Privacy Policy
Kauli means "pledge" in Swahili and "protective resin" in Tongan. Privacy isn't a feature we bolt on -- it's woven into every product we build and every decision we make.
Which means: we're two related companies (Canada + US). Where you live determines which one is responsible for your data.
"Kauli" refers collectively to Kauli AI Inc. (federally incorporated in Canada) and Kauli AI USA Inc. (incorporated in Delaware, USA). The two entities operate as a single business and share this website. The data controller for your information is determined by where you reside:
Both entities follow the same privacy commitments described in this policy. References to "Kauli," "we," "us," or "our" mean the relevant entity for your region.
Which means: we collect what you give us — name, email, what you submit. The AI Readiness Assessment also processes your website URL through a third-party AI provider that's contractually barred from training on it. Future products collect anonymized telemetry only.
We aim to collect the minimum information needed to do good work and stay in touch with the people we serve. Here's what we actually collect, when we collect it, and why.
If you reach out through the contact form, the AI Readiness Assessment, or by email, we collect what you provide -- typically your name, email address, company name, role, website, and a description of what you're working on. This is the minimum we need to respond meaningfully.
The AI Readiness Assessment asks about your organization's strategy, data, technology, culture, and governance. When you submit it:
If we work together on a consulting or configuration engagement, we'll collect whatever information is necessary to deliver that work. The specifics are governed by our engagement agreement (including any task orders or change orders we sign together), which takes precedence over this policy where it differs.
When we ship products and embedded software solutions, those systems collect operational telemetry -- such as usage signals, performance metrics, and error data -- so we can keep them reliable and improve them over time. Two commitments matter here:
Where a specific product handles personal data in ways this policy doesn't fully cover, we'll publish a product-specific privacy notice for that product and make it accessible from within the product.
We use only essential cookies for security and bot mitigation, provided by our content delivery network. We do not use third-party advertising or analytics cookies. Our servers keep standard request logs (IP address, browser, page requested) for a short period to investigate errors and abuse; these are not linked to your identity beyond what your browser sends.
Which means: when you run our software on your own infrastructure, your end users' data stays with you — not us. You're the data controller; we're the software vendor.
Where customers operate Kauli software on their own infrastructure (rather than using a Kauli-hosted service), the customer is the data controller for end users they enroll. Kauli is the software provider. Personal data of end users does not flow to Kauli's central infrastructure unless the customer explicitly enables a feature that requires it (for example, a Kauli-hosted service purchased separately under an executed agreement).
For self-deployed software, Kauli's responsibilities are limited to: shipping the software in working condition, providing documented updates, responding to security vulnerabilities, and honouring the terms of any engagement agreement with the customer. The customer is responsible for the operation, configuration, security posture, and compliance posture of their own deployment, and for the rights of end users they enroll in that deployment.
Which means: when you connect external services (cloud storage, AI providers, your CRM, etc.) through our software, those companies handle your data under their own privacy policies. You pick which providers to use; we're just the integration layer.
Kauli's products integrate with third-party services that customers connect at their own discretion — including but not limited to: cloud storage providers, email and calendar providers, customer-relationship platforms, social media platforms, and AI inference providers. When a customer connects such a service:
For the platform’s managed AI features, inference runs on third-party providers that Kauli selects and contracts with, on tiers whose published terms exclude API inputs from model training; the current providers are available on request. In enterprise configurations, customers may instead integrate their own provider or self-hosted models, in which case their agreement with that provider governs. Where a Kauli product includes a recommended or required AI provider for a specific feature, this is documented in that product's privacy supplement.
Which means: some products may run AI on infrastructure you control (or that we run exclusively for you), so prompts and content never leave that environment. Documented per-product when applicable.
Where Kauli ships products that include or support private inference — meaning AI models running on infrastructure the customer or Kauli operates exclusively, with no third-party API calls during the inference itself — the privacy posture is set out in that product's documentation. Such configurations are designed so that prompts, responses, and content data remain within the controlling environment.
Customers who require this configuration can specify it in the engagement agreement. Where Kauli operates such infrastructure on behalf of a customer under an executed agreement, the agreement's data-processing terms govern what Kauli operations personnel may access; by default, Kauli operations personnel cannot read tenant content data at rest in such configurations.
Which means: we use your data to do the work you've engaged us for, to improve our services with anonymized data, to communicate with you (marketing only with consent), and to comply with the law.
If you submit a form, we use your information to respond and to provide the report or follow-up you've requested. If we're working together on an engagement, we use it to deliver that engagement.
We use aggregated, anonymized data to make our products better -- improving accuracy, optimizing workflows, fixing bugs, and prioritizing features. We do not use raw or identifiable customer data to train AI models. Where we use data to inform model improvements, it is anonymized and aggregated first.
