Privacy Policy

Ailato is a service of Kaumodaki Corporation, a Texas corporation doing business as Ailato ("Ailato", "we", "us"). This policy explains what we collect when you use ailato.ai, the Ailato Reader desktop app and the specialist console (together, the "Service"), why we collect it, and the choices you have.

The short version: we store who an account belongs to and when sessions happen. We never store the transcript of your meetings or the chat between your rep and your specialists. Those exist only in memory while a session is running and are gone when it ends.

Who this policy covers

• Account owners — people who sign up and create sessions.
• Reps and specialists (SMEs) — people who join a session with a one-time code. They don't have accounts; the account owner types their names when creating the session.
• Visitors — anyone who browses our website or writes to us.

What we collect

Information you give us

• Account details: your name, work email, phone number, company, billing country, role, your answer to "why are you signing up", your timezone and your password (stored only as a salted, one-way hash).
• Session details: the names the account owner enters for the rep and each specialist, the link to the meeting's live transcript page, and when each session was created, started and ended.
• Support requests: what you send through our contact form or to our support email address — your name, email address, the subject and description, the category you pick, and any files you attach.

Information created when you use the Service

• Session events: when a one-time code was issued, claimed or reissued, when someone joined, and when a session ended. Names and times only.
• Security records: sign-in and verification codes and links (stored only as hashes), rate-limit counters, and a log of actions our administrators take.
• Technical data: IP address, browser or app version and similar request information, kept in our hosting provider's logs for security, abuse prevention and troubleshooting.

What we do not collect or keep

• Meeting transcripts. The rep's reader displays the transcript page of the meeting tool you already use. To show your specialists what the rep is reading, the text passes through our servers in memory. It is never written to a database or disk and is discarded when the session ends.
• Chat messages between the rep and specialists. Same as above: relayed in memory, never stored.
• Audio or video. The Service does not record or receive audio or video.
• Payment card details. The Service does not take payments today. If that changes, card details will be handled by a payment processor, not stored by us.

How we use information

• To run the Service: create your account, confirm your email, sign you in, create sessions and connect the right people to them.
• To keep the Service secure: prevent abuse, enforce rate limits, detect suspicious sign-ins and investigate problems.
• To support you: answer your requests and keep a record of them so we can follow up.
• To communicate with you: send confirmation links, password resets, security notices and important changes to the Service. We do not send marketing email without your permission.
• To improve the Service, using aggregated information such as how many sessions run and how long they last.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

Legal bases (EEA and UK visitors)

Where the GDPR or UK GDPR applies, we rely on: performance of our contract with you (running your account and sessions), our legitimate interests (security, support and improving the Service), your consent where we ask for it, and legal obligations where they apply.

Who we share information with

• Service providers who run parts of the Service for us under contract, currently including our cloud hosting, database, file storage and email delivery provider. They may only use the information to provide their service to us.
• The people in your session. Specialists see the rep's name and each other's names; the rep sees the specialists' names.
• Legal and safety: when the law requires it, or to protect the rights, safety or property of our users, the public or Ailato.
• Business transfers: if Ailato is involved in a merger, acquisition or sale of assets, information may transfer as part of that deal, under this policy.

Cookies

We use only the cookies the Service needs to work: one that keeps an account owner signed in, and one that keeps a specialist connected to their session. We do not use advertising or cross-site tracking cookies.

How long we keep information

• Account details: while your account is open, and for a reasonable period afterwards for legal, tax and dispute purposes.
• Session details and events: while your account is open, unless you ask us to delete them sooner.
• One-time codes, verification and reset links: they expire within hours or minutes; the hashed records are kept for security troubleshooting.
• Support requests and attachments: as long as needed to resolve and follow up on the request.
• Server logs: for a short period set by our hosting provider.

Your choices and rights

You can view and update most of your account details in Settings. Depending on where you live — for example under the GDPR or UK GDPR, California's CCPA/CPRA, or the Texas Data Privacy and Security Act — you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict certain processing, and to appeal a decision we make about your request. To use any of these rights, email us from the address on your account. We will not treat you differently for exercising them.

If you are a rep or specialist and want information about you removed, contact us or the account owner who invited you.

Security

We use encryption in transit, hash passwords and codes instead of storing them, limit administrator access and require a second step for administrator sign-in. No system is perfectly secure, so we cannot guarantee absolute security. If we learn of a breach that affects you, we will tell you as the law requires.

International transfers

We are based in the United States and our providers operate worldwide. If you use the Service from outside the United States, your information may be processed in the United States and other countries, with safeguards required by applicable law.

Children

The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.

Changes to this policy

We will post any changes on this page and update the date at the top. If a change is significant, we will tell account owners by email or in the Service before it takes effect.

Contact us

Kaumodaki Corporation, doing business as Ailato. Write to us through the contact form or at the email address and mailing address in the footer of this page.