Privacy Policy

1. Introduction

Karloe ("we", "us", "our") operates the Karloe platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

2. Information We Collect

Account Information

When you create an account, we collect your name, email address, and profile information through Supabase authentication. If you sign in with Google OAuth, we receive your Google profile information (name, email, and profile picture).

Payment Information

Payment processing is handled by Stripe. We do not store your credit card details directly. Stripe collects and processes your payment information in accordance with their privacy policy.

Infrastructure Data

When you connect Slack and use Karloe runtimes, we store workspace, Slack installation, and runtime metadata necessary to route requests through Karloe-managed infrastructure.

Slack Data

When your workspace installs the Karloe Slack app, we process the Slack data needed to provide the service: workspace metadata (workspace name, ID, and icon), member metadata (names, display names, and email addresses used for account linking), and the content of conversations where Karloe has been added or where a user directly interacts with Karloe — including channel messages, direct messages, mentions, and files shared in those conversations.

Karloe only reads content from conversations it has been added to or invoked in. Karloe does not expose content from private channels, direct messages, or files to anyone who would not already have access to that content in Slack. Slack bot tokens are stored encrypted at rest using AES-256-GCM with a dedicated application encryption key, and all Slack requests are verified using Slack's request signing.

Usage Data

We collect information about how you interact with the platform, including pages visited, features used, agent configurations, and performance metrics.

3. AI and Large Language Models

Karloe uses third-party large language models (LLMs) to generate responses and perform tasks you request. Conversation content that you send to Karloe (or that Karloe reads from conversations it has been added to) is shared with our LLM providers — currently Anthropic (Claude) and Z.ai (GLM), routed through the Vercel AI Gateway — solely to generate the requested output.

We do not use your Slack data or workspace content to train LLMs, and we do not permit our LLM providers to train their models on it.

AI-generated content may contain errors or inaccuracies. We recommend reviewing important outputs before acting on them.

4. How We Use Your Information

• Provide, maintain, and improve the Karloe platform
• Process transactions and send related information
• Provision and manage Slack-connected runtime access on your behalf
• Send administrative notifications and service updates
• Respond to customer support requests
• Monitor and analyze usage trends to improve user experience

5. Third-Party Services

We use the following third-party services:

• Supabase — Authentication and database hosting
• Google OAuth — Social sign-in
• Stripe — Payment processing
• Slack — Workspace integration and app installation
• Vercel — Web hosting, AI Gateway model routing, and sandboxed code execution
• Amazon Web Services (AWS) — Hosting for the Karloe agent runtime
• Anthropic and Z.ai — LLM providers used to generate responses (see Section 3)
• PostHog — Product analytics and error tracking
• Pipedream — Optional third-party tool connections you explicitly authorize

Each third-party service has its own privacy policy governing their use of your data.

6. Data Security

We implement industry-standard security measures to protect your data, including encryption in transit (TLS), encrypted storage, and access controls. However, no method of electronic transmission or storage is 100% secure.

7. Data Retention

We retain your account data for as long as your account is active. Upon account deletion, we remove your personal data within 30 days, except where retention is required by law or for legitimate business purposes.

Slack conversation content and derived context are retained while your workspace's Karloe installation is active, so Karloe can maintain continuity across conversations. Uninstalling Karloe from your Slack workspace stops all processing of new Slack data. You can request deletion of stored Slack data at any time by contacting privacy@karloe.com, and we will remove it within 30 days.

8. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, delete, or export your personal data. You may also object to or restrict certain processing. Contact us at privacy@karloe.com to exercise these rights.

9. Cookies

We use essential cookies required for authentication and session management. We may also use analytics cookies to understand how the platform is used. You can control cookie preferences through your browser settings.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date.

11. Contact Us

If you have questions about this Privacy Policy, please contact us at privacy@karloe.com.