KokuaOS — Privacy Policy

How KokuaOS collects, uses, and discloses personal information that it controls, and the privacy choices and rights available to individuals.

Capitalized terms have the meanings in the KokuaOS Definitions Schedule (kokuaos.com/legal/definitions).

1. Scope, and the important difference between data KokuaOS controls and data KokuaOS processes

This Privacy Policy explains how KokuaOS, Inc. ("KokuaOS," "we," "us") handles Personal Data for which KokuaOS itself determines the purposes and means — that is, Personal Data for which KokuaOS acts as a controller (or, under U.S. state privacy laws, a business). In this Policy, "personal information" and "Personal Data" are used interchangeably and have the meaning given to Personal Data in the Definitions Schedule.

This Policy applies to Personal Data we handle as a controller, including data collected through:

• our public websites, marketing pages, and events (the "Sites");
• account registration and administration of the Platform by Service Providers, Resellers, Customers, and their Authorized Users;
• sales, billing, support, and business communications; and
• security, fraud-prevention, and product-analytics activities we conduct for our own purposes.

What this Policy does not govern. When an AI Employee handles a call, message, or task and thereby processes Personal Data about a Customer's end users — for example, call and message transcripts and recordings where enabled, and other Customer Data — KokuaOS generally acts as a processor/service provider on behalf of the Customer, who is the controller/business. That processing is governed by the Agreement and the Data Processing Addendum (kokuaos.com/legal/dpa), not by this Policy, and by the Customer's own privacy notice. If you are an end user and want to exercise privacy rights in that data, please contact the organization that operates the AI Employee you interacted with; we will support that organization's response as its processor. Where facts establish that KokuaOS is a controller of particular data, this Policy applies to that data.

2. Categories of personal information we collect

The categories below track the categories used in the California Consumer Privacy Act, as amended (the "CCPA"). The specific data we hold about you depends on how you interact with us.

We do not intentionally collect from our own controlled channels: government identifiers (such as Social Security, driver's-license, or passport numbers), precise geolocation, biometric identifiers, information about racial or ethnic origin, religious or philosophical beliefs, union membership, health, sex life, or sexual orientation. Personal Data of any kind may appear in Customer Data processed on a Customer's behalf; that data is handled as processor data under the DPA (see Section 1).

3. Sources of personal information

We collect Personal Data: (a) directly from you, when you fill out a form, create or administer an account, contact sales or support, or attend an event; (b) automatically, through cookies, log files, and similar technologies when you use our Sites and Platform (see Section 6); (c) from Customers and partners, for example when a Service Provider or Reseller provides administrator contact details to provision an account; and (d) from third parties, such as analytics, security, fraud-prevention, and business-information providers, and publicly available sources.

4. How we use personal information

We use Personal Data we control to:

• provide, operate, secure, and improve the Sites, the Platform, and the Services, and administer accounts and Authorized Users;
• process Order Forms, invoicing, payment, collections, and related record-keeping;
• provide support, respond to inquiries, and send service, security, and administrative communications;
• protect the security and integrity of the Services, detect and prevent fraud and abuse, and enforce the Agreement and Policies;
• conduct product analytics, research, and development, and generate aggregated and de-identified data and analytics that cannot reasonably be used to identify a person or Customer;
• send marketing and event communications, subject to your choices and applicable law; and
• comply with legal obligations, respond to lawful requests, and establish, exercise, or defend legal claims.

No use of your content to train foundation models without permission. Consistent with the Agreement, KokuaOS does not train foundation models on Customer Content without explicit written authorization. KokuaOS may use aggregated and de-identified data and analytics for its legitimate business purposes as described above.

For individuals in the EEA and UK, our legal bases are: performance of a contract; our legitimate interests in operating, securing, and improving our business (balanced against your rights); your consent (which you may withdraw); and compliance with legal obligations.

