Privacy Policy

1. Who we are

Kairon is a business-to-business tool, run by Kairon, a company registered in the State of Delaware, USA. Our customers are companies that run outreach on LinkedIn from their own LinkedIn accounts.

Questions about this policy, or any request under it, go to admin@heykairon.com. If you need a data processing agreement, write to us and we will put one in place.

2. Three different roles

This policy covers three kinds of people, and our responsibility is different for each.

Operators: the people who use Kairon. Our customers and their teams. For their data we are the controller: we decide what we collect and why.

Prospects: the people our customers reach out to. Our customer decides who to contact and what to say. For that data we are a processor acting on our customer’s instructions. If you are a prospect and want your data removed, write to admin@heykairon.com. We will act, and we will also tell the customer who targeted you so they can act on their side.

Visitors who use our free tools. Our funding radar lets you download the whole list of rounds once you leave your email. For that email we are the controller. We store the address, which tool you used and when, the page that first brought you to the site, the site you came from and the day, and, if you came from an ad, the ad’s click id and campaign tags. We do not store your IP address. To stop floods we count submits for one hour under a one-way code made from it, and then the count is deleted. We use the email to know who uses the tools. We write to you only if you tick the box to get the radar every Monday, and then we also store when you ticked it. To stop those emails, or to be removed, write to admin@heykairon.com. These pages publish companies and the investors each round’s public announcement names. They never publish a person’s LinkedIn profile.

3. What we collect

From operators

• Account identity: name, email address, profile picture, and the organization you belong to. If you sign in with Google, we receive these from Google.
• Billing identity and subscription state.
• If you connect your Google Calendar: the events on your primary calendar, read only, to notice when you book a call with one of your prospects (section 15).
• The credentials that connect your LinkedIn seat. Depending on how you connect, these are either a LinkedIn email and password, or the session cookies of a LinkedIn account already signed in to your browser, handed over by the Kairon Chrome extension (section 14). Either way they are encrypted at the field level and are never shown back to you or to anyone else.
• A country, when you connect a LinkedIn seat. You either choose it yourself, or, if you connect with the Chrome extension, it is derived from your browser’s time zone. It is a country only, never a finer location, and it exists so the connection to LinkedIn appears from the region you actually work in.
• What you write inside the product: ICP definitions, campaign settings, message templates, writing guidelines, and instructions to the agent.
• Product usage: pages viewed, actions taken, errors encountered, and session replays in which form inputs are masked.

From prospects

• Public LinkedIn profile data, read through your own connected seat: name, headline, location, current and past positions, education, skills, follower and connection counts, profile picture, and public post activity.
• The content of LinkedIn conversations between your seat and that person, including what they wrote back.
• Data you upload yourself, for example a CSV of contacts.
• Publicly available web results about the person’s company, gathered during campaign research.
• Business email addresses and mobile phone numbers found by our contact-enrichment provider, when you or a campaign’s email step ask Kairon to find them.

We do not buy contact databases, and we do not sell prospect data.

4. Where prospect data comes from

Kairon has no LinkedIn access of its own. Every read and every message goes through your own LinkedIn account, connected by you. What Kairon can see is exactly what your own account can see. Daily ceilings and sending hours are enforced on our side, so automated use stays within a human pace and an agent cannot raise its own limits.

5. Why we process it, and on what legal basis

For operator data, where we are the controller:

• To perform our contract with you: running the product, your account, your seats, support, and billing.
• Our legitimate interests: keeping the service working and secure (error tracking, logs, traces, profiling), preventing abuse, and improving the product in aggregate.
• Your consent: non-essential cookies and marketing email, each withdrawable at any time.
• Legal obligation: accounting and tax records, and answering lawful requests.

For prospect data we are a processor: we act on our customer’s documented instructions, and the legal basis for contacting that person is the customer’s to establish, not ours. See section 6.

We do not use your data, or your prospects’ data, for advertising.

6. What you are responsible for

If you are a Kairon customer, you decide who gets contacted and what is said to them. That makes you the controller of that data, and it means you are responsible for:

• Having a lawful basis to contact each person, and to process their data, under the rules that apply where they are.
• Telling them what they are entitled to be told, and honouring their rights when they ask you directly.
• The content you send, and complying with LinkedIn’s own terms on the account you connected.
• Anything you upload, including contact lists you did not collect yourself.

When a prospect comes to us instead of to you, we honour the request and tell you it happened, so your own records stay correct.

7. Who we share it with

Only with the service providers below, each processing data on our behalf. This list is maintained in our engineering repository and updated in the same change that introduces a vendor.

Two of these have a chain past them, and you should know about both.

• Unipile reaches LinkedIn through commercial proxy providers, which therefore carry the traffic of your connected seat. We link their policy rather than copying the names here, because the list is theirs to change and a stale copy would be worse than none: unipile.com/privacy-policy. It also states that Unipile does not store account credentials, though it does hold message content and settings for connected accounts until the account is removed, and that it hosts in France.
• Pipecorn, our contact-enrichment provider, finds an address or a mobile number through its own data suppliers, which therefore also process the prospect identifiers we send; we hold no contract with those suppliers and no visibility into which one answers a given search.

Instantly, if you connect your own workspace, is your workspace and your contract, not ours: data held inside it is deleted by you, in Instantly. When we run email sending for you, the workspace is ours, and Instantly processes that data for us.

An AI assistant you connect, such as ChatGPT or Claude, is a recipient you choose, not one of our service providers. If you connect it to Kairon through our connector, it can read your workspace data (your lists, leads and campaigns, and their results) and, when you ask, add people to or remove them from your lists, write and make live your ideal customer profiles, and search for companies. When you ask, it can also start judging the people in a list against your ideal customer profile and find their work emails and mobile numbers. Kairon stores each result on the person like any other result in your workspace: for each check, met, not met or not sure, with a short explanation and links to the public pages the explanation rests on; and each email or mobile number found. The assistant can read those results afterwards. Judging and finding contact details use your workspace balance, and the assistant asks you first. Kairon shares that data with the assistant only when you ask it to, and only under your own sign-in, so it sees what your account can see in your workspace and never another workspace’s data. The campaign tools only read. The assistant can also read your workspace’s stored conversations and the messages in them, including what other people wrote to you, which teammate is responsible for each conversation, and the label Kairon gave a message to show what a reply meant (for example interested or objection). The label belongs to the message; it is not a score of the person. Apart from judging and finding contact details, the connector reads what Kairon has already stored. It does not contact anyone and does not change a conversation. Members of a workspace can already read each other’s conversations in the Kairon web app, and the assistant sees the same conversations your account sees. Once the data reaches the assistant, its provider handles it under its own terms and privacy policy.

We also disclose data when the law requires it, and in a merger or acquisition, in which case this policy keeps applying until it is replaced.

8. International transfers

Our team works remotely, from more than one country, and most of our providers are in the United States. When personal data of people in the European Economic Area or the United Kingdom is transferred outside them, it goes to our providers under the Standard Contractual Clauses they offer, and to us under the Standard Contractual Clauses in the data processing agreement we put in place on request.

9. Language models

• Text is sent to language model providers to draft messages, qualify prospects and classify replies.
• We rely on those providers’ published API terms, under which customer data is excluded from model training by default. We do not enable any setting that would allow training on your data.
• We send only what the task needs. A prompt never carries message histories from unrelated prospects, billing data, or credentials.

10. How long we keep it

Deletion on request. Write to admin@heykairon.com. For a prospect, this removes the profile and the stored conversation. Deleting a record inside the product marks it as removed for operational purposes; that is not erasure, and the request above is what triggers erasure. Erased data ages out of backups within the seven-day window above.

