Kaynetics Privacy Policy

1Introduction

Kaynetics, operated by KayJay Global Solutions Private Limited, is a multi-tenant AI-as-a-Service platform that provides AI agents, an AI chatbot, knowledge-based question answering, and related business productivity capabilities to organizations (“Tenants”) and their authorized users. This Privacy Policy explains how we collect, use, store, and process personal information in connection with Kaynetics, whether you are a Tenant Admin, an authorized user within a Tenant, or an end user interacting with a Tenant’s AI agents (for example, a visitor to a Tenant’s deployed chatbot).

By using Kaynetics, you acknowledge that you have read and understood this Privacy Policy. Where consent is required by law, we will obtain it through appropriate mechanisms.

Because Kaynetics is infrastructure that Tenants configure and use to interact with their own customers and visitors, KayJay Global Solutions often processes personal data on behalf of a Tenant, acting as a data processor/service provider, while the Tenant acts as the data controller for its own end users. Where a separate Data Processing Agreement governs a Tenant relationship, that agreement takes precedence for processing carried out by KayJay Global Solutions on that Tenant’s behalf.

2Information We Collect

We may collect:

• Full Name
• Email Address
• Phone Number
• Company/Organization Name and Role
• Tenant, Workspace, and User Account Information
• Login and Authentication Data
• Subscription and Billing Information
• Agent Configuration and Usage Data
• Conversation and Chat Transcripts (where a Tenant deploys the AI Chatbot)
• Lead and Contact Information Captured via AI Agents
• Company Address
• Website
• Privacy Contact
• Data Protection Officer / contact details (if designated)
• Documents and Content Uploaded to Knowledge Collections
• Connected Third-Party Account Data (e.g., email or calendar, where a user authorizes an OAuth connection for agents such as Email Tracker or Demo Scheduling)
• AI Credit and Usage Metrics
• Device Information
• IP Address
• Browser and Usage Information
• Audit and Access Logs

3Purpose of Collection

Information may be used to:

• Create and manage Tenant, Workspace, and user accounts
• Verify user identity and enforce role-based access control
• Operate and configure AI agents on behalf of Tenants
• Generate AI-powered responses, content, and insights using the RAG Engine and other agents
• Capture, qualify, and manage leads on behalf of Tenants
• Track subscription entitlements, AI credit usage, and storage usage
• Improve platform functionality, reliability, and security
• Prevent fraud, abuse, and unauthorized access
• Communicate updates, announcements, and service-related notices
• Generate analytics and reports for Tenants
• Maintain audit logs for security and compliance purposes

4Legal Basis of Processing

Where required by applicable data protection law (including the EU/UK GDPR), we rely on one or more of the following legal bases to process personal information:

• Consent: For example, where a user opts in to a specific AI feature, marketing communication, or optional data collection.
• Contract: Where processing is necessary to provide the Kaynetics services a Tenant has subscribed to.
• Legitimate Interest: For example, to secure the platform, prevent fraud and abuse, and improve service reliability, balanced against individual rights.
• Legal Obligation: Where processing is required to comply with applicable law, regulation, or a valid legal request.

The specific legal basis for a given processing activity depends on the nature of that activity and the jurisdiction involved.

5Data Sharing

We may share information with:

• The Tenant that owns the relevant account, workspace, or agent configuration
• Service providers supporting hosting, infrastructure, and platform operations (see Section 6, Subprocessors)
• Other KayJay Global product platforms that a Tenant has authorized to integrate with Kaynetics (for example, KJ Drive), subject to tenant isolation and access controls
• Government or regulatory authorities, where legally required or permitted by applicable law

6Subprocessors

To provide the Kaynetics service, we may engage carefully selected subprocessors to perform specific functions on our behalf, which may include:

• AI model providers (for example, OpenAI, Anthropic, Google, or Azure OpenAI) — to generate AI responses and process prompts
• Cloud hosting and infrastructure providers (for example, AWS, Render) — to host and run the platform
• Content delivery and security providers (for example, Cloudflare) — to protect and accelerate delivery of the service
• Payment processors (for example, Stripe, Razorpay) — to process subscription billing
• Email and communication providers (for example, Resend, Twilio, Postmark, and other SMTP providers) — to deliver transactional and account-related communications

This list is illustrative and may change as our vendor relationships evolve. A maintained, authoritative list of current subprocessors is available in our Subprocessor List. Subprocessors are contractually bound to protect personal information consistently with this Privacy Policy.

7International Data Transfers

Kaynetics and its subprocessors may store and process data in multiple locations, including:

• India
• AWS cloud regions
• Render (United States)

Where personal information is transferred across borders, including out of India or the European Economic Area, we seek to apply appropriate safeguards, which may include Standard Contractual Clauses (SCCs) or other legally recognized transfer mechanisms, consistent with the adequate safeguards required by applicable law.