5. AI interactions, voice, transcripts, and recordings

The Platform provides AI Employees that interact over voice, SMS, email, chat, and other Communication Channels. Where enabled by the operating organization, these interactions may be transcribed and recorded, and the resulting content may contain Personal Data. In substantially all cases, that content is Customer Data processed by KokuaOS as a processor/service provider on the Customer's behalf and is governed by the DPA and the Customer's privacy notice, not by this Policy. The Customer is responsible for providing notices, obtaining consents, and honoring rights requests relating to recording, monitoring, and automated communications under applicable law. When you contact KokuaOS's own support lines, we may record or transcribe the interaction for quality, training, and security, and that data is controlled by us under this Policy.

No voiceprints, and no biometric identifiers from call audio. Call audio is processed to recognize speech — to convert what was said into text so an AI Employee can understand and respond. KokuaOS does not create, derive, capture, store, or use a voiceprint, voice template, faceprint, or any other biometric identifier or biometric information from that audio, and does not use voice characteristics to identify or authenticate any individual. We do not sell, lease, trade, or otherwise profit from biometric data, because we do not collect any. Speaker labels applied to a transcript (for example, "Caller" and "Agent") separate turns in a conversation; they are not identity determinations and are not derived from any measurement of a person's voice. This statement is made about our own processing wherever it occurs and does not depend on whether KokuaOS acts as a controller or a processor for the underlying content.

6. Cookies, analytics, and online tracking

Our Sites use cookies and similar technologies to operate the Sites, remember preferences, measure performance, and understand usage. We use both first-party and third-party analytics. You can control cookies through your browser settings and, where offered, our cookie-preference tool; disabling some cookies may affect functionality. We respond to browser-based opt-out preference signals, including the Global Privacy Control (GPC), as a valid request to opt out of "sale"/"sharing" for the browser or device from which we receive them, to the extent required by law. We do not knowingly use technologies that respond to a "Do Not Track" signal in a uniform way; instead, we honor recognized opt-out preference signals as described here.

7. How we disclose personal information

We disclose Personal Data to:

• Service providers and Subprocessors that perform functions on our behalf, such as cloud hosting and infrastructure, communications and email delivery, analytics, payment processing, customer support tooling, and security and fraud prevention, under contracts that limit their use of the data. Categories of KokuaOS Subprocessors, and the live list, are described in the Subprocessor Policy (kokuaos.com/legal/subprocessors) and Trust Center (/trust);
• Customers and partners, where you are an Authorized User of an account they administer, or where a Commercial Parent needs account information to provide billing or support;
• Professional advisors and authorities, where necessary to comply with law, respond to lawful requests, or protect rights, safety, and property; and
• Acquirers and successors, in connection with a merger, acquisition, financing, reorganization, or sale of assets, consistent with the Agreement.

BYO Providers. A Customer or Service Provider may connect its own third-party providers (BYO Providers) to the Platform. BYO Providers are Third-Party Services selected and controlled by that Customer or Service Provider, are not KokuaOS Subprocessors, and handle Personal Data under their own terms and privacy notices.

8. Sale and sharing of personal information; your opt-out

Mobile numbers and SMS consent are never sold or shared. No mobile information obtained as part of a text-messaging opt-in — including the mobile number itself and the record of consent — is sold, rented, released, shared, or traded with third parties or affiliates for their own marketing or promotional purposes, and none is transferred between unrelated businesses or messaging programs. Mobile opt-in data is used only to deliver the messages you asked for, and is disclosed only to the service providers that carry those messages on our behalf (for example, our messaging carrier), who may use it solely to deliver them. Opting out of text messages at any time by replying STOP does not affect any other part of your relationship with us. See the SMS Terms (kokuaos.com/legal/sms-terms) and the Messaging Policy (kokuaos.com/legal/messaging-policy).

KokuaOS does not sell your Personal Data for money. We do not sell or "share" (as "share" is defined for cross-context behavioral advertising under the CCPA) the Personal Data of individuals we know to be under 16. Some analytics and advertising cookies may, depending on the law and configuration, be treated as a "sale" or "sharing." Where that is the case, you may opt out by using the "Do Not Sell or Share My Personal Information" link on our Sites, by adjusting cookie preferences, or by transmitting a recognized opt-out preference signal such as GPC. We do not use or disclose sensitive personal information for purposes that would require us to offer a "limit the use of my sensitive personal information" right beyond providing the Services and other purposes exempt under the CCPA.