We send transactional messages (the AI Readiness report, follow-ups on a conversation, account or service notices). We send marketing communications -- product news, AI insights, occasional updates -- only to people who have explicitly opted in. You can withdraw consent at any time using the unsubscribe link in any email or by writing to [email protected].
We process and disclose data when required to comply with applicable law, respond to lawful legal process, protect our rights, or prevent harm. We push back against overly broad requests.
These aren't legal disclaimers -- they're commitments:
Which means: we encrypt your data, restrict access, monitor our systems, and notify affected users promptly if a breach occurs.
We protect your data with measures appropriate to its sensitivity:
No system is perfectly secure, and we don't claim otherwise. We work to make breaches unlikely and to respond appropriately if one occurs.
Which means: we keep your data while it's still useful for our work or required by law. Ask for deletion any time — we'll honor it within 30 days, with limited legal exceptions.
We retain personal data for as long as it remains necessary to:
You can request deletion of your personal data at any time, and we will honor it within 30 days, subject to the limited exceptions above. Backup copies are typically purged within 90 days of an active-system deletion. To make a request, email [email protected].
Which means: you have the right to access, correct, delete, and withdraw consent. Email [email protected] to exercise any of them — we won't charge a fee or retaliate.
Depending on where you live, you have the following rights with respect to the personal data we hold about you:
To exercise any of these rights, email [email protected]. We'll respond within 30 days. We don't charge a fee for legitimate requests, and we won't retaliate against anyone for exercising their rights.
Which means: we use a small set of vendors to run things — hosting, AI inference, email, CRM. They can only process your data on our instructions, not for their own purposes. A current vendor list is available on request.
We work with a small number of third-party providers to operate this site and our services. They fall into a few categories:
Each provider is selected carefully and operates under a data processing agreement that restricts how they can use your data. They may only process it on our instructions, in line with this policy.
A current list of our subprocessors is available on request to [email protected].
For business customers whose use of Kauli services involves personal data of their own users, customers, or employees: a Data Processing Addendum is available on request to [email protected]. For consulting and configuration engagements, the executed engagement agreement (including any data-processing terms therein) governs and supersedes this policy where they conflict.
We notify customers in writing 30 days before adding a new subprocessor used to operate the parts of Kauli we host directly. Services that customers connect themselves through our products (cloud storage, AI inference, customer-relationship platforms, social platforms, and similar) are the customer's relationships with those providers and are not Kauli subprocessors.
Which means: different jurisdictions give people different rights. Wherever you live, we honor the strongest set that applies and don't sell your data anywhere.
Kauli AI Inc. is the data controller for Canadian residents. We handle personal data in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Our marketing emails comply with Canada's Anti-Spam Legislation (CASL): we send commercial electronic messages only to recipients who have given express consent, every message identifies us, and every message contains an unsubscribe mechanism.
Kauli AI USA Inc. is the data controller for US residents. Depending on your state, you may have additional rights under laws such as the California Consumer Privacy Act (CCPA/CPRA), Colorado Privacy Act (CPA), Virginia Consumer Data Protection Act (VCDPA), or others. Our policy is to extend the same core rights -- access, correction, deletion, opt-out of marketing -- to all users regardless of state. We do not sell personal information as defined by the CCPA.
If you are accessing our services from outside Canada or the United States, your data is processed by Kauli AI Inc. (Canada). Canada has been recognized by the European Commission as providing an adequate level of data protection for personal data transferred from the European Union, which simplifies cross-border data transfer for users in the EEA and UK. Where local law affords additional rights (such as the GDPR in the European Economic Area, or the UK GDPR in the United Kingdom), we will honor them on request to [email protected].
We do not currently have an established place of business in the European Union or United Kingdom and have not appointed a representative under GDPR Article 27 / UK GDPR Article 27. EU and UK residents may reach us directly at [email protected] for any data-rights request. If our operations expand to require an appointed representative, we will appoint one and update this policy accordingly.
Which means: we don't market to or knowingly collect data from children. If we learn we have a child's data, we delete it.
Kauli's products and services are not directed at children under 13 (United States) or under 16 (European Economic Area, United Kingdom). We do not knowingly collect personal data from children. If you are a parent or guardian and believe a child has provided personal data through a Kauli product or service, contact [email protected] and we will delete it promptly.
Which means: we may update this. Material changes get a notice; minor ones (typos, clarifications) we may make silently.
We may update this policy from time to time as our practices, products, or legal obligations change. When we make material changes, we'll update the "last updated" date at the top of this page and, where reasonable, notify people who have opted in to communications. For non-material changes (typos, clarifications), we may update the page silently.
If you have questions about this policy, your data, or anything else related to how we handle information, reach out:
We read every message and aim to respond within two business days. For formal data-rights requests, we respond within 30 days as required by law. For security vulnerability reports, we respond within two business days and ask that you not disclose publicly until we have had a reasonable opportunity to investigate and remediate.