Privacy Policy

This Privacy Policy explains how Kylo (“Kylo,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal data in connection with our AI agent platform and related services (the “Services”).

Operator: Kylo, a Company Limited by Shares registered under Innovation City – Ras Al Khaimah, United Arab Emirates (License No. 07011267). Registered office: Office A, Innovation City Business Centre, RAK Bank ROC Office, Ground Floor, Al Rifaa, Sheikh Mohammed Bin Zayed Road, Ras Al Khaimah, UAE. Commercial presence: Dubai / UAE. Privacy and support: support@kylo.ae.

UAE data hosting: Kylo’s production infrastructure — including the application, PostgreSQL database, Redis, encrypted integration tokens, account data, ops IDs, uploads, encrypted transcripts, and conversation-scoped agent memory — is hosted on servers located in Dubai, United Arab Emirates. We do not replicate or store Kylo-controlled personal data on infrastructure outside the UAE.

Our privacy stance (messages & leads): Kylo stores WhatsApp conversation transcripts encrypted at rest (AES-256-GCM) on UAE servers when enabled in Settings → Advanced (default ON). Retention is configurable (30 / 90 / 365 days; default 90). Agent memory is separate — conversation-scoped context for reply quality while the conversation exists in Kylo; delete the conversation or clear memory in Settings to remove it. Kylo is not a first-party leads CRM; connect Zoho (or another supported CRM) as your source of truth.

Message text is processed in transit by the AI path (Mastra + OpenRouter and the underlying model provider) and by Meta to deliver replies. Processing is not a permanent Kylo archive. CRM requirement: because Kylo is not a first-party leads database, Clients must integrate at least one supported CRM as the main database to store leads. Zoho CRM is live; additional CRM integrations are coming soon. When you connect a CRM and enable sync tools, lead fields may be sent to your CRM under your control. Your connected CRM remains the source of truth and primary store — not Kylo.

This Policy is issued with reference to Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL). Kylo applies core PDPL principles — lawful basis, data minimisation, security, and data subject rights — as good practice. Where relevant to Clients operating internationally, GDPR standards may also be referenced.

This Policy applies to:

• The Kylo web application and related APIs
• Account registration, authentication, billing, and settings
• Channel connections via Meta (WhatsApp Cloud API live; additional Meta messaging channels coming soon)
• Required CRM integration(s) as the main lead store (at least one; Zoho CRM live; other CRMs coming soon)
• Communications we send about the Service (e.g. auth emails via SMTP)

This Policy does not govern:

• How Meta, OpenRouter (and underlying model providers), Stripe, Zoho, your SMTP host, or your own tools process data under their policies
• Content that end-users share with you on WhatsApp or other channels — you are the controller of that relationship
• Data held in your connected CRM after a sync

Account & profile. Name, email, company name (as provided), password credentials (no plaintext passwords), profile and security settings, and optional avatar uploads to local application storage.

Billing & credits (when enabled). Subscription and plan status; credit balance, allotments, and ledger entries; usage metering events; payment-related identifiers via Stripe — full card PANs are not stored on Kylo. Billing is priced in AED.

Agent & channel configuration. Agent instructions and routing preferences; channel connection metadata; encrypted integration credentials at rest (AES-256-GCM).

Ops / technical IDs and encrypted transcripts. Provider message IDs, conversation/thread keys, timestamps, message role (inbound/outbound), credits charged, and ops-only metadata. When transcript storage is enabled in Settings → Advanced, message bodies are stored encrypted (AES-256-GCM) for the configured retention window — not as plaintext in the database.

CRM sync (in transit; required main lead store). Clients must keep at least one supported CRM connected as the main database for lead storage. If sync tools are enabled, we may process fields your agent chooses to send solely to deliver them to your connected CRM. Kylo does not retain those fields as a first-party leads product.

Technical & security logs. Standard server/application logs, IP addresses, device/browser signals, and authentication events needed to operate and secure the Service.

We design Kylo so that we do not retain:

• Indefinite conversation / chat transcript archives beyond your retention setting
• Lead / contact records as a Kylo product archive
• Playground chat history as durable Prisma transcripts (playground skips ops transcript rows; metering may still record usage)
• Plaintext message bodies in the database

When Store conversation transcripts is enabled (default ON) in Settings → Advanced, encrypted message bodies are kept for your chosen retention period (30 / 90 / 365 days; default 90), then purged. You can export conversations (JSON or CSV) from the Conversations screen or download a full account JSON export from Settings → Advanced.

Conversation-scoped agent memory (exception for reply quality): recent turns may be stored in Mastra agent memory, keyed by channel thread, while the conversation exists in Kylo. Deleted when you delete the conversation or use Clear agent memory in Settings. Used only to generate better replies for that thread — not sold, not used for advertising, and not a substitute for your CRM.

Processing vs retention: To generate a reply, message text is processed by the AI path (Mastra + OpenRouter and the underlying model provider) for that request. Meta retains messages according to Meta’s policies. Transient server logs may occasionally include sensitive snippets; we treat that as operational risk to minimize, not as a transcript or leads store.

