Platform Privacy Policy

1. Who We Are

KAIRO is operated by Kairo Engine Ltd, a company registered in England and Wales (company number 17127596), with its registered office at 61 Lyne View, Hyde, SK14 4ND. We provide a software-as-a-service platform for chauffeur and executive car operators to manage dispatch, fleet, invoicing, and client communications.

Data Controller: Kairo Engine Ltd (company number 17127596), 61 Lyne View, Hyde, SK14 4ND, United Kingdom
Contact: support@kairoengine.com

2. Data We Collect

Account Data

Name, email address, phone number, company name, company address, VAT number, and payment information (processed by Stripe, we never store card numbers).

Booking & Operational Data

Passenger names, phone numbers, email addresses, pickup and drop-off addresses, flight numbers, special instructions, and booking history.

Location Data

GPS coordinates from drivers during active jobs, used for live tracking and ETA calculation. Location data is collected only while a driver is on an active job and is not tracked outside working hours.

Financial Data

Invoice amounts, payment statuses, expense records, and revenue figures. Card payment details are handled entirely by Stripe and never touch our servers.

Communication Data

Emails forwarded to the KAIRO AI inbox for booking extraction, and messages sent through the platform.

Usage Data

Pages visited, features used, session duration, browser type, and device information, collected to improve the platform experience.

3. How We Use Your Data

• Providing and operating the KAIRO platform
• Processing bookings, dispatching drivers, and generating invoices
• Sending transactional emails (booking confirmations, invoice notifications) via your configured SMTP or our email provider
• AI-powered features: extracting booking details from emails, generating business insights, and providing intelligent suggestions
• Improving the platform based on usage patterns
• Communicating service updates and important account information
• Ensuring platform security and preventing fraud

4. How AI Is Used

KAIRO uses the Anthropic Claude API to power intelligent features:

• Email parsing: Forwarded emails are processed by Claude to extract booking details (dates, times, addresses, passenger names, flight numbers).
• Business insights: AI generates daily summaries and operational recommendations based on your booking and financial data.
• Intelligent chat: The AI assistant can answer questions about your business data.

Data sent to Anthropic's API is processed in real time and is not stored by Anthropic beyond the API call. Anthropic does not use your data to train their models. Full details are in Anthropic's privacy policy (opens in a new tab).

5. Third-Party Services

We share data with the following service providers, solely to operate the platform:

We do not sell your data to any third party. We do not share your business data, client lists, or operational information with other KAIRO operators.

6. Data Retention

We retain operational data while your account is active. After account deletion, operational records are normally deleted or de-identified within 30 days. We retain invoices and the booking amounts they derive from for up to six years where UK financial law requires it, and may retain driver compliance records where a legal obligation applies. Personal identifiers are removed where they are no longer required. See the account-deletion notice for the applicable routes and exceptions.

7. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of access, request a copy of all personal data we hold about you.
• Right to rectification, correct any inaccurate or incomplete data.
• Right to erasure, request deletion of your account and all associated data.
• Right to data portability, email us and we will export your data in a machine-readable format.
• Right to restrict processing, limit how we use your data in certain circumstances.
• Right to object, object to processing of your data for specific purposes.
• Right to withdraw consent, where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, email support@kairoengine.com or use the account deletion option in Settings, under Account & data.

8. Account Deletion

You can delete your account at any time from Settings → Account & data. Deleting removes your sign-in straight away, and nobody can use it again afterwards.

The workspace records behind that login, including bookings, clients, invoices, drivers, vehicles and configuration, then follow the retention schedule in our data processing agreement. We delete operational records within 30 days of the subscription ending, and we keep invoices and other financial records for six years because HMRC requires it. Export anything you want to keep before you delete, because we cannot undo it afterwards.

9. Data Security

We serve every request over TLS 1.2 or later, and Supabase Postgres and object storage encrypt what they hold with AES-256. Postgres row-level security policies separate one operator’s data from another’s at the database layer rather than in the screens above it. We restrict access to production systems.

We do not hold SOC 2 or ISO 27001 certification, and we do not offer multi-factor authentication yet. Our security page lists each control we run today alongside the ones we do not, so you can check rather than take our word for it.

10. Cookies

We use essential session cookies required for authentication and platform functionality. We also show an optional analytics banner offering Google and Meta analytics cookies. Those cookies stay off until you accept them, and you can change your choice at any time from the same banner. We do not use advertising cookies beyond that optional Meta analytics tag.

11. Children

KAIRO is a business-to-business service. It is not directed at individuals under the age of 18. We do not knowingly collect personal data from children.

12. International Transfers

Some of our service providers process data outside the UK. Where this occurs, we ensure appropriate safeguards are in place, including Standard Contractual Clauses and adequacy decisions, in compliance with UK GDPR requirements.

13. US & State Privacy Notice

Kairo Engine Ltd is a UK company and this policy is written under UK GDPR. If you use Kairo from the United States, as an operator, driver or client, the rights in section 7 above apply to you in the same way: access, correction, deletion, portability and objection, on request to support@kairoengine.com.

Kairo has not registered under the California Consumer Privacy Act or any other US state privacy law. The thresholds those laws set (currently around $26.6 million in annual revenue, or personal data on 100,000 California consumers or households, under the CCPA) are well above the scale Kairo operates at today. As stated in section 5 above, Kairo does not sell personal data to any third party.

14. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated via email at least 30 days before taking effect. The “last updated” date at the top of this page will always reflect the most recent version. Continued use of KAIRO after changes take effect constitutes acceptance.

15. Contact & Complaints

For any privacy-related enquiries or to exercise your rights, contact us at: support@kairoengine.com

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk (opens in a new tab).

16. Governing Law

This privacy policy is governed by the laws of England and Wales and the UK General Data Protection Regulation (UK GDPR).