Privacy Policy

1.Who we are and what this covers

This Privacy Policy explains how Kloshi (“Kloshi”, “we”, “us”) handles information when you visit our website, create an account, or use the Kloshi application (the “Service”). It should be read with our Terms of Service.

We act in two different roles, and the distinction matters for your rights:

• Controller of the information about you as a user: your account, your sessions, your billing relationship and how you use the Service.
• Processor of the information your workspace stores about its contacts, companies and deals (“Customer Data”). The business that runs the workspace is the controller of that data and decides why and how it is used; we process it on their instructions, as described here and in the Terms. If you are a prospect or customer of a business that uses Kloshi, see Section 13 for how to exercise your rights.

2.Information we collect

Account information

Your name, email address and a password, which is stored only as a salted hash. When you sign in we create a session record containing a random token, its expiry, and the IP address and browser user-agent of the sign-in.

Workspace content (Customer Data)

Everything you and your team put into a workspace: contact records (names, email addresses, phone numbers, job titles, LinkedIn URLs, location, lifecycle stage, lead status, internal notes), company records (name, domain, website, industry, size, revenue, address, description), deals (name, amount, stage, close date, type, priority), tasks, and the timeline of notes, calls and meetings logged against those records. CSV files you import are parsed and discarded; only the resulting records are kept.

Company knowledge

What you tell us about your own business during onboarding (company name, website, industry, what you sell, sales goals) and the structured knowledge derived from it: a summary, products and services, target customers, value propositions, objections, competitive advantages, preferred messaging. If you ask Grok to analyse your website, we fetch publicly available pages from the URL you give us, respecting its robots.txt. You can edit all of this, and none of it is used by the AI Features until you approve it.

Outreach drafts

Outreach drafts (subject, body, the model’s note to the reviewer and confidence), review decisions (who approved or rejected, when, and any reason), send results (time sent, the mailbox provider’s message and thread identifiers, any send error) and recorded outcomes (replied, meeting booked, no response, bounced) are stored against the contact they relate to.

Connected mailbox

If you connect Gmail, we store the email address of the connected account, the OAuth access and refresh tokens Google issues (encrypted, see Section 12), their expiry, and the scopes granted. See Section 5 for exactly what we do with that access.

Connected data provider

If a workspace admin connects Apollo.io, we store the Apollo account label (usually an email address), the OAuth tokens Apollo issues (encrypted), their expiry and scopes, when the connection was last used and the last error it returned. We also store the recommendations a play fetched (company facts, job postings, news headlines, website excerpts and people suggestions, with their sources) and the decision made on each. See Section 6.

Answer engine optimization

If a workspace adds a website under SEO/AEO, we store the website address, the text of pages we crawled from it (a bounded number of public pages, respecting robots.txt), a structured summary of what the site sells, the prompts generated or entered for it, the answers and source lists each answer engine returned when we checked those prompts, and the content recommendations produced from them. If the workspace installs our tracking snippet on that website, we store page-view counts per day and source, and, for visits that arrived from an answer engine, the page path, the source and the referring host. See Section 7.

Billing

Payments are handled by Stripe. We store your workspace’s plan, subscription status, and Stripe customer and subscription identifiers. We never receive or store card numbers.

Usage and audit records

For each AI request we record the workspace, the user, the feature (company analysis, outreach draft, prospect research, or the AEO site index, prompt and recommendation generators), the model, token counts, number of tool calls, duration and whether it succeeded. These usage records do not contain the content of the request. Every change in a workspace is written to an audit log (who did what to which record, when, and from which IP address); the audit log’s metadata is designed not to contain personal details such as names, emails or phone numbers.

Technical information

Our hosting provider keeps standard server logs (IP address, user agent, requested URL, timestamps, response status) for security and troubleshooting. We do not run third-party analytics or advertising trackers on the website or in the application. The optional tracking snippet a workspace can install on its own website is first-party to that workspace and is described in Section 7.

3.How we use information

We use information to:

• Provide the Service: authenticate you, show the right workspace, store and display your records, run plays, send approved emails from the right mailbox, and detect replies on threads we sent;
• Operate the AI Features on your instructions, as described in Section 4;
• Meter AI usage against your plan’s limits and show owners what the workspace has consumed;
• Bill you, through Stripe, for paid plans;
• Send transactional email you need: password resets, workspace invitations, and notices about your account or these policies;
• Secure the Service: enforce workspace isolation, detect abuse, investigate incidents, and maintain the audit log;
• Support you when you contact us;
• Comply with legal obligations and enforce our Terms.

What we don’t do. We don’t sell personal information. We don’t use Customer Data or your research conversations to train machine-learning models. We don’t send marketing email to the contacts in your workspace on our own initiative, and we don’t place tracking pixels in the emails you send. We don’t show advertising.

