Kebra Privacy Policy

This policy applies across Kebra's Services and is not limited to a particular application, industry, workflow, or customer. Customer agreements, product notices, consent screens, or integration-specific notices may provide additional information for a particular deployment.

Kebra primarily provides Services to businesses and other organizations. Customers determine how they configure and use their Company Brain and AI Employees, including:

• which systems and data sources they connect;
• which users, service accounts, and AI Employees receive access;
• which information and instructions are made available;
• which workflows and actions are permitted;
• which approval or review steps apply; and
• when an integration or authorization should be changed or removed.

When Kebra processes information at a customer's direction, the customer generally decides why and how that information is used, and Kebra processes it to provide the Services on the customer's behalf. Individuals associated with a customer may need to direct privacy requests to that customer.

Kebra may process limited information for its own business purposes when operating our websites, administering customer relationships, securing and supporting the Services, or responding to legal and privacy requests.

A Company Brain is a customer-specific knowledge and context layer created from information the customer chooses to provide or connect. Depending on the deployment, it may organize documents, policies, procedures, operational records, communications, structured business data, or other authorized sources so approved users and AI Employees can retrieve and use relevant context.

Each customer's information is handled within that customer's authorized service context. Shared technology does not give one customer access to another customer's information.

AI Employees are configurable software agents that can help retrieve information, prepare work, generate content, recommend next steps, or carry out customer-approved actions in connected systems. Their available information and capabilities depend on the systems, accounts, permissions, tools, instructions, and approval rules configured for the customer.

Kebra uses AI models and other service providers to interpret authorized content and complete customer-requested work. Relevant portions of Customer Content may be processed by providers that support functions such as hosting, storage, search, AI generation, transcription, communications, or security. The providers involved may vary by service configuration and customer-approved integration.

AI-generated output can be incomplete or inaccurate and should be reviewed before it is used for consequential decisions. Customers are responsible for deciding where professional judgment, human review, approval, consent, or other safeguards are required for their workflows. Kebra does not treat an AI Employee as having authority beyond the access and instructions made available through the customer's configuration.

Kebra does not sell Customer Content and does not use email, files, or other Customer Content to train or fine-tune generalized AI models. We use Customer Content to provide, secure, support, and improve the customer's configured Kebra service as permitted by the applicable customer agreement and customer instructions.

Depending on how the Services are configured and used, Kebra may process:

• Customer Content: information submitted, uploaded, generated, retrieved, or connected by a customer, such as documents, business records, policies, procedures, messages, notes, jobs, assignments, images, audio, transcripts, prompts, responses, and workflow results;
• Integration Data: information received from or sent to customer-approved systems, including identifiers, records, connection metadata, action requests, and results needed to operate the integration;
• Account and Administration Data: names, business contact details, organization affiliation, roles, user identifiers, subscription information, and customer-support communications;
• Usage and Security Data: IP address, browser or device type, timestamps, authentication and authorization events, request metadata, audit or activity records, diagnostic information, and security signals; and
• Commercial Data: contracts, billing contacts, plan information, vendor-management records, and related business communications.

Customer Content may include information about a customer's personnel, clients, students, contractors, suppliers, or other authorized users. Customers are responsible for determining that they have the authority to provide, connect, record, or direct the processing of that information.

We collect information directly from customers and users; from systems and data sources a customer authorizes; automatically through use of the Services; and from service providers or business partners supporting customer relationships, security, and operations.

We use information as reasonably necessary to:

• provide, configure, maintain, and support the Services;
• build and operate each customer's Company Brain;
• run customer-configured AI Employees, integrations, workflows, and approval steps;
• authenticate users and apply organization, role, system, and capability boundaries;
• retrieve information and generate requested content, transcripts, recommendations, actions, or other results;
• maintain activity records, diagnose errors, monitor performance, prevent abuse, and investigate security events;
• communicate about the Services and respond to support or privacy requests;
• improve service reliability and user experience using information we are permitted to use; and
• comply with law, enforce agreements, and protect Kebra, our customers, users, and others.

Kebra does not use Customer Content for advertising or sell it. Customer Content is used to provide, secure, support, and improve the Services as permitted by the applicable customer agreement and customer instructions.

The Services may process audio, images, documents, or communications when a user submits them, a customer connects them, or an authorized system supplies them. Audio may be transcribed; images may be analyzed or used to extract visible information; documents may be indexed or retrieved as context; and communications may be summarized or used in an approved workflow. Customers and users must have the authority and any consent required to submit, record, connect, or use this content.

We may disclose information:

• to hosting, storage, communications, support, security, AI, transcription, search, analytics, and other service providers that help operate the Services;
• to systems, integrations, AI Employees, users, or recipients selected or authorized by the customer;
• to the customer organization and its authorized administrators, reviewers, or users;
• to professional advisers, auditors, insurers, and transaction counterparties subject to appropriate obligations;
• when required by law or reasonably necessary to protect rights, safety, systems, or the integrity of the Services; or
• as part of a merger, financing, acquisition, reorganization, or sale of all or part of the business, subject to applicable safeguards.

Kebra does not sell personal information or use it for cross-context behavioral advertising.

We retain information for as long as reasonably necessary to provide the Services, follow customer instructions, meet contractual commitments, maintain security and business records, resolve disputes, and comply with law. Retention varies by information type, customer configuration, connected system, contractual requirements, and whether an account, Company Brain, AI Employee, or integration remains active.

Customers may have tools or contractual options to export or delete information and disconnect approved systems. Information may remain temporarily in backups or records preserved for security, legal, fraud-prevention, or compliance purposes until those records expire under applicable procedures. A request may be subject to identity verification, customer authorization, technical limitations, and permitted legal exceptions.

Kebra uses administrative, technical, and organizational measures designed to protect information against unauthorized access, loss, misuse, or alteration. Access to Customer Content is intended to be limited by the customer's organization context and configured permissions. Connections to customer systems are used to perform authorized service functions and should be granted only the access needed for those functions.

No service or transmission method is completely secure. Customers and users are responsible for configuring appropriate access, protecting devices and credentials, reviewing connected systems and permissions, and promptly reporting suspected misuse.

Depending on applicable law and Kebra's role, an individual may have the right to request access to, correction of, deletion of, or a portable copy of personal information, or to object to or restrict certain processing. Individuals may also have the right to appeal a decision or lodge a complaint with an appropriate authority.

We may verify identity and authority before acting on a request. If Kebra processes information on behalf of a customer, we may direct the request to that customer or assist the customer in responding. Kebra will not discriminate against an individual for exercising a privacy right protected by applicable law.

Kebra does not currently sell personal information or share it for cross-context behavioral advertising. If that practice changes, we will provide any notice and choice required by applicable law.

Kebra and its service providers may process information in the United States and other countries where they operate. Those locations may have different data-protection laws. Where required, Kebra uses contractual or other measures intended to support lawful transfers.

The Services are business tools and are not directed to children under 13. If a customer authorizes use in an educational or training setting, the customer is responsible for determining whether additional notices, permissions, or restrictions apply.

We may update this policy as the Services, our practices, or legal requirements change. We will post the updated policy with a revised date and provide additional notice when required.

For privacy questions or requests, email support@kebra.com. Please identify the customer organization connected to your request, if applicable, so we can route it appropriately.