Privacy Policy

Draft — not reviewed by counsel. Items marked [TBD-counsel] are still under legal review and may change.

Version 0.3 (draft) · Last updated: 2026-11-07 · Effective: when published (see section 15 for what changed)

This Privacy Policy explains what personal information Kairu collects, why we collect it, who we share it with, and the choices and rights you have. It applies to www.kairuhq.com, the free online book, the waitlist, the HERON Check, the Kairu mobile apps for iPhone and Android (the "app") and the Kairu Pro subscription (together, the "Service").

Kairu is operated by Ringle, Inc., 400 Concar Dr, San Mateo, CA 94402 ("Kairu", "we", "us"). Some team members who support Kairu work in South Korea (see section 10). Kairu is built for people in the United States, and this policy is written for U.S. law, starting with the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA").

SummaryCopy Anchor Link

• We collect only what we need to run the Service: your email if you join the waitlist or create an account, how you sign in, basic site analytics, and — if you take a HERON Check — your voice recording (up to 90 seconds), its transcript and your results. In the app, we also collect a notification token if you turn on notifications, and records of your Kairu Pro subscription if you buy one.
• We do not sell your personal information. We do not share it for targeted (cross-context behavioral) advertising.
• We do not create voiceprints or any other biometric identifier from your voice. We never guess your culture, ethnicity or background from your voice, name or accent.
• Your recording is turned into text on our own servers and deleted as soon as your results are ready. Only the text (not the audio) is sent to our AI provider to score your answer and write feedback.
• We record your voice only after you agree, each time, at the moment you record.
• We use your recording or transcript for research or as a published example only if you separately opt in.
• Payments for Kairu Pro are handled by Apple or Google. We never receive your card number or billing address.
• The app has no advertising, no third-party analytics and no tracking.
• You can ask us to show you, correct or delete your information at any time, and you can delete your account inside the app.

1. Information we collectCopy Anchor Link

1.1 Information you give usCopy Anchor Link

Waitlist. If you join the waitlist for the HERON Check, we collect your email address. You may also choose to tell us your role (for example, software engineer or manager), your career level, and the work culture you first learned to communicate in (see section 4 about this optional question). These extra fields are optional. You pick them from a list; we do not guess them.

Account. If you create an account, we collect your email address, how you sign in, the devices you are signed in on, and your confirmation that you are 18 or older (with the version of our Terms and this policy you accepted). How you sign in can be:

• a passkey — your fingerprint, face or device PIN never leaves your device. We store only a public key, a device-type label (for example, "iPhone") and when it was last used. This is not biometric information;
• a one-time code sent to your email; or
• Google sign-in, if you choose it — we receive only your Google account ID and email address, not your name or photo.

In the app, you sign in with a one-time code sent to your email.

HERON Check. If you take a HERON Check, we collect:

• Your voice recording — up to 90 seconds of audio of you answering a work question.
• The transcript — the text of what you said, made from your recording.
• Your results — your scores for the five HERON moves (Headline, Enter, Reason, Own, Next), the one move we suggest you focus on, and a Before/After rewrite of one of your own sentences.
• Information you choose to say. Please do not include confidential work information or sensitive personal details (for example, health or financial information) in your answer. Whatever you say will be in the recording and transcript.

Kairu Pro subscription. If you buy Kairu Pro in the app, you pay Apple (App Store) or Google (Google Play), not us. Apple or Google tells us about the purchase so we can turn on Kairu Pro for your account. We receive and keep: the product you bought, the store, purchase and transaction identifiers, a random account token that links the purchase to your Kairu account, the dates the subscription started, renews, ends, is canceled or refunded, its status (for example, active or in a billing retry), whether it was a test (sandbox) purchase, and the country, currency and price the store reports. We also keep a record that you agreed to the automatic-renewal terms (when, which terms version, the price shown to you, and on which device type). We do not receive your card number, billing address or Apple or Google password.

Reports about feedback. If you use "Report this feedback" in the app, we receive the reason you choose, any note you add (stored encrypted) and the ID of the check it is about.

Messages to us. If you write to us through our contact form or by email to privacy@kairuhq.com or support@kairuhq.com, we keep your email address and what you write so we can reply. Messages are stored, encrypted, on our servers at Amazon Web Services. Email to privacy@kairuhq.com is answered automatically. By default no person reads it; a request that cannot be handled automatically may be forwarded to our team.

1.2 Information collected automaticallyCopy Anchor Link

Analytics. We use Google Analytics 4 to understand how people use the site: pages viewed, how far you scroll, which buttons and links you click (for example, "Join the waitlist"), the page or campaign that brought you here (including UTM tags in links from our videos), and general device and browser information. Google Analytics sets cookies to tell visits apart. See section 7 for how we set it up and how to turn it off.

Server and security logs. When your browser loads a page, our hosting and security systems (Amazon Web Services, including CloudFront and AWS WAF) may record your IP address, browser type, the page requested, and the time. Our servers' logs and error reports are also sent to our monitoring provider (Datadog). We use these logs to keep the site running and to stop abuse.

Sign-in security records. If you have an account, we record sign-in events (for example, a successful sign-in, a wrong code or a new passkey) with a one-way hash of your IP address and a browser and operating-system label, so we can show you where you are signed in and stop account takeover.

Browser storage. The site may store small settings in your browser, such as light or dark mode. These stay on your device.

The app. When you use the app, it sends us:

• Device push token — only if you allow notifications: a notification token from Google Firebase Cloud Messaging (and, on iPhone, Apple's push service), with the platform (iOS or Android) and the app version, so we can send you the notifications you chose. Notifications contain only a short message and a link inside the app — never your transcript, scores or email address.
• A log of notifications we send — which kind of notification, when, and whether it was delivered (no message text).
• Basic device and app details sent with every request — the platform (iOS or Android), the app version and the standard technical header your phone's network software adds — which land in the server logs described above. The platform also labels your signed-in session (for example, "Kairu app on iOS").

The app does not include advertising tools, third-party analytics or crash-reporting tools, does not use your device's advertising ID (IDFA or Android advertising ID) and does not track you across other companies' apps or websites. It uses the microphone only while you record a HERON Check, after you allow it. If we add app diagnostics or analytics later, we will update this policy first and tell you in the app.

1.3 Information we do not collectCopy Anchor Link

• We do not ask for your name, phone number, home address or government ID. We do not receive or store payment card details — Apple and Google handle payment for Kairu Pro.
• We do not create voiceprints, face data or any other biometric identifier.
• We do not collect precise location.
• We do not knowingly collect information from children (see section 11).

2. How we use your informationCopy Anchor Link

How the HERON Check is scored. Your recording is turned into text on Kairu's own servers (Amazon Web Services, U.S. East region) by an open-source speech-recognition system. A computer program then measures timing features, and the transcript is sent to Anthropic's Claude AI model, which helps score your answer and write your feedback. The feedback is generated automatically. It is about the sentences you said, not about you as a person, and it is not used to make any legal or employment decision about you.

What we do not do.

• We do not score or correct your accent.
• We do not infer your culture, ethnicity, national origin or background from your voice, name or accent.
• We do not use your recording, transcript or results to train AI models, for research, or as an example in our marketing, books or videos unless you separately opt in (see section 5).

3. Your voice recordingCopy Anchor Link

• Consent first. We start recording only after you agree on the recording screen. We ask each time you record. In the app, your phone also asks once for microphone permission, and the app uses the microphone only while you are recording — never in the background.
• No biometrics. We use your recording only to make a transcript and measure timing (for example, words per minute and pauses). We do not create a voiceprint, and we do not use your voice to identify you or to tell you apart from other people. Your recording is therefore not used as "biometric information" or a "biometric identifier" under laws such as the CCPA, the Illinois Biometric Information Privacy Act or the Texas biometric privacy law. [TBD-counsel]
• Audio stays with us. The audio file is processed on our own servers. We do not send the audio to Anthropic or Google.
• Deleted right away. We delete the audio file as soon as your results are ready. If processing fails, we delete it within 24 hours. We keep audio longer only if you opt in to research (section 5). See section 9.

4. The optional work-culture questionCopy Anchor Link

The waitlist may ask which work culture you first learned to communicate in — for example, an East Asian workplace, a South Asian workplace, or a U.S. workplace. We ask because different workplace cultures build different habits, so people often find different HERON moves hardest at first. Your answer helps us choose which examples to show you first and, when two moves score the same, which one to suggest as your focus move. It is a starting point, not a label.

Some answers to this question could reveal national or ethnic origin, which some state laws treat as sensitive personal information. For that reason:

• the question is optional, and we explain why we ask it on the form. "Prefer not to say" is always an option, and choosing an answer is your consent to use it as described here;
• we use your answer only to choose your first examples, to break a tie when choosing your focus move, and to count, in totals, which content helps which groups;
• your answer never changes your HERON Check scores (the five move scores), and we never use it to make decisions about you, for advertising, or to infer anything else about you;
• we never guess it from your voice, name or accent;
• you can change or remove it at any time.

[TBD-counsel] Confirm that this form of consent meets the opt-in requirements of Virginia, Colorado, Connecticut, Texas, Oregon and similar laws.

5. Separate opt-insCopy Anchor Link

We ask separately — and you can say no without losing access to the HERON Check — before we:

• use your recording or transcript to improve and test our scoring (research and calibration); and
• use your answer as a case story (for example, a Before/After example in our book, videos or lessons). We would remove your name and details that identify you, and you can withdraw before publication.

