Privacy Policy

1. Who we are

Akaro AI, Inc. ("Akaro", "we", "us", or "our") operates the website at akaro.ai and the Akaro platform (collectively, the "Services"). This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our Services.

For questions about this policy, contact us at: rohan@akaro.ai

2. Information we collect

2.1 Information you provide directly

• Account information: Name, email address, company name, and job title when you create an account or request a demo.
• Content you upload: Documents, files, and other content you upload to the Akaro knowledge base.
• Communications: Messages you send us via email or our contact forms.

2.2 Information collected automatically

• Usage data: Pages visited, features used, time spent, and actions taken within the platform.
• Device information: IP address, browser type, operating system, and device identifiers.
• Cookies and similar technologies: See our Cookie Policy for details.

2.3 Information from third parties

If you connect third-party integrations (Salesforce, Google Drive, Notion, etc.), we receive information necessary to provide the integration. We only access what you explicitly authorise.

3. How we use your information

• To provide, maintain, and improve the Services
• To process your RFP responses and generate answers from your knowledge base
• To communicate with you about your account, updates, and support requests
• To send product updates and marketing communications (you can opt out at any time)
• To analyse usage and improve our platform
• To comply with legal obligations and enforce our terms

We never use your data to train shared AI models. Your documents are used exclusively to generate answers for your account.

4. Legal basis for processing (GDPR)

If you are located in the European Economic Area, we process your personal data under the following legal bases:

• Contract: Processing necessary to provide the Services you requested.
• Legitimate interests: Product improvement, fraud prevention, and security.
• Consent: Marketing communications and non-essential cookies.
• Legal obligation: Compliance with applicable laws.

5. How we share your information

We do not sell your personal data. We share data only in the following circumstances:

• Service providers (sub-processors): We use a limited number of trusted third parties to operate our services (e.g., AWS for hosting, OpenAI API for AI processing). Full sub-processor list is available in our Data Processing Agreement.
• Legal requirements: Where required by law, court order, or governmental authority.
• Business transfers: In connection with a merger, acquisition, or sale of assets, with appropriate protections for your data.
• With your consent: Any other sharing requires your explicit consent.

6. Data retention

We retain your personal data for as long as necessary to provide the Services and comply with our legal obligations. Specifically:

• Account data: retained while your account is active and for 30 days after deletion
• Uploaded documents: deleted immediately upon your request or within 30 days of account closure
• Usage logs: retained for 12 months
• Financial records: retained for 7 years as required by law

7. Your rights

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Correct inaccurate or incomplete data.
• Erasure: Request deletion of your personal data ("right to be forgotten").
• Restriction: Restrict how we process your data in certain circumstances.
• Portability: Receive your data in a machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Withdraw consent at any time where we rely on consent.

To exercise any of these rights, email rohan@akaro.ai. We will respond within 30 days.

8. International data transfers

Akaro is based in the United Kingdom. If you are located in the EEA, Switzerland, or UK, we transfer your data internationally only with appropriate safeguards (Standard Contractual Clauses or equivalent mechanisms).

9. Security

We implement industry-standard security measures including AES-256 encryption at rest, TLS 1.3 in transit, access controls, and annual penetration testing. See our Security page for full details.

10. Children's privacy

Our Services are not directed to individuals under 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, contact us immediately.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or prominent notice on our website at least 30 days before the changes take effect.

12. Contact us

For privacy-related questions or to exercise your rights:

If you are in the EEA and believe we have not addressed your concerns, you have the right to lodge a complaint with your local data protection authority.