Privacy Policy

Version 2.1 · Last updated: 2026-10-08 · Last reviewed: 2026-10-08 · Effective: 2026-11-20

Summary of changes from Version 2.0: extends the policy to Account holders and users; describes fraud and abuse prevention at signup, login and checkout, including device recognition (§4A) and automated holds with human review (§2); adds retention periods for security records and confirmed-fraud records (§5); adds IPQualityScore, Fingerprint.com and Stripe as recipients (§6); adds §13 on processing we carry out on behalf of your organization.

This Privacy Policy explains how Kameas AI, Inc. (“Kameas”, “we”, “us”, “our”) collects, uses, shares, retains, and protects personal information when you visit the websites we operate at kameas.ai and its subdomains (including kenaz.kameas.ai) (the “Site”), when you join the waitlist or receive product updates, and when you create or use an account for Kameas Fleet or Kenaz (an “Account”) (together with the Site, the “Service”).

This Privacy Policy describes what we do as a controller (or, under U.S. state laws, a business) of personal information about Site visitors, waitlist signups, prospective customers, recipients of our marketing communications, and Account holders and users as to their account, billing, security and fraud-prevention information. Where your organization has subscribed to Kameas Fleet, two other things apply. First, personal information your organization and its users submit to or generate through the product, including any Workflow Data sent under the optional Offload feature, is processed by us on your organization’s behalf as its processor under the Kameas Subscription Agreement, Part 2 (the Data Processing Addendum); §13 below explains what that means for you. Second, your organization, not Kameas, is the controller of that information, and requests about it should go to your organization.

1. The categories of personal information we collect

In the twelve months preceding the “Last updated” date above, we have collected the following categories of personal information (using the categories defined in Cal. Civ. Code § 1798.140(v)):

On the Site we do not collect “sensitive personal information” as defined in Cal. Civ. Code § 1798.140(ae). For Accounts, your sign-in credentials (your account identifier together with your password or other authentication secret) are sensitive personal information under that definition. We use them only to authenticate you and secure your Account, which are purposes permitted without a “Limit the Use of My Sensitive Personal Information” option under Cal. Civ. Code § 1798.121 and its regulations, and we do not use them to infer characteristics about you. If you contact us by email, the contents of your message will become personal information we hold; do not send us sensitive information through unencrypted email.

2. How we use personal information

We use the personal information described above for the following business and commercial purposes:

• Provide the Service. Acknowledge your waitlist signup; send the confirmation, product updates, launch announcements, and transactional messages you signed up for; provide customer support for any inquiry you send us.
• Operate the Site. Serve the pages you request; produce server access logs for debugging and abuse-prevention; allocate capacity; detect and prevent fraud, denial-of-service attempts, and other forms of abuse of the signup form.
• Provide and secure Accounts. Create your Account, authenticate you, manage your organization membership, deliver the features your organization has subscribed to, and send service messages about your Account.
• Prevent fraud and abuse. Screen signups, logins and checkouts for signs of fraud or abuse, including by checking IP reputation and email validity, recognizing devices (see §4A), and comparing against records of confirmed fraud. We train our own scoring on those signals and on billing outcomes so that a device or email behind repeated abusive signups is recognized across organizations. This processing is not optional, because allowing it to be declined would defeat its purpose; §3 and §8 explain the legal basis and your rights.
• Understand how the Site is used. Produce aggregate analytics about traffic patterns; choose which pages, examples, and documentation to invest in. We do this through Google Analytics 4, subject to your consent and the regional defaults described in §4.
• Comply with the law. Respond to lawful requests from courts, regulators, and other authorities; enforce our terms; meet our record-keeping obligations.
• Marketing. Send you newsletters and product announcements about Kenaz and Kameas Fleet to which you have subscribed. You can unsubscribe at any time using the unsubscribe link in any marketing email, by contacting privacy@kameas.ai, or by configuring your account preferences (when an account is available).
• Defend our rights. Investigate and address security incidents, suspected fraud, violations of our terms, and threats of harm to our users or the public.