You can withdraw an opt-in at any time by emailing us. Withdrawing stops future use; it cannot undo a publication that already happened.

6. Who we share information withCopy Anchor Link

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose personal information only to:

Payments: Apple and Google. When you buy Kairu Pro, you buy through Apple's App Store or Google Play using your Apple Account or Google Account. Apple or Google takes the payment, handles billing, renewals, cancellations and refunds, and sends us the purchase records listed in section 1.1 so we can provide Kairu Pro. Apple and Google handle your payment information under their own terms and privacy policies (apple.com/legal/privacy and policies.google.com/privacy). We do not send them your recordings, transcripts or results. If Apple asks us for information about a refund request, we answer only if you agreed to it in that request. [TBD-counsel: confirm whether Apple and Google are described as service providers or as separate businesses for CCPA purposes when they act as merchant of record]

These companies act as our service providers (also called processors). Our contracts limit them to using your information to provide services to us. Anthropic's commercial terms state that it does not train its models on data sent through its API [TBD-counsel: confirm against the signed agreement and Anthropic's data-retention terms].

We may also disclose information:

• inside our corporate group (Ringle, including affiliates in South Korea) to people who help run Kairu, under the same rules as this policy [TBD-counsel] — see section 10;
• when the law requires it, for example in response to a valid court order;
• to protect the safety, rights or property of our users, the public or Kairu;
• in a business transfer, such as a merger or sale of Kairu, in which case this policy continues to apply to your information.

7. Cookies, analytics and your choicesCopy Anchor Link

We set up Google Analytics 4 for measurement only:

• Google Signals and ad personalization are turned off, and Analytics is not linked to Google Ads or other advertising products;
• we keep event-level and user-level Analytics data for 2 months, the shortest setting Google Analytics offers (Google keeps only aggregated, non-identifying reports after that);
• we do not use advertising pixels (for example, Meta or TikTok pixels), and our emails do not contain open-tracking pixels or click-tracking links.

Because we do not use analytics data for targeted advertising, we do not consider it a "sale" or "sharing" under the CCPA [TBD-counsel].

Global Privacy Control (GPC). If your browser sends a GPC signal, we treat it as a request to opt out of sale and sharing for that browser, and we do not load Google Analytics.

Do Not Track. There is no common standard for "Do Not Track" signals, so we do not respond to them differently. We honor GPC as described above.

Other choices. You can block or delete cookies in your browser settings, or install the Google Analytics opt-out browser add-on (tools.google.com/dlpage/gaoptout).

In the app. The app does not use cookies, analytics or advertising tools, so there is nothing to opt out of. You can turn notifications on or off at any time in your phone's settings (the app's Settings screen links there), and you can turn off microphone access in your phone's settings (you will not be able to record a HERON Check without it).

8. SecurityCopy Anchor Link

We protect your information with reasonable safeguards: encryption in transit (HTTPS), access limited to people who need it, and storage in AWS in the U.S. No system is perfectly secure, so we cannot promise that information will never be accessed without permission. If a data breach affects you, we will notify you as the law requires.

9. How long we keep informationCopy Anchor Link

We may keep information longer when the law requires it or to resolve a dispute. We may keep de-identified or totaled (aggregate) information that cannot reasonably be linked to you. We will not try to re-identify it.

10. Where your information is processedCopy Anchor Link

We store and process Service data in the United States (AWS, U.S. East region). Kairu is operated by Ringle, Inc., a U.S. company, and some members of the team that builds and supports Kairu may work from South Korea. They may access personal information from there to operate the Service, under the safeguards in this policy. [TBD-counsel: operator entity, cross-border access and any transfer terms]

11. ChildrenCopy Anchor Link

The Service is for adults. It is not directed to anyone under 18, and you must be 18 or older to join the waitlist or take a HERON Check. We do not knowingly collect personal information from children under 13 (as defined by the Children's Online Privacy Protection Act) or sell or share information of anyone under 16. If you believe a child has given us information, contact us and we will delete it.

12. Your privacy rightsCopy Anchor Link

12.1 Rights for everyoneCopy Anchor Link

Wherever you live, you can ask us to:

• tell you what personal information we have about you and give you a copy;
• correct it;
• delete it;
• stop sending you emails (use the unsubscribe link in any email, or the request form below).

12.2 California residents (CCPA)Copy Anchor Link

If you live in California, you have the right to:

• Know — what personal information we collected about you, the categories of sources, the purposes, and the categories of recipients, and to get a copy of the specific information;
• Delete — the personal information we collected from you, with some legal exceptions;
• Correct — inaccurate personal information;
• Opt out of sale or sharing — we do not sell or share personal information, but you may still send a request or use GPC;
• Limit the use of sensitive personal information — we use sensitive personal information (if any, see section 4) only for purposes allowed without this right, so we do not offer a separate "Limit" link [TBD-counsel];
• Non-discrimination — we will not deny you service, charge you a different price or give you a lower-quality service because you used your rights.

