Privacy Policy

Account Information: Name, email address, phone number, company name, and billing details when you create an account.

Usage Data: Pages visited, features used, session duration, browser type, device information, and IP address.

Business Data: CRM records, contacts, leads, invoices, tasks, and other business data you input into the platform.

AI Interactions: Conversations with our AI agents, including prompts, responses, and tool usage logs.

Cookies & Tracking: We use cookies and similar technologies as described in our Cookie Policy.

We use the information we collect to:

• Provide, maintain, and improve the KalOps.ai platform
• Process transactions and send related information
• Power our AI agents to deliver intelligent business insights
• Send technical notices, updates, security alerts, and support messages
• Respond to your comments, questions, and customer service requests
• Monitor and analyze usage trends to improve user experience
• Detect, prevent, and address technical issues and security threats

We take data security seriously and implement industry-standard measures:

• Encryption: Connections to KalOps.ai use encrypted HTTPS (TLS). The database, cache and file storage we run on Amazon Web Services are configured with AWS-managed encryption at rest. In addition, the application encrypts with AES-256-GCM the credentials of connected mailboxes, AI-provider API keys you bring, and the WhatsApp, LinkedIn, Jira, GitHub, Gamma and WordPress connections. Other stored tokens rely on the AWS-managed encryption at rest only.
• Multi-Tenant Isolation: Every request is scoped to your workspace, and access to other tenants' data requires explicit administrative action
• Data Residency: Our primary database is hosted in the Amazon Web Services Israel region. Some of the service providers listed in section 4, such as AI model providers, process data outside Israel.
• Access Controls: Role-based access control (RBAC) with multi-factor authentication support
• Audit Logging: Security-relevant events, such as sign-ins and administrative actions, are logged.

We may share limited data with trusted third-party providers:

• AI Providers: Amazon Web Services (AWS Bedrock) is our primary AI provider, with Anthropic (Claude) and OpenAI (GPT) used as fallback providers, for AI agent processing. Google (Gemini) is used only for AI image generation and for analyzing website screenshots. Prompts are sent to these providers but are not used for model training.
• Voice Services: Speech-to-text providers (OpenAI Whisper and Google Cloud Speech-to-Text) to transcribe voice input, and ElevenLabs to generate spoken replies.
• Payment Processing: Payment gateway providers to process subscription payments
• Communication: WhatsApp Business API, Telegram, and email service providers for notifications
• Infrastructure: Cloud hosting and CDN providers for platform delivery

We do not sell your personal data to any third party.

When you connect a Google account (Gmail, Calendar), KalOps.ai accesses only the data needed for the features you enable: reading and sending email on your behalf, managing mailbox labels, and syncing calendar events.

KalOps.ai's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google user data is never sold, never used for advertising, and never used to train AI models. It is processed only to provide the features you requested, stored encrypted, and access can be revoked anytime at myaccount.google.com/permissions or by disconnecting the integration in Settings, which deletes stored Google tokens.

Transfers of Google user data to others are made only as necessary to provide the features (e.g., the AI model processing a message you asked an agent to draft), with your consent, for security, or to comply with law.

The KalOps.ai mobile app for Android and iOS (the "App"), published by Kal Solutions Group, is a companion to the KalOps.ai platform. This Privacy Policy applies to the App as well as to our website and web platform. The App is for adults aged 18 or over and requires an existing KalOps.ai account to sign in. The App communicates only with KalOps.ai servers; it does not contain advertising, and we do not sell your personal data.

When you use the App, the following data is sent to our servers and processed on your behalf:

• Account information: your name and email address, and the sign-in credentials you use to log in.
• CRM and business data you enter, view or scan in the App: leads, contacts, clients, tasks, projects, calendar events, invoices, notes, and files you upload.
• Business card photos: pictures of business cards that you take with the camera or choose from your photo gallery are sent to our servers, where AI extracts the contact details and may enrich them. The extracted details are saved as a record in your workspace.
• Voice recordings: audio you record with the microphone for voice input in chat or Drive Mode is sent to our servers to be transcribed and answered by an AI agent. Spoken replies are generated on our servers and sent back to your device; if server voice is unavailable, your device's own speech engine may read replies aloud instead.
• AI chat content: the messages you send to our AI agents and their replies.
• Authentication tokens: your sign-in and refresh tokens (and your language preference) are stored on your device in the platform secure storage (iOS Keychain / Android Keystore via Expo SecureStore). The tokens are deleted from the device when you sign out.

What the App does not do: The App does not include third-party analytics, advertising or crash-reporting SDKs, and does not collect your location or access your device contacts. We do not use App data for advertising.

The App asks for device permissions only when you use the related feature:

• Camera: to photograph business cards. You can instead choose an existing image from your photo gallery.
• Photo library: to choose a business card image or a file to upload.
• Microphone: to record voice input for chat and Drive Mode.
• Notifications: to show local reminders that you schedule yourself after scanning a business card. These notifications are created on your device. The App does not currently register your device for remote push notifications and does not send a push token to our servers.

Card images, voice recordings and chat messages are processed by AI providers on our behalf: AWS Bedrock (primary), with Anthropic and OpenAI as fallback providers; speech-to-text by OpenAI Whisper or Google Cloud Speech-to-Text; and speech synthesis by ElevenLabs. Your content is sent to these providers only to deliver the feature you requested and is not used by us for model training or advertising.

You can ask us to delete your account and the personal data associated with it, or to export your data, at any time. Send the request to the privacy address in the Contact Information section below from the email address registered to your account. We will verify your identity and handle the request in line with the retention periods in Section 6.

An in-app option to delete your account directly from the mobile App is planned but is not yet available.

Under the EU General Data Protection Regulation (GDPR) and the Israeli Privacy Protection Law, 5741-1981 (חוק הגנת הפרטיות, התשמ"א-1981), you have the right to:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your personal data ("right to be forgotten")
• Data Portability: Request your data in a structured, machine-readable format
• Restriction: Request limitation of processing of your personal data
• Objection: Object to processing of your personal data for specific purposes
• Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at privacy@kalops.ai or through the GDPR management tools in your account settings. For account deletion, see the “Account and Data Deletion” section below.

We keep personal data for as long as it is needed for the purposes described in this policy. Retention periods for each type of data are still being defined, and most data is not yet deleted automatically after a fixed period. This is what happens today:

• Account Data: Kept while your account is active. Account deletion requests are recorded and handled manually.
• Business Data: Kept while your organisation's account is active. When an account is closed, its data is deleted on request; there is no automatic deletion yet.
• Server logs: Application server logs are kept for about one month.
• AI Conversation Logs: Kept until they are deleted by you or your administrator; no automatic deletion period is applied yet.
• Billing Records: Kept for the period required by Israeli tax law (generally 7 years).
• Backups: Automated database backups are kept for up to 7 days. Manual snapshots taken before maintenance are kept until they are removed. Deleted data can remain in backups until they expire or are removed.

KalOps.ai is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. Continued use of the platform after changes constitutes acceptance of the revised policy.

For privacy-related inquiries, data requests, or complaints: