Delaware corporation ("Kira," "we," "us," or "our"), acting as data controller, collects, uses, discloses, and safeguards personal data when you use Kira, our websites, and related services (the "Services"). It applies to visitors, account holders, and the authorized users of our business customers.

We've drafted this policy to align with the EU and UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the CPRA, and other applicable data-protection laws. Capitalized terms not defined here have the meaning given in our Terms of Service.

2. How We Collect Personal Data

We collect data about you in a few distinct ways, worth understanding separately rather than lumped together:

Directly from you. This includes when you create an account, submit content for Kira to work with, configure an agent, upgrade your plan, or contact us for any reason.
Automatically, through your use of the Services. This includes log data, device information, and usage patterns collected as you actually use Kira, not something you separately submit, but something generated by the act of using the product.
Through integrations you connect. When you link an email, calendar, or messaging account to Kira, information from that connected service flows into Kira to the extent you've authorized, limited specifically to what's needed to provide that integration.

3. Personal Data We Collect

Depending on how you interact with the Services, we collect the following categories of personal data:

Identity and account data: name, email address, password, profile details, and organization or team membership.
Content you provide: the emails, documents, notes, tasks, calendar events, prompts, and call or meeting transcripts you submit to or generate within Kira. This is the category that reflects what Kira actually does as a product, an AI workspace acting on your emails, calls, and documents, not merely your signup details.
Usage and device data: log data, IP address, browser and device type, features used, timestamps, and approximate location derived from IP address.
Integration data: information from third-party services you connect, such as email, calendar, and messaging platforms, limited to the scope you authorize.
Transaction and billing data: plan, billing contact, and payment status. Card details are handled by our payment processor; we do not store full card numbers.
Communications: messages you send to support, survey responses, and your contact preferences.

A note on sensitive information. Some of the content you create in Kira might incidentally include sensitive categories of information, health-related details, for instance, in a note or calendar event. We don't require this kind of information to use Kira, and we handle any of it that appears with the same protections described throughout this policy. If you'd like more detail specifically on health-related data, see our Consumer Health & Data Privacy notice.

4. How We Use Personal Data

To provide, operate, secure, and improve the Services and their features.
To run the agents, automations, and integrations you configure.
To personalize your experience and remember your settings.
To communicate with you about your account, security, transactions, and changes to the Services.
To provide customer support and respond to your requests.
To detect, investigate, and prevent fraud, abuse, and security incidents.
To comply with legal obligations and enforce our agreements.

5. Legal Bases for Processing (GDPR)

Where the EU or UK GDPR applies, we rely on one or more of the following legal bases:

Performance of a contract — to deliver the Services you or your organization have requested.
Legitimate interests — to secure, maintain, and improve our Services, provided these interests aren't overridden by your rights and freedoms.
Consent — for optional features such as certain cookies, marketing communications, and any opt-in use of your content; you may withdraw consent at any time.
Legal obligation — to comply with applicable laws, regulations, and lawful requests from authorities.

6. AI Models and Your Content

We don't train on your content by default

We do not use the content you create in Kira to train our AI models unless you explicitly opt in. Content belonging to business customers is never used for model training.

To generate responses, your inputs are processed by us and by underlying AI model providers, acting as our sub-processors under contract specifically to power Kira's AI features. These providers are prohibited from using your content to train their own models except as you've separately authorized.

8. Cookies and Similar Technologies

We use cookies and similar technologies for authentication, preferences, security, and analytics. You can manage your choices as described in our Cookie Policy, and we honor recognized opt-out signals such as Global Privacy Control where required by law.

9. Data Retention

We retain personal data for as long as your account is active and as needed to provide the Services. When you delete content or close your account, we delete or de-identify the associated personal data within 90 days, except where longer retention is required for legal, tax, accounting, security, or dispute-resolution purposes. This 90-day window reflects the practical reality that some data, backups, logs, records needed to resolve a dispute, can't be instantly purged the moment an account closes, while still ensuring nothing lingers indefinitely without a real reason.

10. Your Rights and Choices

Subject to applicable law, you may have the right to:

Access the personal data we hold about you and obtain a copy.
Correct inaccurate or incomplete personal data.
Delete your personal data (the "right to be forgotten").
Receive your data in a portable, machine-readable format and transmit it to another provider.
Object to or restrict certain processing, including direct marketing.
Withdraw consent where processing is based on consent.
Opt out of the sale or sharing of personal information (we do not sell or share for advertising) and limit the use of sensitive personal information.

You can exercise many of these rights in your account settings, or by contacting support@kiraai.ai. We'll verify your request and respond within the timeframes required by law (for example, one month under the GDPR and 45 days under the CCPA). We won't treat you differently for exercising your rights, and you may appeal a decision by replying to our response. You also have the right to lodge a complaint with your local supervisory authority, or in the UK with the Information Commissioner's Office.

11. International Data Transfers

We may process and store personal data in the United States and other countries. Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and, where applicable, adherence to recognized frameworks such as the Data Privacy Framework, or an adequacy decision where one applies. You may request a copy of the relevant safeguards by contacting us.

12. Security

We maintain technical and organizational measures designed to protect personal data, including encryption in transit (TLS 1.2 or higher) and at rest (AES-256), access controls, logging, and continuous monitoring. See our Security & Compliance page for details. No method of transmission or storage is completely secure, so we can't guarantee absolute security.

13. Children's Privacy

The Services aren't directed to children, and we don't knowingly collect personal data from anyone under 18 (or the age of majority in your jurisdiction). If you believe a child has provided us personal data, contact us and we'll delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We'll post the updated version, revise the "Last updated" date, and, for material changes, provide additional notice as required by law. Your continued use of the Services after an update takes effect constitutes acceptance of the revised policy.

15. How to Contact Us

If you have questions or wish to exercise your rights, contact our privacy team at support@kiraai.ai. You can also write to us at Kira ASI Inc, Delaware, United States. For EU or UK matters, you may also contact your local data-protection authority.

16. References and Regulatory Frameworks

This policy is informed by the following laws, regulations, and official resources:

Frequently asked questions

Quick answers to common questions.

Does Kira use my emails, documents, or transcripts to train AI?

No, not by default. We only use your content for model training if you explicitly opt in, and we never use business customer content for training.

Do you sell my personal data?

No. We do not sell personal data or share it for cross-context behavioral advertising. We disclose it only to service providers, integrations you authorize, and where legally required.

How do I download or delete my data?

You can export and delete data from your account settings, or contact our privacy team. We respond within the timeframes set by applicable law.

Which privacy laws apply to me?

It depends on where you live. EU/EEA and UK users are covered by the GDPR; California residents are covered by the CCPA/CPRA. We honor the rights granted under applicable law regardless of where you're located.

What happens if I include sensitive information in my content, like health details?

We handle it with the same protections as everything else in this policy. See our Consumer Health & Data Privacy notice for more detail specifically on health-related data.

Does Kira use third-party AI models to generate responses?

Yes. Underlying model providers act as our sub-processors under contract, they're contractually prohibited from using your content to train their own models except as you've separately authorized.