Notice of financial incentive. We do not offer financial incentives in exchange for personal information. [TBD-counsel: confirm that a free first HERON Check offered to waitlist members is not a "financial incentive"]

12.3 Residents of other statesCopy Anchor Link

Residents of states with comprehensive privacy laws — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island — may have similar rights: to confirm whether we process their data, to access, correct, delete and get a portable copy of it, and to opt out of targeted advertising, sale and profiling that produces legal or similarly significant effects. We do not do targeted advertising, sell personal data, or use profiling for decisions with legal or similarly significant effects. We honor these rights for all U.S. users, whether or not your state's law applies to us.

Appeals. If we deny your request, you may appeal using the request form (choose "Appeal a decision" and enter the request ID from our decision email). We will answer within the time required by your state's law (usually 45 or 60 days). If you are not satisfied, you may contact your state's Attorney General.

12.4 How to make a requestCopy Anchor Link

• Online form (fastest): kairuhq.com/privacy/request. Most requests are completed automatically within minutes after you confirm your email.
• Or email privacy@kairuhq.com. We automatically reply with a link to the same form, filled in for your email address. (We do not reply to messages that look like spam, fail email authentication checks, or were sent automatically.) This is our only address for privacy requests. Besides it, only support@kairuhq.com accepts mail (see section 16); mail to other addresses at kairuhq.com is not accepted.
• In your account. If you have an account, you can download or delete your data yourself in Account settings after you confirm it's you with your passkey or an email code. That counts as a verified request.
• In the app. Go to Settings → Delete account and confirm with an email code. This deletes your account and its data (recordings, transcripts, results, history, push tokens and reports about feedback) as described in this section and section 9. Deleting your account does not cancel a Kairu Pro subscription — only you can cancel it, in your App Store or Google Play subscription settings. The app reminds you and links there before you delete.
• Verification. To protect you, we send a link and a code to the email address the request is about. Confirming it verifies the request. We do not ask for any other information. If you do not confirm within 14 days, we close the request and tell you how to start again.
• What happens next. Requests are carried out automatically: for a copy of your data, we email a download link that works once and expires after 7 days; for deletion, we delete your information from our systems and stop all emails to you; for correction, we update the details you chose. We email you the result and the reason for any part we could not do.
• Authorized agents. An authorized agent can submit the form for you. We will then email you directly at the address we have on file, and the request goes ahead only after you confirm it.
• Timing. We confirm receipt right away and respond within 45 days at most. If we ever need more time (up to 45 more days), we will tell you why.
• Cost. Requests are free. We may decline or charge a reasonable fee for requests that are clearly unfounded or excessive, as the law allows.

13. Notice at CollectionCopy Anchor Link

This section is our CCPA "Notice at Collection". It applies at the waitlist form, the account sign-up screen (on the web and in the app), the HERON Check recording screen and the Kairu Pro purchase screen, which link here.

We collect this information for the purposes in section 2 and disclose it only as described in section 6.

14. Personal information we collected in the last 12 monthsCopy Anchor Link

As of the date of this policy, the waitlist, the HERON Check, accounts, the app, Kairu Pro and Google Analytics have not started collecting information from the public, so in the last 12 months we have collected only server and security logs (identifiers such as IP address, and internet activity) through our hosting and monitoring providers, for the purposes in section 2. We did not sell or share any personal information. We will update this section as these features launch.

15. Changes to this policyCopy Anchor Link

We will post any change on this page and update the "Last updated" date. If a change is material — for example, a new use of your recording — we will tell you by email, on the site or in the app before it takes effect, and we will ask for your consent where the law requires it.

Change logCopy Anchor Link

• Version 0.3 (2026-11-07, draft). Added the Kairu mobile apps and the Kairu Pro subscription: device push tokens and the notification log (section 1.2), Kairu Pro purchase records from Apple and Google and the record of your agreement to automatic renewal (section 1.1), reports about AI feedback, Apple and Google as the companies that take payment and Firebase Cloud Messaging and Apple's push service as notification providers (section 6), app choices (section 7), retention for these records (section 9), deleting your account in the app (section 12.4), and support@kairuhq.com as an email address that auto-replies with the contact form (sections 1.1 and 16). The HERON Check recording limit is now up to 90 seconds.
• Version 0.2 (2026-11-06, draft). First published version.

16. Contact usCopy Anchor Link

Privacy requests: kairuhq.com/privacy/request, or email privacy@kairuhq.com

All other questions: kairuhq.com/contact

Email: support@kairuhq.com (listed because app stores require a public email address). Mail to this address is answered automatically with a link to the contact form, which is the fastest way to reach us.

Ringle, Inc., 400 Concar Dr, San Mateo, CA 94402