Legal bases (EEA/UK). We process account, billing and usage information to perform our contract with you and for our legitimate interests in securing and improving the Service; transactional email on the basis of contract; and compliance records to meet legal obligations. Customer Data is processed on the documented instructions of the workspace that controls it.

4.AI processing

The AI Features use Grok models from xAI. Every request is made from our servers, never from your browser, with the provider’s retention option disabled on each call so that the request is not stored by xAI for later use. Our use of xAI is governed by our agreement with them and their API terms.

What is sent to the model

• Company analysis: the public content fetched from your website and what you told us about your business.
• Outreach drafting: the play’s goal, the recipient’s name, title and company details, recent timeline entries for that contact, your approved company knowledge and product catalog.

What is never sent

• Contact email addresses and phone numbers;
• Deal amounts as raw numbers;
• Anything from a different workspace;
• Your password, sessions, mailbox tokens or billing details.

Notes you write on a record are sent when relevant, so if you type an email address or phone number into a note it will be included. The model has no tools to change records or send email. All AI output is shown to you for review; see the Terms for your responsibilities when relying on it.

5.Connected Google accounts

Connecting Gmail is optional and per person. When you connect, Google asks you to grant Kloshi three scopes: gmail.send, gmail.readonly and userinfo.email. Here is exactly how each is used:

• Send — to send an approved outreach draft from your mailbox when you own the contact and a person clicks Send. Nothing is ever sent automatically or on a schedule.
• Read — to fetch the thread of a message Kloshi itself sent, once a day, so a reply or a bounce can be recorded against that draft. We look up threads by the identifier returned when we sent the message. We do not list, search, index or read your inbox, labels, contacts or any message we did not send.
• Email address — to show you which account is connected and to make sure the owner’s sends come from the owner.

Connecting Google Search Console is separate and optional, per website, and available to workspace owners and admins. It asks for webmasters.readonly and userinfo.email. We use the read scope only to list the properties the account can see, so we can pick the one for your website, and to read clicks, impressions, click-through rate and average position for the specific pages of fixes you approved, for the 28 days before and the days after the change went live. We do not read other pages or queries, and cannot change anything in Search Console. The refresh token is stored encrypted and bound to your workspace; disconnecting revokes it with Google and deletes it.

Access and refresh tokens are encrypted at rest with AES-256-GCM using a key held only on our servers, and bound to your user record so a token cannot be reused for another user. You can disconnect at any time from Settings → Mailbox, which deletes the stored tokens, or revoke Kloshi’s access from your Google Account permissions.

6.Prospect data from connected providers

A workspace admin can connect the workspace’s own Apollo.io account under Settings → Integrations so that prospecting plays can find companies that are not yet in the CRM. This is optional. Connecting uses Apollo’s OAuth flow: you sign in to Apollo and approve the permissions Kloshi asks for (company search, company and person enrichment, job postings, news and your basic profile). We never ask for, store or use Apollo API keys, and every request runs as the Apollo user who connected, against that account’s own credits.

What we send to Apollo and what we get back:

• Searches send the filters from your ideal customer profile (industries or keywords, company sizes, locations) and, for people, the job titles and seniorities a play specifies together with Apollo’s identifier for a company. We do not send your CRM records to Apollo.
• Results are company records (name, domain, industry, size, location, description, funding), job postings, news articles, and for people only a first name, an obfuscated last name, a title and whether Apollo holds an email. We store these as recommendations inside your workspace, attributed to Apollo, so a person can decide. They are not CRM records yet.
• Enrichment happens only when a person approves a recommendation. Then we ask Apollo for that one person’s work email, full name, title, LinkedIn URL and location, and create a contact and company in your CRM marked with their source and date. We never request personal (non-work) emails or phone numbers.

Provider data stays inside the workspace that fetched it. We do not share, resell or pool it across customers, and we do not use it to train models. Apollo’s own handling of the request is governed by Apollo’s privacy policy. Before this feature researches a company, Grok may also fetch a few pages of that company’s public website (respecting robots.txt) so that any claim it makes can cite where it came from.

Tokens are encrypted at rest exactly like mailbox tokens and bound to the workspace. A workspace admin can disconnect at any time from Settings → Integrations, which deletes the stored tokens; you can also revoke Kloshi from inside Apollo. Disconnecting does not delete recommendations or records already created, which remain your workspace’s data.

If you are a person who appears in a recommendation. Kloshi customers use this feature to find businesses to contact for business purposes. The information comes from Apollo, not from us collecting it about you, and we hold only what a customer fetched into their workspace. To learn what Apollo holds or to object, see Apollo’s privacy policy. To ask a specific Kloshi customer to stop contacting you, reply to them or contact their business; to raise a concern with us, write to privacy@kloshi.com and we will act under our Terms.

