Kairos One PMIS Privacy Policy

Last updated September 9, 2026. Customer-specific schedules and signatures are completed where required. Existing executed agreements remain controlling.

This Privacy Policy explains how KAIROS ONE, INC. ("Kairos") collects, uses, protects, retains, and shares information in connection with the Kairos One PMIS platform ("Service"). Kairos generally acts as a service provider/processor handling information on behalf of its customer organizations, under their instructions and the applicable agreement. It is designed to align with the safeguards and breach-notification expectations of laws such as the New York SHIELD Act and the New Jersey data-breach statute (N.J.S.A. 56:8-161 et seq.).

1. Information We Collect

Account information: name, business email address, role, organization/company, authentication activity, and login metadata including IP address and timestamps used for security and audit purposes.

Project information submitted to the Service: schedules, documents, reports, action items, comments, attachments, approvals, and audit history.

Demo and contact information: name, work email, company, message, appointment selection, and related scheduling metadata that you choose to submit through the public site, the Kairos request form, or Calendly.

Limited technical/usage information needed to operate and secure the Service. The application also keeps authentication state, preferences, saved views, and user-requested local drafts in the browser as described in the Cookie & Storage Notice. Kairos does not intentionally collect Social Security numbers, payment-card data, or special categories of personal information through the Service.

When Live transactional email is enabled, Kairos records operational delivery metadata such as recipient address, subject line, provider identifiers, sending source, timestamps, and sent, delivered, delayed, failed, bounced, complaint, and suppression events. When provider engagement tracking is enabled, the ledger may also record that a message was opened or that a link was clicked, but it does not store the clicked URL. This supports auditability, troubleshooting, and prevention of repeated sends to rejected or complaining addresses. The delivery-history ledger does not copy message bodies, attachments, authentication codes, reset links, provider credentials, or raw webhook bodies.

2. How We Use Information

To provide secure access, operate platform features and dashboards, generate schedule and portfolio insights, maintain records and audit trails, and support customer operations.

To respond to inquiries and arrange requested demonstrations. When you choose Calendly scheduling, Calendly processes the information needed to provide that scheduling service; when you choose the Kairos request form, its contents are delivered to Kairos through the configured transactional-email provider.

To protect the Service — detecting, investigating, and preventing unauthorized access, fraud, and abuse — and to meet legal and contractual obligations. Aggregated or de-identified data may be used to monitor and improve reliability.

AI and automated processing: As of September 9, 2026, Kairos uses OpenAI's business API for authorized internal evaluation with internal or synthetic data in its own workspace, under an authorization that expires on December 31, 2026. This does not authorize processing customer data. AI remains disabled by default for customer workspaces. Customer activation requires documented authority over the affected customer's data, approved account/models/features, location, retention and agreement terms. Inputs may include the user's request, relevant authorized records, page context and selected uploaded-document excerpts. Output requires human review and does not authorize a change to project records.

By default, Kairos does not use Customer Data, prompts, excerpts or Generated Output for model training, fine-tuning or provider improvement programs. A future exception requires the separate written agreement, lawful authority and validated controls in DPA Section 5.2, including any required individual notices or permissions. Ordinary use of the Service or inference approval is insufficient, and the current release does not enable training. The DPA describes the provider-processing schedule; a storage setting is not a promise of zero retention. Kairos also retains bounded Copilot questions/answers, which may contain personal information, plus audit metadata and any saved outputs. The customer retention/hold schedule must cover those records and provider copies. See the Responsible AI Statement for the feature limits and approval process.

3. Sharing and Disclosure

Kairos does not sell personal information or Customer Data. Information is accessible to authorized users in accordance with the customer’s configured permissions and project assignments.

Information may be shared with vetted service providers (sub-processors) acting on Kairos’s behalf under contractual confidentiality and security obligations, with customer-approved integrations, or where required by law or legal process. The public scheduling surface uses Calendly. Calendly describes its processing and embedded-cookie roles in its Privacy Notice and Data Processing Addendum.

4. Information Security

Kairos maintains administrative, technical, and physical safeguards designed to protect personal information, consistent with the "reasonable safeguards" standard of the NY SHIELD Act.

