Privacy Policy

3. Information We Process

We process information continuously through the operation of our Services and Website and through other interactions with our Business. If you provide us with information about another individual, you represent that you have the authority to do so and have given any required notices and obtained any necessary consents.

A. Information You Provide

We receive information when you submit it to us:

• Contact Information, including first name, last name, email address, phone number, employer, job title, and address.
• Account Information, including the credentials you create or use to log into the Services, profile preferences, and information about your role within your organization.
• Communications, including when you contact sales or support, ask a question, provide product feedback, respond to a survey, or correspond with our team.
• Customer Data, meaning all data, information, and materials a Customer provides, uploads, or submits to the Services. Customer Data may include documentation, files, transactions, vendor records, contracts, draws, pay applications, invoices, schedules of values, ledgers, and other materials that contain information about you, your colleagues, your vendors, or your customers.
• Third Party Information, including information you provide about coworkers, contractors, vendors, or referrals, such as their contact details.
• Job Applicant Data, including employment history, education, work samples, references, and other information you submit when applying for a role at Kosai.

Restricted categories of data. Under our Customer agreements, Customers shall ensure that Customer Data does not contain any of the following categories of sensitive data unless expressly required for use of the Services: (a) Social Security number, passport number, driver's license number, or similar identifier (or any portion thereof); (b) credit or debit card number (other than the truncated last four digits), financial information, banking account numbers or passwords; (c) employment, financial, genetic, biometric or health information; (d) racial, ethnic, political or religious affiliation, trade union membership, or information about sexual life or sexual orientation; (e) account passwords, mother's maiden name, or date of birth; (f) criminal history; (g) any other information or combinations of information that falls within the definition of "special categories of data," "sensitive data," or "sensitive personal information" under any applicable privacy or data protection law; or (h) personal information of children under the age of 16. Customers are solely responsible for ensuring Customer Data complies with this restriction.

B. Information Generated and Collected by Kosai

We generate, collect, and derive information when you use the Services, the Website, and other parts of our Business:

• Usage Data, including pages visited, features used, workflows constructed, time spent, login events, agent runs, prompts and instructions issued to our agents, the outputs returned, third party services connected, your preferences, and crash and error data.
• Device Data, including the type of device or browser you use, operating system and settings, internet service provider, IP address, and device identifiers.
• Location Data, including approximate geolocation derived from your IP address or business address.
• Session Data, including session replays, screen recordings, and event logs of how you interact with the Services. We use this to debug issues, improve product quality, and review the work performed by our virtual employees on a Customer's behalf.

We use cookies, pixels, log files, software development kits, and similar technologies to collect this information. You can limit some of this collection by changing your browser settings, but doing so may affect the features available to you.

C. Information from Other Sources

We also receive information from other sources:

• Customers and their personnel, who provide information about you when you are added to their Kosai workspace, invited as an authorized user, or named in their content.
• Connected third party services, including data sources that you or your Customer authorize us to access, such as accounting systems, ERPs, bank or treasury systems, document repositories, identity providers, communication platforms, and project management tools.
• Service providers, including identity verification, fraud prevention, marketing analytics, and security vendors that support our Business.
• Public sources, including company websites, public filings, business registries, and professional networking sites that help us identify prospective customers and conduct due diligence.
• Marketing and referral partners, including partners that refer leads to us or run joint marketing activities.

4. How We Use Information

We use information for the following business purposes:

• Providing and operating the Services, Website, and Business, including authenticating users, executing the workflows requested by Customers, integrating with connected systems, and analyzing usage to keep the Services reliable and performant.
• Communicating with you, including sending notices, updates, security alerts, billing and account messages, and information about changes to this Policy or our terms.
• Customer support, including responding to your questions, troubleshooting issues, and improving the support experience.
• Security and fraud prevention, including verifying accounts, detecting and preventing fraudulent activity, investigating suspicious behavior, and protecting the safety and security of the Services and our Customers.
• Analyzing and improving the Services on an internal basis, including analyzing how features are used, identifying defects, evaluating model and agent performance, and developing new capabilities. Under our Customer agreements, Kosai may use Customer Data on an internal basis to analyze and improve the Services.
• Legal, regulatory, and contractual obligations, including maintaining records to demonstrate compliance with applicable law, responding to lawful requests, and enforcing our agreements and rights.
• Marketing and advertising, including sending you information about our products, events, offers, and content you may find relevant, and running targeted advertising on third party platforms. We do not use Customer Data for marketing or advertising.
• Auditing and research, including internal reporting, audits, surveys, and analytics.
• Generating and using Anonymized Data, as described in Section 5.
• At your direction or with your consent, for any other purpose disclosed to you.