Automated holds and human review. Our fraud-prevention systems can automatically place a signup on hold, or require an additional verification step at login, when the risk score is high. An automated hold is never a final refusal: we tell you at the time that your signup is on hold, you can ask for a review and give us more information by writing to the address shown in the notice, and a person at Kameas reviews the hold and decides within two business days of your request. Only a person can permanently block an Account, and we record the reasons. We do not use personal information to make decisions about creditworthiness, employment, housing, insurance, or any other consequential decision under applicable law. Our Automated Decision Safeguards standard, available on request from privacy@kameas.ai, describes the procedure.

3. The legal basis on which we process personal information (GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the GDPR (or the UK GDPR, or the Swiss FADP, as applicable) requires us to identify a legal basis for each purpose for which we process your personal information. Our legal bases are:

• Consent (Art. 6(1)(a)). Setting non-essential analytics cookies; sending marketing emails.
• Performance of a contract (Art. 6(1)(b)). Sending the waitlist confirmation and the product-update messages you specifically requested when you signed up.
• Performance of a contract (Art. 6(1)(b)), additionally: creating and administering your Account and providing the features your organization has subscribed to.
• Legitimate interests (Art. 6(1)(f)). Operating the Site, protecting it against abuse, debugging, and producing server access logs; and preventing fraud, abuse and unauthorized access to Accounts and to the Service. Our interest is in keeping the Site and the Service available, secure and paid for, and in protecting our other users and customer organizations from abuse. We have assessed this against your rights and interests and concluded that the data we process (IP address, email validity signals, device characteristics, account and billing events, and the resulting risk scores and labels), the short default retention (90 days), the pseudonymization of longer-kept fraud records, and the human review of every adverse outcome make the processing proportionate. Recital 47 of the GDPR recognizes fraud prevention as a legitimate interest. You may request a summary of our assessment from dpo@kameas.ai.
• Legal obligation (Art. 6(1)(c)). Responding to valid requests from supervisory authorities, courts, and other competent regulators.

You can object to processing based on legitimate interests, or withdraw consent for processing based on consent, at any time using the contact information in §11 below. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

4. Cookies and analytics

We use Google Analytics 4 to understand how visitors use our Site (pages viewed, time on page, where traffic comes from). We do not use Google Analytics for advertising, remarketing, or to build profiles of you across other sites. IP addresses are anonymized before storage.

Google Analytics is loaded with Google Consent Mode v2. The default state varies by where you are visiting from:

• European Union, EEA, United Kingdom, Switzerland, or any region we cannot determine — analytics storage is denied by default. No analytics cookies are written and no measurement data is sent to Google until you explicitly accept the consent banner shown on your first visit. If you decline, only a small first-party preference record is stored in your browser to remember that choice; that record is a strictly-necessary preference and is not used for analytics or tracking.
• United States — analytics storage is granted by default and a small first-visit toast points you at the opt-out link. We additionally enable Google’s restricted data processing mode for U.S. visitors, which directs Google to treat your data as if you had opted out of any “sale” or “sharing” under the California Privacy Rights Act and similar U.S. state laws.
• Other regions — analytics storage is granted by default with the same opt-out toast.

Regardless of region, we honor two browser-level opt-out signals: Global Privacy Control (navigator.globalPrivacyControl) and the legacy Do Not Track header. If your browser sends either signal, we set Consent Mode to denied and do not show a banner.

You can change your choice at any time by clicking Your privacy choices in the Site footer.

If you accept analytics, the following cookies may be set on this domain: _ga, _ga_<ID> (Google Analytics, used to distinguish visitors and sessions). These are first-party cookies with a lifetime of up to 2 years; you can clear them at any time through your browser settings.

Google’s data practices for Analytics are described in Google’s Privacy Policy. You can opt out of Google Analytics globally across all sites by installing Google’s browser opt-out add-on.