7.Answer engine checks and the tracking snippet

Under SEO/AEO, a workspace can add websites it wants answer engines (ChatGPT, Gemini and Perplexity) to cite. This is optional, and the number of websites, prompts and engines depends on the workspace’s plan.

What we send to answer engines

When a check runs, we send each active prompt, as plain text, to the answer engines included in the plan, using Kloshi’s own API accounts: OpenAI for ChatGPT, Google (Gemini API) for Gemini, and Perplexity. Prompts are generic buyer questions written from the site’s public pages (for example “best electric forklift for a small warehouse”). We do not send your CRM records, your contacts, your Company Knowledge or any personal data to these engines, and the prompts are not tied to any person. We store what each engine answered and which web pages it listed as sources so you can see exactly why a prompt counts as cited, mentioned or absent. Those engines’ handling of a request is governed by their own terms; retention settings are set to the minimum each provider offers for API use.

What we crawl

To build the site index and to understand what already ranks, we fetch a bounded number of public pages from the website you added and, for recommendations, up to three of the pages an engine cited instead. Fetching identifies itself as KloshiBot, honours robots.txt, never fetches private network addresses, and keeps only page text, not forms, cookies or scripts. If an owner or admin turns on scheduled re-crawls, we fetch the same pages again on the schedule chosen (daily, weekly or monthly) without using AI, and keep a record of each run: counts, page paths, and which findings appeared or were resolved. Grok (xAI) then produces the site index, the prompts and the recommendations from that text under the same rules as our other AI Features (Section 4).

SEO checks, AI agents and proposed fixes

When a website is crawled we also record its search-relevant metadata (title, description, canonical address, headings, image and link counts, structured-data types) and run automatic checks on it. If you ask for an analysis or a proposed fix, we send the relevant page text, that metadata and a short summary of what the site sells to Grok (xAI) through our API account, under the same rules as our other AI Features. Page text is treated as data, never as instructions, and the result must match a fixed format before it is saved.

A workspace owner or admin can instead connect their own Grok Bot or Grok Automation webhook. If they do, the same material is sent to the webhook address they entered, which then belongs to their own arrangement with xAI and not to us; the address must be https and public, and its key is stored encrypted and never shown again. Each job carries a single-use address that the Bot may post a result to, and a person can also paste a result in. We cannot read the status or result of a Bot run ourselves.

Competitors you name are stored with what we read from their public pages (page titles, descriptions, headings, schema types and short excerpts), fetched honouring robots.txt, and with the agent’s summary of them; we do not log in to or contact those sites beyond fetching those pages. Proposed fixes are suggestions only. We never change your website: an approved fix is shown to you as text to apply yourself. If an owner or admin connects a GitHub repository, we store its fine-grained access token encrypted, use it only to open a pull request on a separate branch that adds a file describing the approved change (the page, the current and approved values, and the reason), and never write to the base branch. We later fetch the public page, honouring robots.txt, to check whether the approved change is live. Jobs, proposals, who approved or rejected them and when are kept as part of the workspace’s history.

The tracking snippet

To show whether answer engines send visitors, a workspace can install a small script (aeo.js) on its own website. The script sends us the page address and the referring page address for each page view. It sets no cookies, uses no local storage, and does not fingerprint devices. On our side we drop anything that does not come from the registered website, classify the referrer into a source (ChatGPT, Gemini, Perplexity, other AI assistants, search, direct or other), and keep only:

• a count of page views per day and per source for every visit, and
• for visits that arrived from an answer engine only: the page path, the source and the referring host, plus which published recommendation (if any) that page corresponds to.

We do not store IP addresses, user agents, visitor identifiers, query strings or the content of pages. Server logs at our hosting provider are kept as described above. The business that installs the snippet on its website is responsible for its own notices to its visitors; because the snippet stores no identifiers and no personal data, it is designed to operate without consent banners in most jurisdictions, but that determination is the website owner’s to make.

8.Email we send to your contacts

Outreach email is sent from a workspace member’s own Gmail account, at that workspace’s direction, to contacts in that workspace. Kloshi is the tool; the sending business is responsible for the content and for the lawfulness of contacting each recipient, including recipients found through a connected data provider. We do not add tracking pixels, link redirects or read receipts, so we never know whether a recipient opened a message. Replies go to the sender’s own inbox, not to us.

If you received an email from a Kloshi user and want to stop hearing from them, reply to the sender or contact their business directly. If you believe a Kloshi user is sending unlawful email, tell us at privacy@kloshi.com and we will investigate under our Terms.

9.How we share information

We share information only as follows:

• Within your workspace. Customer Data is visible to every member of the workspace it belongs to. Your name is shown to other members as a record owner, task assignee or author of a note.
• Service providers (sub-processors) who process data on our behalf under contracts that restrict their use of it:

• Legal reasons. If required by law, subpoena or court order, or to protect the rights, safety or property of Kloshi, our users or the public. Where lawful, we will tell the affected workspace owner before disclosing Customer Data.
• Business transfers. In a merger, acquisition, financing or sale of assets, information may be transferred to the successor, who must honour this policy or give you notice and a choice.
• With your direction. For example, when you connect Gmail or when you ask us to share something.