9. Retention

We retain Personal Data for as long as needed for the purposes described in this Policy, then delete or de-identify it. Retention periods depend on the type of data and the context, including: the duration of your account and business relationship; our legal, tax, accounting, and audit obligations; the need to resolve disputes and enforce agreements; and security and fraud-prevention needs. Even after your account closes or a standard retention period otherwise ends, we may retain Personal Data to the extent, and for as long as, reasonably necessary to maintain routine backups until they are overwritten in the ordinary cycle; to comply with our legal obligations; to establish, exercise, or defend legal claims, including under a litigation or legal hold; to detect, investigate, and prevent fraud, abuse, and security incidents; and to meet accounting, tax, and audit requirements — after which we delete or de-identify it. For Customer Data processed on a Customer's behalf, retention, export, and deletion follow the Agreement and DPA, including the post-termination export window described in the Master Terms & Conditions, subject to legal, security, backup, and payment exceptions.

10. Security

We maintain administrative, technical, and organizational measures designed to protect Personal Data, as described in our Security Policy (kokuaos.com/legal/security). No method of transmission or storage is completely secure, and we cannot and do not guarantee absolute security. Please safeguard your account credentials and notify us promptly of any suspected compromise (see Sections 11 and 16 of the Security Policy and the Incident Response Policy).

11. International data transfers

KokuaOS is based in the United States and may process and store Personal Data in the United States and other countries where we or our Subprocessors operate. These countries may have data-protection laws that differ from those in your jurisdiction. Where we transfer Personal Data from the EEA, the United Kingdom, or Switzerland to a country that has not received an adequacy decision, we rely on appropriate safeguards where required, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with supplementary measures as appropriate. You may request information about these safeguards using the contact details in Section 15.

12. Your California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right, subject to verification and legal exceptions, to: (a) know and access the categories and specific pieces of Personal Data we have collected, the sources, the purposes, and the categories of recipients; (b) delete Personal Data we collected from you; (c) correct inaccurate Personal Data; (d) opt out of any "sale" or "sharing" of Personal Data (see Section 8); and (e) limit the use and disclosure of sensitive personal information where that right applies. We will not discriminate against you for exercising these rights.

How to submit a request. Submit a request through the privacy request form on our Sites or by emailing privacy@kokuaos.com. We will verify your request using information reasonably necessary to confirm your identity, and we will respond within the timeframes required by law. You may use an authorized agent to submit a request on your behalf, subject to proof of authorization. If we decline a request, you may appeal by replying to our decision or contacting privacy@kokuaos.com. Where KokuaOS acts as a service provider or processor, we will refer or forward your request to the responsible Customer.

13. Rights in other jurisdictions (EEA, UK, and elsewhere)

If you are in the EEA or the United Kingdom, you have rights under the GDPR and UK GDPR, subject to conditions and exceptions, to access, rectify, erase, restrict, or object to processing, to data portability, and to withdraw consent where processing is based on consent. Where processing is based on legitimate interests, you may object on grounds relating to your particular situation. You may lodge a complaint with your supervisory authority, though we encourage you to contact us first. Residents of other U.S. states with comprehensive privacy laws may have comparable rights, which we honor as applicable. To exercise any right, contact us as described in Section 15.

14. Children's privacy

The Sites and the Services are intended for businesses and are not directed to children. We do not knowingly collect Personal Data from children under 16 through our controlled channels. If you believe a child has provided us Personal Data that we control, contact us and we will take appropriate steps to delete it. Whether and how children's data may be processed through an AI Employee is controlled by the operating organization under the DPA and applicable law.

15. Contact us; data-protection representative

For privacy questions or to exercise a right, contact us at privacy@kokuaos.com or by mail at KokuaOS, Inc., [KokuaOS Mailing Address]. If you are in the EEA or the UK and we are required to designate a representative, our representative is [EU/UK Representative name and address, if appointed].

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where required by law or the Agreement, provide additional notice. Changes are effective when posted unless a later effective date is stated or a longer notice period is required. Your continued use of the Sites or Services after an update means you have read the updated Policy.