Privacy policy

1. Who this policy covers

This Policy applies to:

1. visitors to Karemelo's website;
2. prospective and current business customers;
3. account administrators and authorised users;
4. people who contact Karemelo directly;
5. people whose information is processed through a Karemelo customer's AI agent, telephone number, messaging account, website chat or business workflow; and
6. other individuals whose information is processed for Karemelo's legitimate business, security or legal operations.

For end-customer data processed for a subscribing business, that business normally determines why its information is collected and used. Its own privacy notice remains important.

2. Our different privacy roles

Karemelo does not have one legal role for every processing activity.

When a business customer decides why and how its end-customer records, calls, messages, appointments or leads are handled and Karemelo processes those records to provide the Services, the business is normally the controller and Karemelo acts as its processor or analogous service provider.

For account administration, Karemelo's own billing records, platform security, fraud prevention, direct support, legal compliance, supplier management and Karemelo's own marketing, Karemelo may act as an independent controller or equivalent responsible organisation.

Where another legal allocation applies, we will follow the applicable law and contract.

3. Information we receive about account users

We may process:

• account-holder and staff names;
• email addresses;
• telephone numbers;
• business names and addresses;
• account identifiers;
• password hashes and authentication information;
• multifactor-authentication information;
• workspace memberships;
• roles and permissions;
• account preferences;
• support requests;
• security events and login history;
• subscription information; and
• usage records.

Where Polar or another authorised merchant/payment provider handles a payment, Karemelo does not ordinarily receive or store the complete payment-card number. We may receive transaction identifiers, subscription status, billing contact details, plan details and payment status required to provide the Service.

4. Business information and uploaded content

Customers may provide business descriptions, products, services, prices, catalogues, inventory information, operating hours, employee information, schedules, documents, knowledge-base materials, prompts, AI instructions, customer lists, CRM records, files and attachments.

The business customer is responsible for determining that it may lawfully provide this information to Karemelo.

5. Conversation and end-customer information

Depending on how a Customer configures the Service, we may process:

• names;
• telephone numbers;
• social-media and messaging identifiers;
• messages;
• call audio;
• transcripts;
• conversation summaries;
• timestamps and metadata;
• voice messages;
• images and attachments;
• appointment details;
• order and quotation enquiries;
• preferences;
• lead information;
• follow-up instructions;
• customer notes; and
• other information a person voluntarily provides during an interaction.

The exact information depends on the Customer, channel and conversation.

6. Calls, recordings and transcripts

A Customer may configure Karemelo to receive or make telephone calls.

Calls may be transcribed and, where enabled, recorded.

The relevant business customer is normally responsible for determining why its call is recorded and for giving notices and obtaining any consent required by applicable law. Karemelo may also have direct legal obligations and will comply with those obligations where they apply.

A recording notice is separate from notification that a person is communicating with an AI system.

7. AI interactions

Karemelo uses AI systems to understand communications, produce responses and perform authorised workflow actions.

Information from an interaction may be sent to AI and voice-infrastructure providers as necessary to provide the configured Service.

AI systems can produce inaccurate or unexpected results. Businesses using Karemelo should supervise and verify consequential actions.

8. Sensitive information

Some conversations may contain sensitive information, including health information.

Customers should minimise the collection of sensitive information and may only use Karemelo for such information when they have a lawful basis and the applicable Karemelo service configuration supports the processing.

Karemelo's standard Service is not represented as universally compliant with every healthcare, medical-record, financial or professional-secrecy regime.

Karemelo does not represent that the standard Service is HIPAA compliant.

9. Technical information

When a person accesses Karemelo or communicates through the Service, we may process technical information such as:

• IP address;
• device and browser information;
• request metadata;
• login and authentication events;
• security and audit events;
• error information;
• crash reports;
• performance information;
• AI usage and token consumption;
• telephone and message usage; and
• other operational diagnostics.

This information may be necessary to provide, secure, bill, troubleshoot and improve the Services.

10. Information we obtain from third parties

We may receive information from:

• our business customers;
• Authorised Users;
• telephone and communications providers;
• Meta platforms used for supported messaging integrations;
• AI providers;
• Polar and payment/merchant-of-record services;
• security and infrastructure providers; and
• other integrations a Customer chooses to connect.

11. Why we process personal information

Depending on our legal role, we process personal information to:

• provide the Services;
• run AI conversations and authorised workflows;
• route calls and messages;
• maintain customer records;
• provide support;
• authenticate users;
• protect accounts and systems;
• prevent fraud, abuse and unlawful use;
• measure Service usage;
• administer subscriptions;
• respond to legal obligations;
• investigate incidents;
• maintain and improve reliability;
• communicate important product, billing or security information;
• respond to enquiries and demonstration requests; and
• conduct lawful marketing.

Where we act solely as processor, these purposes are carried out on the Customer's documented instructions except where law requires otherwise.

12. Legal bases under European and UK data law

Where EU GDPR or UK GDPR requires a legal basis and Karemelo acts as controller, we may rely, as appropriate, on:

• performance of a contract or steps requested before entering one;
• legitimate interests in running, securing and improving a business SaaS service;
• compliance with legal obligations;
• consent, where the relevant processing requires or appropriately relies on consent; and
• other bases available under applicable law.

Where special-category data is involved, an additional legally permitted condition must exist.

Where a Customer is controller, the Customer determines the legal basis for its own end-customer processing.

Other jurisdictions may use different legal bases, and this section does not replace those requirements.

13. Azerbaijan processing

Where Azerbaijani personal-data law applies, Karemelo and its Customers must satisfy the processing, consent, special-category, information-system registration and cross-border requirements applicable to their respective roles.

Karemelo does not rely on this Privacy Policy alone as a substitute for any specific form of consent, registration or other authorisation that Azerbaijani law requires.

14. AI training and service improvement

Karemelo does not use identifiable Customer conversation content to train its own general-purpose foundation model.

We use business/API arrangements and available settings intended to limit external provider use of Customer Content for general model training where available.

Some providers may conduct security, abuse monitoring, safety operations or use appropriately de-identified or aggregated information for service analytics or improvement under their applicable contractual arrangements.

Current provider information is described in our Subprocessor List and may change.

Karemelo may use aggregated or properly de-identified operational information for reliability analysis, capacity planning, security, abuse prevention and product improvement where the information no longer identifies a person under applicable law.

We do not intentionally re-identify information represented as de-identified except, where permitted, to test de-identification safeguards.

15. No sale or advertising use of private conversations

Karemelo does not sell private Customer conversation content.

Karemelo does not share private Customer conversation content with advertisers for behavioural or targeted advertising.

If this practice changes, this Policy and any legally required choices will be updated before the new use begins.

16. Service providers

We use third parties to operate the Service.

Depending on configuration, these include infrastructure hosting, content delivery and security, AI processing, voice and telephony infrastructure, transactional email, error monitoring, analytics and merchant-of-record providers.

Current material providers are described in the Karemelo Subprocessor List.

Not every third party is legally a “subprocessor”. Some organisations, including payment/merchant-of-record services and connected communications platforms, may process information under their own legal role.

17. International transfers

Karemelo's primary application hosting is intended to use Hetzner infrastructure in Germany, but this does not mean all information remains in Germany or the European Union.

AI providers, voice providers, communications platforms, email services, security tools and other providers may process information in other countries.

Where applicable law requires safeguards for an international transfer, we use or require appropriate contractual or other transfer mechanisms, which may include EU Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, provider-specific contractual safeguards or other mechanisms recognised by applicable law.

Azerbaijani cross-border requirements are assessed separately and are not replaced by EU transfer clauses.

18. EU and UK processor transfers

Where Karemelo receives personal data as a processor from a Customer subject to EU or UK data-protection law, the DPA describes applicable transfer arrangements.

A Customer should contact support@karemelo.com if it needs information reasonably necessary to assess those arrangements.

19. Data retention

We retain information only for as long as reasonably necessary for the purposes described in this Policy, our contractual obligations and applicable legal requirements.

Different categories have different retention needs.

While a Customer account is active, customer records, conversation histories, transcripts and uploaded materials may remain in the Service until the Customer deletes them or the applicable retention configuration removes them.

Call recordings are intended to use a separate, shorter retention schedule where configured.

Security and operational logs are retained for periods reasonably required for security, troubleshooting, fraud prevention and legal defence.

Subscription, transaction and accounting records may be retained for periods required by tax, financial and other applicable law.

20. Customer deletion

Customers can delete eligible customers, conversations and other records using available product functionality.