8Tenant Data Isolation

Kaynetics is designed as a multi-tenant platform. By default, one tenant’s data, documents, prompts, embeddings, and AI outputs are not accessible to another tenant. Cross-tenant access is only possible where explicitly authorized, such as through an approved integration or API connection.

9AI and Knowledge Base Processing

Where a Tenant enables AI agents that use Retrieval-Augmented Generation (RAG) or similar knowledge-base features, documents and content the Tenant authorizes may be indexed, embedded, searched, and used to generate AI responses. This processing is scoped to the authorizing Tenant’s own content and is not shared with, or used to answer queries from, another Tenant.

Embeddings generated from a Tenant’s documents remain logically isolated to that Tenant and are not accessible to, or searchable by, any other Tenant. Knowledge embeddings are stored in a tenant-scoped vector index; queries against that index only retrieve content belonging to the querying Tenant.

Customer prompts may be processed by third-party AI providers selected by KayJay Global Solutions or the Tenant, solely for the purpose of providing the requested AI functionality. Neither customer prompts, uploaded documents, embeddings, nor AI conversations are used to train foundation models without explicit written authorization from the relevant Tenant.

10Cookies

Like most SaaS products, Kaynetics and its associated websites use cookies and similar technologies, including:

• Session cookies: To keep users logged in and maintain platform functionality during a session
• Authentication cookies: To verify identity and secure access to Tenant accounts
• Analytics cookies: To understand platform usage and improve the service

11Data Security

We implement technical and organizational measures designed to protect user and Tenant information. Depending on the system and configuration, these measures may include:

12Data Retention

We retain personal information for as long as necessary to provide the Kaynetics service and for legitimate business purposes, including:

• For the duration of an active subscription and Tenant relationship
• Until a Tenant or user requests deletion, subject to Section 13 (Data Deletion)
• As required to meet contractual obligations to a Tenant
• As required by applicable law, audit, or fraud-prevention obligations
• In backups, for a limited period following deletion from primary systems, consistent with our backup retention cycle

13Data Deletion

When a Tenant or user requests deletion of their data, or when a Tenant’s account is deleted:

• Data is generally deleted from primary, active systems within defined SLA timelines of a verified request.
• Deletion from primary systems is typically a soft delete followed by permanent removal after a defined recovery window, during which a Tenant may request restoration.
• Copies of data may persist in backups for a limited period until those backups are cycled out, consistent with our backup retention schedule.
• Some information may be retained beyond deletion where required for legal, audit, tax, or fraud-prevention purposes.

14Security Incident Notification

In the event of a security incident affecting a Tenant’s personal information, we will notify the affected Tenant without undue delay and in accordance with applicable law and any contractual notification obligations.

15User Rights

Users may request:

• Access to their data
• Correction of inaccurate information
• Account deletion
• Withdrawal of consent where applicable
• Data portability, where applicable — export of a Tenant’s data in a common, machine-readable format, subject to the Tenant’s subscription plan and applicable law

Requests relating to data submitted through a Tenant’s use of Kaynetics (for example, information provided by a chatbot visitor) should generally be directed to the relevant Tenant in the first instance, as the Tenant typically controls that data.

16Administrator Access

Within a Tenant, users designated as Tenant Admin or Workspace Admin may, depending on their configured role and permissions, have access to information generated by other users within that same Tenant, including conversations, leads, and agent usage data. This access is governed by the Tenant’s own internal policies and the roles the Tenant assigns. KayJay Global Solutions personnel access to Tenant data is limited, role-based, and logged, as described in our Access Control Policy.

17Children’s Privacy

Kaynetics is intended for business and organizational use and is not directed at children. Where a Tenant’s use of Kaynetics involves data relating to minors or students, such use is governed by our Children / Student Data Policy, wherever applicable.

18Business Transfers

If KayJay Global Solutions is involved in a merger, acquisition, reorganization, financing, or sale of some or all of its assets, personal information may be transferred as part of that transaction. We will seek to ensure that any such transfer is subject to protections consistent with this Privacy Policy, or that affected Tenants and users are notified of any material change.

19Account Termination

Upon expiry, cancellation, or termination of a Tenant’s subscription, the Tenant’s data is handled in accordance with Section 12 (Data Retention) and Section 13 (Data Deletion) above. Tenants are encouraged to export any data they wish to retain, consistent with Section 15 (User Rights), before termination takes effect.

20Policy Updates

We may update this Privacy Policy from time to time. Material changes will be communicated through the platform, email, or other appropriate means where required by applicable law.

21Contact Information

22Related Policies

This Privacy Policy is part of a broader suite of policies governing Kaynetics and the KayJay Global Trust & Compliance Framework. As of the effective date, the following documents make up that suite: