Legal
Privacy policy
This policy explains what personal information we collect on this website and in the Klayno app, why we collect it, and what you can do about it. It is written to be read, not skimmed.
Last updated
1. Who we are
Klayno LLC, a Delaware limited liability company, with its principal office at 16192 Coastal Highway, Lewes, DE 19958, United States ("Klayno", "we", "us"), operates the website klayno.com and the application at app.klayno.com (together, the "Service").
For anything about your personal information, email privacy@klayno.com or write to us at the address above.
2. Two roles: our own data and our customers' data
Klayno acts in two different roles, and your rights depend on which one applies.
- We decide how to use the data of visitors to this website, of the people who create an account, and of the people who contact us or apply for a job. In GDPR terms we are the controller; in US state privacy law terms we are the business. This policy covers that data.
- We act on our customers' instructions for the data they put into their workspace: their contacts, prospects, clients, call notes and transcripts, form answers, documents, contracts and payments ("Customer Data"). Our customer decides why and how that data is used; we are their processor or service provider under our data processing agreement. If you are in a customer's workspace as a contact, ask that customer first; we will help them answer.
3. Information we collect on this website
- Technical logs. Our hosting provider records the IP address, browser and pages requested for every visit, to serve the site and detect abuse. The host of klayno.com is Cloudflare, Inc., which keeps these logs for a limited period before deleting them.
- Analytics, only after you click Accept in the cookie banner: Google Analytics 4 and the Meta Pixel. They measure which pages are visited and which campaigns brought you here. Nothing loads before you choose. Details in the cookie policy.
- Forms. When you use the Talk to sales, Open application or job application forms, we receive what you type: your name, email, company and message.
- Emails you send us, at any of our addresses.
4. Information we collect in the app
- Account data: name, email address, password (stored hashed by Supabase Auth), profile picture, language and theme, and the Google account identifiers if you sign in with Google.
- Workspace and billing data: workspace name, business type, team size and industry given at onboarding, plan, invoices and payment status. Card numbers are entered on Stripe's pages and never reach our servers.
- Usage and device data: pages used, actions taken, error reports, browser and device information, and push notification tokens for the devices where you installed the app.
- Connected accounts: when you connect Google Calendar, Calendly, Fathom, Instagram, YouTube or Stripe, we store the access tokens and the data those services send us (events, bookings, transcripts, messages, analytics), so the features you turned on can work.
- Customer Data, as defined above, which we process on behalf of the workspace owner.
5. Why we use it
The table shows each purpose, the data it uses, and, for people in the European Economic Area, the United Kingdom and Switzerland, the legal basis under GDPR article 6.
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Create and run your account and workspace | Account, workspace, usage data | Contract |
| Bill you and prevent fraud | Billing data | Contract, legal obligation |
| Run the features you turn on (calendar sync, DM inbox, call transcripts, payments) | Connected accounts, Customer Data | Contract, on our customer's instructions |
| Run the AI employee on your workspace | Customer Data you point it at, your instructions | Contract, on our customer's instructions |
| Send transactional emails (verification codes, invitations, receipts, booking confirmations, security notices) | Email address | Contract |
| Send product news and tips, only if you opted in | Email address, plan | Consent; you can unsubscribe at any time |
| Answer your messages and sales requests | What you send us | Legitimate interest |
| Keep the Service secure and fix bugs | Technical logs, error reports | Legitimate interest |
| Measure the website audience | Analytics cookies | Consent |
| Recruit | Application data | Pre-contractual steps, legitimate interest |
| Comply with the law (accounting, requests from authorities) | Billing, account data | Legal obligation |
We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use it for advertising other than measuring our own campaigns with the analytics you consented to.
6. Emails we send
- Transactional emails are part of running the Service: verification codes, invitations to a workspace, receipts and invoices, booking confirmations and reminders, form notifications, agreements sent for signature, and security notices. You receive them as long as you have an account. They are sent through Twilio SendGrid.
- Marketing emails (product news, tips, occasional offers) are sent only to people who asked for them, for example by subscribing on our website or in the app. Every marketing email includes an unsubscribe link, our mailing address, and a link to this policy. Unsubscribing takes effect within a few days and never affects transactional emails.
- To stop marketing emails you can also write to privacy@klayno.com.
7. The AI employee
The AI employee reads the parts of the workspace you give it access to, and performs the actions you ask for, at the autonomy level you set. Every action is written to an activity log you can read. At the default level, anything that would leave the workspace (an email, a message, a contract) waits for your approval.
To do this, we send the relevant text to our AI model provider, Anthropic, listed on the sub-processors page, under a contract that limits what it may do with that text to providing the service to us.
8. Who receives your information
- Our service providers and sub-processors: the companies that host, store, send or process data for us. The full list, with what each one does and where it is, is on the sub-processors page.
- The third-party services you connect yourself (Google, Meta, Calendly, Fathom, Stripe). Their own privacy policies apply to what they do on their side.
- Your workspace members, according to the roles the workspace owner set.
- Law enforcement and authorities, when the law requires it or to protect the rights, safety or property of Klayno, our users or others, after reviewing the request.
- A buyer or successor, if Klayno is sold, merges, or reorganizes; you would be told beforehand.
9. Where your information is stored
Klayno is a United States company. Customer Data and account data of customers in Europe are stored in the European Union, on Amazon Web Services (AWS) servers, through a Supabase project. Other data, and data processed by our US providers, is processed in the United States.
If you are in the European Economic Area, the United Kingdom or Switzerland, your information may be accessed from the United States when our team runs the Service or answers a support request, and some of our providers (for example Stripe, SendGrid, Fathom, Calendly, Anthropic) are based in the United States. Those transfers rely on the European Commission's Standard Contractual Clauses, or on the EU-US Data Privacy Framework where the provider is certified. You can ask us for a copy of the safeguards in place.
10. How long we keep it
| Data | Kept for |
|---|---|
| Account and workspace data | As long as the account exists, then deleted from live systems within 30 days of deletion. Backups rotate out within 30 days after that. |
| Customer Data | As long as the workspace exists, or as instructed by the workspace owner. Same deletion cycle. |
| Invoices and payment records | As long as tax and accounting law requires. |
| Technical logs | 12 months, then deleted. |
| Analytics data | Google Analytics: 14 months. Meta: per Meta's retention. |
| Sales inquiries | 3 years after our last exchange. |
| Job applications | 2 years after our last exchange, unless you ask us to delete them earlier. |
11. Your rights and choices
Wherever you live, you can ask us to:
- Tell you what personal information we hold about you, and give you a copy.
- Correct it when it is wrong or incomplete.
- Delete it, when we no longer have a reason to keep it.
- Give it to you in a portable format.
- Stop sending you marketing emails.
Email privacy@klayno.com. We may ask you to confirm your identity. We answer within 30 days (one month under the GDPR), and we do not charge for it or treat you differently for asking. Workspace owners can also export and delete most data directly in the app.
If you are in the European Economic Area, the United Kingdom or Switzerland, you can also restrict how we use your data while a dispute is being settled, object to processing based on our legitimate interest, and withdraw a consent at any time without affecting what was done before. If you are not satisfied with our answer, you can complain to the data protection authority of the country where you live or work. Our GDPR statement has more detail.
12. Residents of California and other US states
If you live in California, Colorado, Connecticut, Virginia, Texas, Oregon or another state with a comprehensive privacy law, you have the rights in section 11 under that law: to know what personal information we collect and how we use and share it, to access it, to correct it, to delete it, and to receive it in a portable format. You also have the right to opt out of the sale or sharing of personal information and of targeted advertising. We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use it for targeted advertising or for profiling with legal or similarly significant effects, so there is nothing to opt out of.
In the last twelve months we collected the categories of personal information listed in sections 3 and 4 (identifiers, commercial information, internet activity, and professional information), from you directly, from your devices, and from the services you connect, for the purposes in section 5, and we disclosed them to the service providers in section 8 for business purposes only. We do not discriminate against you for exercising your rights. You can use an authorized agent to make a request; we will ask for proof of the authorization. If we deny your request, you can appeal by replying to our answer or by writing to privacy@klayno.com.
Our site does not respond to Do Not Track signals, because there is no agreed standard for them. The only non-essential cookies we use are the analytics cookies, which load only after you accept them in the banner.
13. Security
Encryption in transit and at rest, per-workspace row-level security, role-based permissions and audit trails. The details are on the security page. No system is perfectly secure; if we learn of a breach that affects you, we will notify you as the law requires.
14. Children
Klayno is a business tool. It is not directed at anyone under 18, and we do not knowingly collect personal information from children under 13, as defined by the Children's Online Privacy Protection Act (COPPA), or under 16 in the European Union. If you think a child gave us information, write to us and we will delete it.
16. Changes to this policy
When we change this policy, we update the date at the top. If the change matters to you (a new purpose, a new category of recipient), account holders get an email before it applies.