Deletion from the active Service does not necessarily remove every residual backup copy instantaneously.

Protected backup copies may remain until they are overwritten or deleted through the normal backup rotation process and are ordinarily not restored to production except for disaster recovery, security or legal necessity.

Third-party providers may have separate short-term residual retention under their contracts and technical systems.

21. Account termination

Following termination, eligible business customers normally have a 30-day period in which to export available Customer Data.

After that period, Karemelo may begin deleting Customer Data from active systems unless law requires retention.

The exact maximum backup-rotation period will be disclosed once the production backup configuration has been finally verified.

22. Security

Karemelo uses technical and organisational safeguards appropriate to the nature of the Service and information processed.

These may include encryption in transit, encryption at rest for supported systems, authentication controls, multifactor authentication, role-based access controls, workspace permissions, administrative controls and security logging.

No system can be guaranteed absolutely secure.

Karemelo will not claim SOC 2, ISO 27001 or another certification unless that certification has actually been obtained and remains applicable.

23. Administrative access

Authorised Karemelo personnel may access customer information where necessary for requested support, troubleshooting, security or misuse investigations, legal compliance and essential Service operation.

Access is intended to be limited by role, need and confidentiality obligations.

24. Data breaches

Where Karemelo acts as a processor and becomes aware of a personal-data breach affecting Customer Personal Data, it will notify and assist the relevant Customer in accordance with the DPA and applicable law.

Where Karemelo acts as controller, it will make notifications required by applicable law.

25. Marketing from Karemelo

We may send service communications necessary to operate an account, such as authentication, security, billing, subscription, important legal and material product notices.

These communications are not optional where necessary to administer the account.

We may separately send marketing, newsletters or promotional product announcements where permitted by law.

Marketing communications will include or provide an appropriate method to unsubscribe where required.

Unsubscribing from marketing does not prevent necessary account, security or transaction messages.

26. Website forms and sales enquiries

If a person submits a contact form, demo request or sales enquiry, we use the information supplied to respond, evaluate the request, maintain an appropriate sales record and conduct permitted follow-up.

Where required, marketing beyond the requested follow-up will use an appropriate consent or other legal basis.

27. Cookies and analytics

Karemelo uses cookies or similar storage necessary for authentication, session management and security.

Karemelo also uses Umami for website analytics.

Our intended Umami configuration is privacy-oriented and does not use advertising trackers. The exact production implementation, including whether Umami is self-hosted and whether any browser storage or identifiers are used, is described in our Cookie Policy and must be verified against the live deployment.

We do not use advertising cookies unless this Policy and the Cookie Policy are updated and any required choices are provided first.

28. Privacy rights

Depending on where a person lives and which law applies, rights may include:

• access to personal information;
• correction;
• deletion;
• restriction;
• objection;
• data portability;
• withdrawal of consent;
• rights concerning certain automated decisions; and
• the right to complain to an applicable regulator.

These rights are subject to legal conditions and exceptions.

29. Requests concerning a business customer's data

If your information was collected by a clinic, retailer, hotel or another Karemelo Customer, that business is usually the best first point of contact because it controls why the information is processed.

If Karemelo receives a request relating to information that it processes solely for a Customer, we may refer the request to that Customer and assist it as required by law or the DPA.

30. Requests concerning Karemelo-controlled data

To exercise a right concerning information controlled directly by Karemelo, contact:

support@karemelo.com

We may need to verify identity before fulfilling a request.

We will respond within the period required by applicable law.

31. Children

Karemelo business accounts are intended for users aged 18 or over.

The Services are not designed as a general-purpose service directed at children.

A business that uses Karemelo to communicate with minors is responsible for determining and implementing any additional notice, consent, safeguarding and data-protection requirements applicable to its activity.

32. Changes to this Policy

We may update this Policy to reflect changes in law, providers, features or processing.

We will update the effective date and provide additional notice of material changes where required.

33. Contact

Privacy questions may be sent to:

support@karemelo.com

[REGISTERED LEGAL NAME], trading as Karemelo VÖEN: [●] [COMPLETE VERIFIED ADDRESS]

[EU REPRESENTATIVE DETAILS, IF REQUIRED BEFORE ACTIVE EU TARGETING]

[UK REPRESENTATIVE DETAILS, IF REQUIRED FOLLOWING TERRITORIAL-SCOPE ASSESSMENT]