5. AI Models, Customer Data, and Anonymized Data

Kosai delivers a virtual finance employee that uses large language models, retrieval systems, and other machine learning techniques.

• Customer Data ownership. As between Kosai and a Customer, the Customer retains all right, title, and interest in and to Customer Data, including all intellectual property rights in it. Customer Data is treated as the Customer's confidential information under our Customer agreements.
• Permitted use of Customer Data. Under our Customer agreements, Kosai may use Customer Data to provide the Services to that Customer and, on an internal basis, to analyze and improve the Services. Individual Order Forms may impose additional restrictions on specific uses.
• Anonymized Data. "Anonymized Data" means logs, metadata, statistics, and other data that are anonymized or aggregated such that they are not identifiable with Customer, its customers, or any natural person. Anonymized Data does not constitute or include Customer Data. Kosai owns all right, title, and interest in and to Anonymized Data, including all intellectual property rights in it, and may freely use and disclose Anonymized Data to analyze and improve the Services and for other lawful business purposes.
• Public and licensed data. Our foundation models may be trained or fine-tuned on publicly available data and on data we license from third party providers.
• Subcontractors and model providers. Kosai may use subcontractors in delivering the Services, including third party model providers. Kosai remains responsible for our subcontractors as set forth in our Customer agreements.

6. How We Disclose Information

We disclose information to the following categories of recipients. Disclosures of Customer Data are governed by the confidentiality terms of our Customer agreements.

• Service providers and subcontractors, including cloud infrastructure, hosting, analytics, observability, payment processing, customer support, and collaboration tools that process information on our behalf and under written agreements. Kosai remains responsible for its subcontractors as set forth in our Customer agreements.
• Affiliates and related entities of Kosai.
• Customers, when we process information on a Customer's behalf or when the information relates to a Customer's use of the Services. For example, your activity in a Customer's workspace may be visible to other authorized users in that workspace, including the Customer's administrators.
• Connected third party services, when you or your Customer instruct us to connect those services to the Services.
• Identity verification, fraud, and compliance providers, where reasonably necessary to operate the Business.
• Marketing, advertising, and analytics partners, for the purposes described in Section 4 and Section 7. Customer Data is not disclosed to marketing or advertising partners.
• Mergers and acquisitions, in connection with, or during negotiations of, any actual or proposed merger, sale, financing, or other corporate transaction.
• Security, legal process, and compelled disclosure, including to comply with the law, regulations, legal process, or enforceable governmental requests, to investigate suspicious or fraudulent activity, and to protect the rights, property, life, health, security, and safety of Kosai, our Customers, or others.
• At your request or direction, including to recipients you ask us to share information with.
• With your consent or with notice to you, for any other purpose disclosed to you at the time of collection.

We may also disclose Anonymized Data for any lawful purpose.

7. Analytics and Interest Based Advertising

We use analytics services, such as Google Analytics, to understand how visitors and users interact with our Website and Services. We also work with advertising partners to place ads on our behalf on third party platforms, including LinkedIn, Google, and Meta. These partners use tracking technologies to deliver ads that are more likely to be relevant to you. You can opt out of certain interest based advertising through industry programs such as the Digital Advertising Alliance and the Network Advertising Initiative, or by enabling Global Privacy Control on your browser.

8. Data Transfer

We operate from the United States and may transfer, process, store, and handle information in the United States and other jurisdictions. Data protection laws in those jurisdictions may differ from those in your country of residence. We take measures to comply with applicable data protection laws when we transfer Personal Information internationally, including, for personal data transferred from the EEA, Switzerland, or the United Kingdom, by using standard contractual clauses or other recognized transfer mechanisms.

9. Security

We use organizational, technical, and administrative measures designed to protect Personal Information from loss, theft, misuse, and unauthorized access, disclosure, alteration, and destruction, applying at least a commercially reasonable standard of care. No security program is perfect, and no transmission over the internet can be guaranteed to be fully secure. If you believe an account or content has been compromised, contact us at security@kos.ai.

10. Retention

We retain Personal Information for as long as we have a business or operational need to do so, and as necessary to comply with our legal and regulatory obligations, resolve disputes, prevent fraud, and enforce our rights and agreements. Our retention obligations may require us to retain information after you stop using the Services or after a Customer's account is closed. When the applicable retention period ends, we delete or de-identify the information in accordance with our policies. Treatment of Customer Data at termination is governed by the applicable Customer agreement.

