Privacy Policy

Kairo (developed by Zambezi Digital) acts as an independent Data Controller for account authentication, billing, website diagnostics, and service security. For organizational documents, member rosters, fleet records, and business data uploaded to your workspace, your organization acts as Data Controller and Kairo operates strictly as a Data Processor.

We process: • Account Information: Name, email address, password hash, role, birth date/year for eligibility verification. • Workspace Data: Document text, vehicle records, calendar events, tasks, and team chat messages. • AI Prompts & Context: User queries and retrieved document excerpts necessary to answer questions. • Technical Telemetry: IP addresses, browser user-agents, request timestamps, and security audit logs.

When you query Ask Kairo, prompts and relevant authorized context excerpts are transmitted via encrypted API to our AI model providers (OpenAI and OpenRouter). Data is processed ephemerally and is NOT used to train or refine public foundation models under enterprise API terms. Sensitive secrets (API keys, JWTs) are automatically redacted prior to dispatch.

Your data is hosted with verified cloud infrastructure providers (Supabase on AWS EU/US, Cloudflare Edge global network). Cross-border transfers adhere to recognized standard contractual safeguards. A complete list of external infrastructure providers is maintained in our Subprocessor Register.

Depending on your jurisdiction, you may have rights to access, rectify, erase, restrict, or export your personal data, or object to processing. To exercise these rights, submit a verified request through our Privacy Requests portal (/legal/privacy-requests) or contact privacy@zambezidigital.agency.

Data is encrypted in transit (TLS 1.3) and at rest (AES-256). Detailed retention intervals, soft-delete lifecycles, and hard-purging timelines are governed by our Data Retention and Deletion Policy.