4A. Device recognition for security

When you sign up or log in, we collect characteristics of your browser and device (such as browser type and version, operating system, screen and rendering characteristics, time zone, and similar technical signals) and derive from them an identifier that lets us recognize whether the same device has been seen before. We do this with a service provided by Fingerprint.com, configured to process this information in the European Union and to retain it for no longer than 90 days.

We use device recognition for one purpose only: to protect the Service and its users against fraud, abuse and unauthorized access, by detecting devices associated with repeated abusive signups, account takeover attempts, or confirmed fraud. We do not use it for analytics, advertising, personalization, or to track you across other websites, and we do not combine it with data from other sites. Because it is strictly necessary to provide securely the service you are requesting when you sign up or log in, we do not ask for consent to it; we tell you about it at the point of signup and login and in this section. If you object to this processing, you may write to dpo@kameas.ai and we will consider your objection as described in §8.2.

5. How long we keep personal information

We retain personal information only for as long as we need it for the purposes described above, subject to longer retention where required by law. Specifically:

• Waitlist signups (email address, role tag, signup date, source): retained for so long as you remain on the waitlist plus thirty (30) days after you unsubscribe or after the Kenaz product reaches general availability and the waitlist is retired, after which the record is deleted from our primary database. Suppression records (a hash of your email address and an unsubscribe / bounce / complaint flag) are retained indefinitely so that we do not accidentally email you again after you have opted out.
• Server access logs (IP, user-agent, request path, timestamp): 30 days, then deleted in the ordinary course.
• Google Analytics data: 14 months at the property level; aggregated reports may be retained longer.
• Cookie preferences: stored in your browser only, for the lifetime of the cookie or until you clear it.
• Email correspondence: up to 24 months after the conversation closes, unless we need it longer to defend against a legal claim, comply with a legal obligation, or maintain a permanent record (in which case we retain it for the period required and then delete it).
• Account information (name, email, organization, role, sign-in identifiers): for the life of your Account plus thirty (30) days after it is deleted, after which it is removed from our primary database. Backups expire within thirty (30) days after that.
• Security and fraud-prevention signals (IP address and reputation, email validity signals, device recognition identifiers, risk scores, signup and login events): ninety (90) days, then deleted. These records are erased with your Account or your organization if that happens sooner.
• Confirmed-fraud records: where we have established fraud or abuse (for example a payment dispute decided against the account holder, a card issuer’s early fraud warning, a block applied by our staff after review, or a very high-confidence match from our fraud-prevention vendor), we keep a pseudonymized record consisting of keyed hashes of the email address, IP address and device identifier involved, the label, its source, who applied it and when, for thirty-six (36) months from the date of the label. We keep these records even if you ask us to delete your personal information, because they are necessary to protect the Service and other users from repeated fraud and to establish, exercise or defend legal claims; see §8 for the basis.
• Backups. Our database backups are retained for thirty (30) days. Information deleted from our primary systems can therefore persist in encrypted backups for up to thirty (30) days after deletion.

6. Who we share personal information with

We do not sell your personal information, and we do not share it for cross-context behavioral advertising as those terms are defined under California or other U.S. state privacy laws. Within the twelve months preceding the “Last updated” date, we have not sold or shared personal information for those purposes.

We do disclose personal information to the following categories of recipients, in each case under written contracts that restrict their use of the information to the purposes for which we disclosed it:

• Service providers / processors who help us run the Service:
  • Amazon Web Services, Inc. — cloud hosting, storage, server access logs, and the data store for the waitlist (United States).
  • Resend, Inc. — transactional and marketing email delivery and bounce/complaint webhook processing (United States).
  • Google LLC — Google Analytics 4 (subject to your consent and the regional defaults in §4; United States).
  • IPQualityScore LLC — IP address, email and device reputation checks at signup, login and checkout, for fraud prevention (United States).
  • Fingerprint, Inc. — device recognition at signup and login, for fraud prevention (European Union region).
  • Stripe, Inc. — payment processing and subscription billing; Stripe also provides us with dispute and early-fraud-warning signals that we use to label confirmed fraud (United States).
  • Amazon Web Services, Inc. — in addition to the uses above, hosting of Accounts, security and fraud-prevention records, and, on behalf of customer organizations, the data described in §13 (United States, us-east-2).
• Professional advisors (accountants, lawyers, insurers, auditors) when reasonably necessary to obtain advice or defend a claim.
• Authorities in response to valid legal process, or where we have a good-faith belief that disclosure is necessary to comply with the law, enforce our terms, address fraud or security incidents, or protect our users or the public from harm.
• Acquirers, in a corporate transaction. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our assets, personal information may be transferred as part of that transaction. We will provide notice on the Site and, where required, by email before personal information becomes subject to a new privacy policy.

7. International transfers of personal information

We are based in the United States and our service providers operate primarily from the United States. If you access the Site from outside the United States, your personal information will be transferred to, stored in, and processed in the United States.

For transfers of personal information from the European Economic Area, the United Kingdom, or Switzerland to the United States, we rely on the European Commission’s Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), the UK International Data Transfer Addendum issued by the UK Information Commissioner’s Office, and, for Switzerland, the SCCs construed under the Swiss FADP. We are not, at this time, self-certified to the EU–U.S. Data Privacy Framework. You may request a copy of the relevant transfer documentation by emailing dpo@kameas.ai.

8. Your rights

8.1 Rights for U.S. state-law residents (California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and others)

If you are a resident of a U.S. state with a comprehensive consumer privacy law, you have the right (subject to verification of your identity, and subject to limited exceptions in those laws) to:

• Know what personal information we have collected about you, the sources, the purposes, the categories of recipients, and (in California) the specific pieces of personal information we hold;
• Delete personal information we have collected about you;
• Correct inaccurate personal information we hold about you;
• Receive a portable copy of personal information you have provided to us, in a structured, commonly used, machine-readable format;
• Opt out of sale or sharing of personal information, and opt out of profiling in furtherance of decisions that produce legal or similarly significant effects. We do not sell or share personal information. Our fraud-prevention scoring does not make final decisions by itself: every adverse outcome is reviewed by a person before it becomes final (see §2), so it is not solely automated profiling of that kind. You may nonetheless ask us to review any fraud-prevention outcome that affected you by writing to privacy@kameas.ai;
• Limit the use and disclosure of sensitive personal information. We do not collect sensitive personal information through the Site;
• Be free from retaliation or discrimination for exercising any of these rights;
• Appeal a denial of your request (where applicable law provides an appeal right).

To exercise any of these rights, email privacy@kameas.ai with the subject line “Privacy rights request” and tell us which right you want to exercise. We will acknowledge receipt within ten (10) business days and substantively respond within forty-five (45) days (extendable by another forty-five (45) days where reasonably necessary, in which case we will tell you why). We will verify your identity using the email address you provide, by matching it against the record we hold; if we cannot verify your identity, we will tell you and ask for additional information.

Authorized agents. You may designate an authorized agent to make a request on your behalf. We may ask the agent to provide written permission signed by you, and we may ask you to verify your own identity directly.

California “Shine the Light”. California Civil Code § 1798.83 permits California residents to request information about disclosures of personal information to third parties for those third parties’ direct-marketing purposes. We do not disclose personal information for third parties’ direct-marketing purposes. You may confirm that by writing to privacy@kameas.ai.

“Do Not Sell or Share My Personal Information”. Because we do not sell or share personal information for cross-context behavioral advertising, we do not display a dedicated opt-out link. We do, however, honor Global Privacy Control signals as described in §4.