11. Children

Our Services are not directed to children. We do not knowingly collect personal information from children under the age of 16. If you believe a child has provided us with personal information, contact us and we will take appropriate steps to delete it.

12. Changes to this Policy

We may update this Policy from time to time. When we do, we will post the updated version and revise the "Last updated" date at the top. If the changes are material, we will provide additional notice as required by law. Your continued use of the Services after an update means you accept the updated Policy.

13. Your Rights and Choices

Depending on where you live, you may have rights regarding your Personal Information, including the right to access, correct, delete, or port your information, and the right to opt out of certain processing. You can exercise these rights by contacting us at privacy@kos.ai. We may need to verify your identity before responding.

If we process your Personal Information on behalf of a Customer, your request should be directed to that Customer. If you submit a request to us, we may refer it to the Customer and assist them in responding.

Cookies. Most browsers accept cookies by default. You can change your browser settings to refuse or delete cookies, but some features of the Services may not work properly if you do.

Email and SMS. You can opt out of marketing emails by clicking the unsubscribe link in any marketing message we send. You can opt out of marketing SMS by replying STOP. You cannot opt out of transactional and service messages relating to your account or use of the Services.

14. Additional Disclosures for California Residents

This section applies to California residents and supplements the rest of this Policy.

Categories collected. In the past twelve months, we have collected the following categories of personal information as defined by the California Consumer Privacy Act, as amended (the "CCPA"): identifiers; customer records; commercial information; internet or network activity; geolocation; professional or employment related information; education information; inferences; and audio, electronic, or visual information (such as session recordings of the Services).

Sources, purposes, and recipients. We collect personal information from the sources, for the purposes, and disclose it to the recipients described in Sections 3, 4, and 6 above.

Rights. California residents have the right to know, correct, delete, and opt out of the sale or sharing of personal information, and the right not to receive discriminatory treatment for exercising these rights. To exercise your rights, contact us at privacy@kos.ai. We may require information to verify your identity.

Do Not Sell or Share. We do not sell personal information for money. Some of our marketing practices, such as using cookies and pixels to support cross context behavioral advertising, may be considered "sharing" or "selling" under the CCPA. You can opt out by emailing privacy@kos.ai or by enabling Global Privacy Control on your browser.

Authorized agents. You may use an authorized agent to submit a request on your behalf. We may require signed proof of the agent's authority and may verify your identity directly.

Shine the Light. California residents may request information about our disclosures, if any, of personal information to third parties for those third parties' own direct marketing purposes. Send requests to privacy@kos.ai.

15. Additional Disclosures for Other U.S. State Residents

Residents of certain other U.S. states, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Tennessee, and Delaware, may have rights similar to those described above under their respective state privacy laws, including the right to access, correct, delete, and port personal information, and to opt out of targeted advertising, sale of personal information, and certain types of profiling. To exercise your rights, contact us at privacy@kos.ai. You may appeal a decision we make about a rights request by replying to our response.

Nevada residents may submit a request directing us not to sell certain personal information. We do not sell personal information as defined by Nevada law, but you may still submit a request to privacy@kos.ai.

16. Additional Disclosures for Data Subjects in the EEA, Switzerland, and the United Kingdom

Roles. Kosai may act as a processor when processing personal data on behalf of a Customer under our agreement with that Customer. We act as a controller when we determine the purposes and means of processing personal data for our own business operations, such as managing our Website, marketing, and corporate functions.

Lawful basis. We rely on the following lawful bases to process personal data: your consent; the performance of a contract with you or your organization; compliance with a legal obligation; and our legitimate interests in operating, securing, and improving our Business, where those interests are not overridden by your fundamental rights.

Your rights. Subject to applicable law, you may have the right to access, correct, delete, restrict, or object to our processing of your personal data, and the right to data portability. Where we rely on consent, you may withdraw it at any time. You also have the right to lodge a complaint with the data protection regulator in your jurisdiction.

International transfers. We may transfer your personal data to the United States or other countries that may not provide the same level of protection. Where required, we rely on adequacy decisions or standard contractual clauses, supplemented by additional safeguards as needed.

To exercise your rights, contact us at privacy@kos.ai. If we process your personal data on behalf of a Customer, your request should be directed to that Customer.

17. Contact Us

If you have questions about this Policy or our privacy practices, contact us:

By email: privacy@kos.ai

By mail: Kosai, Inc., Pier 5, Ste 101, The Embarcadero, San Francisco, California, 94111, United States

If you have a disability and need this Policy in an accessible format, contact us at privacy@kos.ai and we will provide it.