• Provide, operate, and improve the Service
• Authenticate accounts and protect against abuse
• Meter credits, enforce entitlements, and bill subscriptions / credit packs via Stripe
• Route Meta webhooks and send/receive messages on your connected channels
• Encrypt and refresh connection tokens as needed
• Deliver lead field values to the CRM(s) you connect as your main lead store, when sync tools are enabled
• Send transactional email (verification, password reset, service notices) via SMTP
• Comply with law and enforce our Terms

We do not sell personal data. We do not use Client or End User data to train AI models for anyone other than the Client from whose use the data was generated. Conversation-scoped agent memory is used only for reply quality on that channel thread and is removed when the conversation is deleted or memory is cleared.

As between Kylo and its Clients, the Client typically acts as data controller for End User data, and Kylo acts as data processor for the platform — except where Kylo determines purposes for its own account data (billing, security), in which case Kylo acts as controller of that account data. A separate Data Processing Agreement may apply when entered into with the Client.

Kylo runs on a self-hosted Docker stack in Dubai, United Arab Emirates — Postgres, Redis, local file storage, and the Kylo application all reside on UAE-based servers. Better Auth sessions are self-hosted on the same stack. We also rely on external APIs to deliver the Service: Meta (WhatsApp Cloud API live; more Meta channels coming soon), OpenRouter and underlying model providers, Stripe (AED), at least one connected CRM as your main lead store — Zoho CRM when you connect (other CRMs coming soon), and your configured SMTP provider. Each external provider processes data under its own terms. Message content handled by Meta or OpenRouter is subject to their retention and processing rules even though Kylo does not keep a permanent chat transcript product and does not store Kylo-controlled data outside the UAE.

Before a new subprocessor is brought into live use in a way that processes Client or End User personal data, Kylo will provide at least thirty (30) days’ prior written notice where required by contract or DPA.

• Account profile & auth — while active; deleted or anonymized after closure subject to legal holds
• Billing / credit ledger / usage — as needed for accounting, disputes, and fraud prevention
• Ops message/conversation rows (IDs, timestamps, credits) — while useful for idempotency, support, and abuse prevention
• Encrypted conversation transcripts — when enabled, for your configured retention window (default 90 days)
• Encrypted channel/CRM tokens — until disconnect or account closure
• Auth email / OTP records — short-lived (minutes to hours)
• Server logs — rolling operational windows
• Mastra agent memory — while the conversation exists in Kylo; deleted on conversation delete or Clear agent memory

• Encryption of WhatsApp / integration tokens at rest (AES-256-GCM)
• TLS for data in transit to our application
• Access controls and account sessions
• Secrets in environment configuration (not in client bundles)

No method of transmission or storage is 100% secure. This Policy does not claim certifications (e.g. SOC 2) or end-to-end encryption of message content unless separately obtained and disclosed. In a breach affecting personal data, Kylo will notify the affected Client without undue delay.

Clients are responsible for lawful submission of personal data for AI processing and for reviewing AI-generated outputs before relying on them. Where the Services send marketing or promotional messages, the Client is solely responsible for TDRA unsolicited-communications rules, Meta policies, and required consent.

Depending on applicable law (including UAE PDPL where it applies), you may have rights to access, correct, delete, or export certain account data; disconnect channel or CRM integrations (at least one CRM remains required as the main lead database while you use the Services for lead capture); export conversations from the Conversations screen (JSON or CSV) or download a full account JSON export from Settings → Advanced; and object to or restrict certain processing where the law allows. Contact support@kylo.ae from your account email. We may need to verify identity before acting.

End-user (contact) data on channels: Requests relating to End User data should generally go to the relevant Client as controller. Kylo does not keep an indefinite transcript or leads archive; encrypted transcripts are retained only for your configured window when enabled. Conversation-scoped agent memory exists only while the conversation remains in Kylo.

Facebook / Meta: If you connected Kylo through Facebook Login or Embedded Signup, you can remove the app in Facebook settings or follow kylo.ae/data-deletion. Meta posts our callback at /api/meta/data-deletion; we return a confirmation code and status URL. Kylo does not keep a Facebook profile archive.

Kylo-controlled storage stays in the UAE. Account profiles, billing records, ops IDs, encrypted channel and CRM tokens, uploads, encrypted transcripts, conversation-scoped agent memory, and other data stored on Kylo’s infrastructure are hosted exclusively in Dubai, United Arab Emirates. We do not maintain backups or replicas of that Kylo-controlled data on servers outside the UAE.

In-transit processing by third parties. To deliver messages and AI replies, certain subprocessors — including Meta (WhatsApp), OpenRouter (and underlying model providers), Stripe, and Zoho — may process personal data on infrastructure outside the UAE for that specific request (for example routing a WhatsApp message or generating an agent reply). That processing is transient and governed by each provider’s terms; it is not a permanent export of your data from Kylo’s UAE hosting. Where required, we rely on appropriate safeguards permitted by law.

Kylo is a business service. It is not directed to children under 18. We do not knowingly collect personal data from children.

We may update this Policy from time to time. The “Last updated” date will change when we do. Material changes may be notified in-product or by email. Continued use after the effective date constitutes acceptance where permitted by law.

Privacy and data requests: support@kylo.ae. Postal: Kylo, Office A, Innovation City Business Centre, RAK Bank ROC Office, Ground Floor, Al Rifaa, Sheikh Mohammed Bin Zayed Road, Ras Al Khaimah, United Arab Emirates. Related: Terms and Conditions · Cookies · Data deletion.