8.2 Rights for EEA, UK, and Swiss residents (GDPR)

If you are in the EEA, the UK, or Switzerland, you have the right to:

• access the personal information we hold about you (Art. 15 GDPR);
• have inaccurate personal information rectified (Art. 16);
• have personal information erased in the circumstances set out in Art. 17;
• restrict processing in the circumstances set out in Art. 18;
• receive a portable copy of personal information you provided to us (Art. 20);
• object to processing based on legitimate interests, including direct marketing (Art. 21);
• withdraw consent at any time, without affecting the lawfulness of prior processing (Art. 7(3));
• lodge a complaint with your national supervisory authority. A list of EU/EEA authorities is available from the European Data Protection Board; UK residents may contact the Information Commissioner’s Office; Swiss residents may contact the Federal Data Protection and Information Commissioner.

Objections to fraud-prevention processing. If you object under Art. 21 to our fraud-prevention processing, we will stop unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims. Preventing repeated fraud against the Service and its users is such a ground where the record concerns confirmed fraud, and we will tell you our decision and the reason. Confirmed-fraud records described in §5 are retained under Art. 17(3)(e) and Art. 21(1) notwithstanding a request for erasure.

To exercise any of these rights, email dpo@kameas.ai. We will respond within thirty (30) days of receipt of a verifiable request, extendable by a further sixty (60) days where the request is complex or numerous.

9. Security

We implement and maintain administrative, technical, and physical safeguards designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access. These include encryption in transit (TLS 1.2 or higher), encryption at rest for the waitlist data store, role-based access controls, multi-factor authentication for personnel access to production systems, and a documented incident response plan. No security control is perfect; we cannot guarantee absolute security, and you should take care with how you share information with us (in particular, do not send sensitive information through unencrypted email).

If we become aware of a personal data breach affecting your personal information, we will notify you and any applicable supervisory authority as required by applicable law.

10. Children

The Site and the Service are not directed to children under the age of 13. We do not knowingly collect or solicit personal information from anyone under the age of 13. If you believe we have collected personal information from a child under 13, please email privacy@kameas.ai and we will delete it as soon as possible. The Kameas Fleet product (separate from the Site) is intended for use only by individuals at least 18 years old.

11. Contact us

For privacy questions, requests, complaints, or to exercise any right described in §8, contact:

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email (if you are a waitlist subscriber and have provided us with an email address) and by posting a prominent notice on the Site at least thirty (30) days before the changes take effect. Non-material changes (clarifications, typo fixes, contact-detail updates) take effect immediately. The “Last updated” date at the top of this page reflects the most recent change.

13. Processing we carry out on behalf of your organization

If you use Kenaz through an organization that subscribes to Kameas Fleet, the following applies to information processed through the product.

• Local by default. The Kenaz tools on your machine record your workflow activity and produce suggestions on your machine. By default nothing leaves your machine.
• Offload is your organization’s choice. Your organization’s administrator can enable an optional, paid feature called Offload, under which workflow activity data is sent from your machine to Kameas’s cloud (in the United States, AWS region us-east-2) so that predictions can be computed there, including from models trained on your team’s history. Your organization decides whether to enable it, whether it is required for everyone, off, or your choice, how long data is kept (up to 90 days), and what is excluded. Before anything is first sent from your machine, you will see a notice in the product describing exactly what is sent.
• What is sent, and what never is. Offload sends workflow events (file paths, shell commands run, git branch and repository names, the active application or window, browser activity at domain level, device power state, timestamps) and task summaries derived from them. It never sends the contents of your files, your source code, your prompts or AI conversations, screenshots, or keystrokes, and strings that look like credentials are redacted before sending.
• Your organization is the controller; Kameas is its processor. Kameas processes this data only on your organization’s instructions and only to provide the service to your organization. Your organization is responsible for having a lawful basis and for giving you the notices your jurisdiction requires. Predictions about you are delivered only to your own tools; your organization’s administrators do not see individual predictions, and the contract prohibits your organization from using Offload data to evaluate your performance or make employment decisions about you.
• Your rights. Requests to access, correct, delete or export this data should go to your organization. If you contact us directly, we will acknowledge your request, direct you to your organization, and tell your organization you asked. We will carry out your organization’s instructions, including deletion, and the deletion and retention commitments are set out in the Data Processing Addendum at kenaz.kameas.ai/subscription-agreement.