Data inside your own LinkedIn account, and inside your own Instantly workspace, is not ours to delete. You control it there.

11. Your rights

Depending on where you live you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict processing, to withdraw consent, and to complain to your data protection authority (in Argentina, the Agencia de Acceso a la Información Pública; in the European Union, the authority for the country you live in).

If you are in California or another US state with its own privacy law, the same requests apply, including the right to know what we collect and to have it deleted. We do not sell or share personal information for cross-context behavioural advertising.

Write to admin@heykairon.com and we will answer within 30 days. We may ask you to confirm your identity first, and we use that confirmation for nothing else. We do not charge for this, and we will not treat you differently for asking.

12. Security

• Encryption in transit and at rest.
• Credentials and other sensitive fields are additionally encrypted per field.
• Every request is scoped to one organization at the database layer, so one customer’s data cannot be read from another customer’s session.
• Personal data is redacted from logs and traces.
• Privileged actions are written to an append-only audit trail.
• We aim to notify affected customers within 72 hours of confirming a personal data breach.

No system is perfectly secure, and we do not claim otherwise.

13. Cookies

We use a cookie to keep you signed in and one to remember your language; the product does not work without them. Our analytics provider sets its own cookies to measure product usage, and our site records which page you first arrived on so a signup can be credited to it. We do not use advertising cookies inside the product.

14. The Kairon Chrome extension

The Kairon Chrome extension is optional. If you install it, it reads your LinkedIn session cookies (li_at, and li_a when your account has Sales Navigator or Recruiter) from linkedin.com in that browser, together with your browser’s user agent and a country derived from its time zone. It sends these to Kairon so your LinkedIn seat can be connected without you typing a LinkedIn password, and reconnected on its own when LinkedIn ends the session.

The session cookie is stored the way any other LinkedIn credential is: encrypted at the field level, never shown back to you or to anyone else. On your own device the extension stores only a one-way hash of the last session it sent, the time it sent it, and a hash of one that was refused. It never stores the cookie itself.

The extension does not read, change, or interact with LinkedIn pages. It has no content script and cannot see what you browse. It sends data to Kairon and to nowhere else, and only while you are signed in to Kairon in that same browser. Removing the extension stops all of it; disconnecting your LinkedIn seat deletes the stored credential.

15. Your Google Calendar

Connecting your Google Calendar is optional. You connect it from Settings, with the same Google account you sign in to Kairon with, and Google asks you to allow read-only access to your calendar events (calendar.events.readonly). Kairon never creates, changes, or deletes an event, and never reads a calendar other than your primary one.

Every few minutes Kairon reads the events that changed on that calendar. For each new meeting with someone outside your team, it checks whether that person is one of your prospects. When one is, Kairon moves that prospect to “Meeting booked” in your pipeline, stops the campaign still writing to them, and shows the meeting’s title and time on their card. When the meeting is cancelled, the prospect goes back. Meetings that were already on your calendar when you connected are never read. A meeting with nobody who could be one of your prospects is not stored at all. When Kairon had to check a meeting, it keeps its title, time, and outside attendees’ email addresses, so the same meeting is not checked twice.

To decide whether an attendee is one of your prospects, Kairon may send the meeting’s title and its outside attendees’ names and email addresses to a language model (section 9), together with the names of the few prospects it might be. Calendar data is never used to train a model, never used for advertising, and never sold or shared with anyone else.

Google gives Kairon an access token for this, which we store encrypted. Disconnecting from Settings stops Kairon reading your calendar, asks Google to revoke the access, and deletes the token. You can also remove Kairon at any time from your Google account’s security settings.

Kairon’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

16. Children

Kairon is not for anyone under 18, and we do not knowingly collect their data.

17. Changes

We update the date at the top whenever this policy changes. For a change that meaningfully affects your rights, we tell customers by email before it takes effect.

18. Contact

Kairon: admin@heykairon.com