We will update this table when we add or replace a sub-processor and, for paid workspaces, notify owners by email in advance of a change that affects Customer Data.

10.Cookies and local storage

We use only the cookies and browser storage the Service needs to work. There are no advertising or third-party analytics cookies.

Because these are strictly necessary, no consent banner is shown. You can clear them from your browser at any time; doing so signs you out.

11.Data retention

• Customer Data is kept for as long as the workspace exists. Deleting a record removes it, and its timeline, immediately. Deleting a workspace (an owner action in Settings) permanently removes every record, draft, conversation, usage record and audit entry in it.
• Account information is kept while your account exists. If you leave every workspace and want your account removed, write to privacy@kloshi.com.
• Sessions are removed when you sign out or they expire.
• Mailbox tokens are deleted when you disconnect, or when your account is deleted.
• AEO data (crawled page text, the site index, prompts, engine answers, recommendations, visit counts and AI-sourced visits) is kept while the website is tracked and deleted when a workspace admin removes the website or the workspace is deleted. Crawled page text is replaced on every re-index.
• Billing records are retained as required by tax and accounting law, typically seven years.
• Backups of the database are kept by our database provider for a limited rolling window for disaster recovery; deleted data leaves backups as that window rolls over.
• Server logs are retained by our hosting provider for a limited period for security and troubleshooting, then discarded.

After an account or workspace has been inactive for an extended period, we may contact the owner before deleting it. If you stop paying, your workspace returns to the trial plan’s limits; we do not delete it for that reason.

12.Security

We design security into the Service rather than bolting it on. Measures include:

• Every record carries its workspace identifier, and membership is re-verified against the database on every request. A non-member receives a “not found” response, so workspace names cannot be discovered by guessing.
• Passwords are stored as salted hashes; sessions use random, HttpOnly, Secure cookies.
• Third-party credentials (Gmail and Apollo tokens) are encrypted at rest with AES-256-GCM and authenticated against the owning user or workspace so ciphertext cannot be moved between records.
• Traffic is encrypted in transit (TLS), including the connection between the application and the database, which verifies the server certificate.
• AI requests run server-side only, never expose secrets to the browser, and are made with provider retention disabled.
• Website fetching during analysis refuses private, loopback and cloud-metadata network ranges to prevent server-side request forgery.
• An audit log records every mutation in a workspace. Usage caps per workspace stop a runaway process from running unchecked.
• Security headers restrict framing, referrer leakage and content-type sniffing.

No system is perfectly secure. If we learn of a breach affecting your information we will notify affected workspace owners without undue delay and, where required, regulators. To report a vulnerability, email privacy@kloshi.com.

13.Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, restrict or object to our processing of your personal information, to receive a copy of it in a portable format, and to withdraw consent where processing is based on consent. We honour these rights regardless of location where we reasonably can.

If you are a Kloshi user

You can reset your password from the sign-in page, disconnect your mailbox from Settings → Mailbox, and sign out at any time. For anything else, including correcting your name or deleting your account, email privacy@kloshi.com. We will verify your request against the email address on your account and respond within 30 days.

If your data is in a customer’s workspace

If you are a contact in a workspace run by one of our customers, that business is the controller of your data. Please direct your request to them; they can correct or delete your record directly. If you contact us, we will forward your request to the workspace owner and help them fulfil it, and we will not retaliate against you for making it.

Additional rights

• EEA, UK and Switzerland: you may lodge a complaint with your local supervisory authority. Transfers outside these regions are described in Section 14.
• California: we do not “sell” or “share” personal information as defined by the CCPA/CPRA and have not done so in the preceding 12 months. You have the right to know, delete, correct, and not be discriminated against for exercising your rights. Authorised agents may submit requests with proof of authority.
• Do Not Track / Global Privacy Control: because we do not track you across sites or sell data, these signals do not change how the Service behaves.

14.International transfers

Our providers operate primarily in the United States, and your information may be processed there and in other countries whose data-protection laws differ from yours. Where we transfer personal data from the EEA, UK or Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and the UK Addendum, or an adequacy decision, together with the technical measures described in Section 12.

15.Children

The Service is for businesses and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact privacy@kloshi.com and we will delete it.

16.Changes to this policy

We may update this policy as the Service and the law change. The effective date at the top of this page tells you when it was last revised. For material changes, we will notify workspace owners by email or with a notice in the Service before the change takes effect. Earlier versions are available on request.

17.Contact us

Privacy questions and requests: privacy@kloshi.com
General support: support@kloshi.com
Legal notices: legal@kloshi.com

Kloshi