Technical safeguards include encryption of data in transit (TLS) and encryption of data at rest (storage-level encryption of the database and file storage via AWS RDS and S3 server-side encryption), role-based access control with least-privilege scoping, authentication controls, audit logging of access and data changes, rate limiting, and secure development and change-management practices. Administrative safeguards include access reviews and assignment of security responsibility.

5. Data Breach Notification

Kairos maintains an incident-response process to detect, assess, and respond to security incidents. In the event of a breach of private information, Kairos will notify the affected customer without unreasonable delay and will cooperate with the customer’s notification obligations to affected individuals and regulators, including those under the NY SHIELD Act and N.J.S.A. 56:8-163, in the most expedient time possible and without unreasonable delay.

6. Data Retention and Deletion

The current record lifecycle archives projects, reviews and documents while preserving their original files, revisions and audit history. Archive removes records from active worklists; it does not erase them. Authorized users can recover records within their existing access scope. Preservation holds prevent changes to held records and protect their relevant parent or linked records.

Retention periods, customer exit exports, disposal authority, legal holds and backup expiration must be documented for each customer before production onboarding. Automated end-of-contract erasure and deletion certification have not been validated. A deletion request requires the records process described in the applicable agreement; the archive action is not evidence that data has been deleted.

Customers and their administrators may request access, correction, deletion, or export of personal information, subject to the applicable agreement and legal retention requirements. Requests can be made using the contact below.

7. Data Location and Sub-processors

The application database and object storage are deployed on Amazon Web Services in the United States. Public-site content uses CloudFront content delivery. Pre-sales scheduling information is processed through Calendly when a visitor chooses that service, and public request-form information is processed through the configured transactional-email provider. Provider processing locations and contractual commitments require separate verification; U.S. application hosting alone does not establish the location of email, AI, support or development processing. A customer's residency requirements must be assessed and agreed before activation. The Sub-processor List distinguishes infrastructure, conditional integrations, active internal OpenAI API evaluation and customer AI processing that requires separate approval.

The proposed customer baseline is U.S. AWS storage for durable platform records and backups, and U.S. AI storage and inference where AI is approved. Provider configuration and any system-data exceptions must be verified and agreed under DPA Section 13 before activation. This proposed requirement is not a claim that every processing path has been validated.

Kairos uses an offshore development team. Offshore access to customer production or support data requires advance written authorization from Kairos and the customer's authorized representative, including owning-agency authority where required. The supplier schedule must identify entities, countries, functions, data scope and access duration. Development work does not itself authorize access. Onshore-only requirements must be supported by access controls and supplier arrangements before the affected service begins.

8. Your Rights and Requests

Depending on applicable law and the customer agreement, individuals may have rights to access, correct, delete, or obtain a copy of their personal information. Because Kairos typically processes information on behalf of a customer, such requests are generally directed to and coordinated with the relevant customer organization.

9. Children’s Privacy

The Service is intended for business and government use and is not directed to children. Kairos does not knowingly collect personal information from children.

10. Changes to This Policy

Kairos may update this Privacy Policy. Material changes will be posted here with an updated effective date and, for active customers, communicated to the customer administrator.

Contact

KAIROS ONE, INC., a Delaware corporation 10 Bayberry Drive, Princeton, NJ 08540, United States Schedule Control Intelligence for capital portfolios Email: legal@kairosonetech.com

Optional public-website measurement

On deployments where first-party measurement is enabled, you may choose “Help improve this website for this visit” in the footer's Website privacy choices. It is off by default. The choice is kept only in memory for this site visit and resets on reload. Browser Do Not Track or Global Privacy Control keeps this optional measurement off.

When chosen, fixed page categories, video identifiers, team categories and actions such as playing a video, opening a demo, or a reported request outcome may be sent to Kairos. These measurement records exclude form content, contact details, raw URLs, referrers and persistent visitor identifiers. No third-party analytics script is used. Normal network and security processing still applies. Turning the choice off stops further optional measurement; it does not erase records already received. Server-log retention follows the deployment's operational retention configuration.

A demo request separately includes the walkthrough topic and video you explicitly selected so the team can prepare for your conversation. This request context is independent of optional measurement and does not subscribe you to marketing.