Privacy Policy

1. Introduction

Kairos Automation ("we", "us", or "our"), a trade name of Mariana Valdivia Reyes, operates the website kairosautomation.ai, the platform at app.kairosautomation.ai, and custom business systems built and operated for its clients (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

2. Information We Collect

We collect information in the following ways:

2.1 Information You Provide

• Account registration information (name, email address, business name)
• Communication content sent and received through our platform (messages via WhatsApp, Instagram, Facebook Messenger, email, and other connected channels)
• Contact information of your customers/guests that you manage through our platform
• Business information provided during onboarding (hotel details, services, policies)

2.2 Information Collected Automatically

• Usage data (pages visited, features used, interaction patterns)
• Device information (browser type, operating system, IP address)
• Cookies and similar tracking technologies

2.3 Information from Third-Party Platforms

When you connect your social media and messaging accounts to our Service, we receive information from Meta Platforms (Facebook, Instagram, WhatsApp) and other providers as authorized by you. This includes:

• Facebook Page information and metadata
• Instagram business account information
• WhatsApp Business account information and message content
• Messenger conversation content

3. How We Use Your Information

We use the collected information to:

• Provide, operate, and maintain our omnichannel communication platform
• Route and deliver messages between you and your customers/guests across connected channels
• Power AI-assisted responses and automated workflows configured by you
• Generate analytics and reports on communication performance
• Improve and optimize our Service
• Communicate with you about your account and our Service
• Comply with legal obligations

4. Use of Meta Platform Data

Our Service integrates with Meta Platforms (Facebook, Instagram, WhatsApp) to enable omnichannel messaging. We access and use Meta platform data strictly in accordance with Meta's Platform Terms and Developer Policies. Specifically:

• We use pages_read_engagement and pages_show_list to retrieve and display your Facebook Pages so you can select which page to connect to the inbox.
• We use pages_messaging to send and receive messages on your behalf through Facebook Messenger.
• We use instagram_business_basic to access your Instagram business account information for channel connection.
• We use instagram_business_manage_messages to send and receive Instagram Direct Messages on your behalf.
• We use whatsapp_business_messaging to send and receive WhatsApp messages on your behalf.
• We use whatsapp_business_management to manage your WhatsApp Business account configuration.

We do not sell, lease, or share Meta platform data with third parties for their own purposes. Data obtained from Meta APIs is used solely to provide our Service to you.

5. Use of Google User Data

Some parts of our Service let you sign in with your Google account. When you do, we receive only your name, email address, and profile picture (the openid, email, and profile scopes). Specifically:

• We use this information solely to identify you, verify that your email address has been granted access by the account owner, and keep your session active.
• We do not access your Gmail, Google Drive, Calendar, contacts, or any other Google data through your sign-in.
• We do not sell Google user data, use it for advertising, or transfer it to third parties except as needed to operate the Service, comply with the law, or with your consent.
• Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Where a client's system stores files in that client's own Google Drive, the system connects through a service account that the client adds to a specific shared drive. It does not access any individual user's Google account.

6. Custom Systems Built for Clients

We build and operate custom business systems (for example, budgeting, payments, and project control) for companies that hire us. In these systems:

• The client is the owner and controller of the data. Kairos Automation processes it only on the client's behalf and under its instructions, to build, operate, maintain, and support the system.
• Only people whose email address has been registered by the client can access the system.
• We do not use client data for any purpose other than providing the system, and we do not share it with other clients.
• When the engagement ends, we return the data to the client in a standard format and then delete it from our systems, except where retention is required by law.

If you are a user of a system we operate for one of our clients, you may contact that client or us to exercise your rights over your data.

7. Data Storage and Security

Your data is stored on secure servers. We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include encryption in transit (TLS/SSL), access controls, and regular security reviews.

8. Data Sharing and Disclosure

We may share your information only in the following circumstances:

• Service providers: Third-party services that help us operate our platform (hosting, databases, file storage, email delivery, AI processing), such as Vercel, Neon, and Google, under strict data processing agreements.
• Legal requirements: When required by law, regulation, or legal process.
• Business transfers: In connection with a merger, acquisition, or sale of assets.
• With your consent: When you explicitly authorize sharing.

9. Data Retention

We retain your data for as long as your account is active or as needed to provide you with our Service. You may request deletion of your data at any time by contacting us. Upon account termination, we will delete or anonymize your data within 90 days, except where retention is required by law.

10. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict processing of your data
• Request data portability
• Withdraw consent at any time

To exercise any of these rights, please contact us at alberto@kairosautomation.ai.

11. Data Deletion

You can request deletion of your data by emailing alberto@kairosautomation.ai. For data obtained through Meta platforms, you may also revoke our access at any time through your Facebook, Instagram, or WhatsApp settings. If you signed in with Google, you can revoke our access at any time at myaccount.google.com/permissions. Upon receiving a deletion request, we will remove your data within 30 days.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

• Kairos Automation
• Email: alberto@kairosautomation.ai
• Website: kairosautomation.ai