Privacy Policy

Kadre Labs, Inc. (“Kadre Labs,” “we,” “us,” or “our”), a Delaware corporation, provides a platform for building, running, and governing AI agents around a company’s recurring business workflows, together with related professional services such as read-only diagnostics, agent builds, day-to-day operation, executive enablement, and operator advisory (collectively, the “Services”). The platform can read from and write to systems our customers connect, such as CRM, accounting, service desk, email, document, commerce, and telephony systems, and can draft and, with a person’s approval, send communications on our customers’ behalf. This Privacy Policy explains what information we collect, how we use and share it, and the choices you have.

This policy applies to our websites, applications, and the Services. It applies to visitors of our websites, individuals who register for or use the Services (“users”), and individuals whose information is processed by the Services on behalf of our business customers.

1. Our role: controller vs. processor

We act in two capacities:

As a controller for information about our own users and website visitors (e.g., your account registration details, billing information, and usage of our Services).
As a processor / service provider for content and data that our business customers submit to, connect with, or generate through the Services (“Customer Data”), for example, records about a customer’s own customers, prospects, suppliers, and staff drawn from the systems the customer connects, drafts the Services produce, and the decisions and corrections a customer’s reviewers record. We process Customer Data on the customer’s instructions, under our agreement with that customer. If your information appears in Customer Data, please direct requests to the relevant business customer; we will assist them in responding.

Services engagements

In a services engagement (for example a read-only diagnostic, an agent build, ongoing operation, or executive enablement), Kadre Labs personnel may access a customer’s systems and the personal information in them. That access is granted by the customer, limited to what the engagement needs, revocable by the customer, and covered by confidentiality obligations. We act as a processor or service provider for personal information we encounter in those systems, under the engagement agreement with that customer. Where the Services run inside a customer’s own infrastructure, the agreement with that customer states what data, if any, reaches Kadre Labs.

2. Information we collect

Information you provide

Account information: name, email address, company name, role, and password or single-sign-on identifiers.
Billing information: billing contact and address, and payment details, which are collected and processed by our payment and banking providers; we do not store full payment card numbers.
Customer Data: business records, contact records, documents, communications, workflow settings, policies and rules, reviewer decisions and corrections, and other material you submit to the Services, connect to the Services, or instruct the Services to generate, draft, or send.
Website forms: information you submit through forms on our website (for example, our contact and strategy-call forms), such as your name, email address, company, service interest, and message.
Communications: messages you send us, including support requests and feedback.

Information from connected systems

The Services can connect to third-party systems at your direction, using each system’s authorization flow or credentials you provide with the scopes the workflow needs. Examples include CRM, accounting, service desk, email, document, commerce, and telephony systems, Intuit platforms such as QuickBooks, and social media platforms such as LinkedIn, Facebook, Instagram, TikTok, and X (see Social media platform connections). When you connect a system we may receive and store:

access tokens that authorize the Services to act on the connected account (we never receive or store your platform password);
basic profile and page/account information (e.g., page name, account ID, profile image);
records, messages, tickets, invoices, orders, content, and related status and metrics made available by the system’s APIs under the permissions you grant;
business records made available by a platform’s APIs under your granted permissions (for example, accounting records from QuickBooks, if you connect it).

Our use of information received from Intuit platforms complies with Intuit’s developer terms and applicable policies. Our use and transfer of information received from any third-party API is limited to the practices described in this policy.

Voice and call data

Where a customer enables a voice workflow, the Services may place or receive calls at the customer’s direction and may record and transcribe them. Recordings and transcripts are Customer Data, retained under the agreement with that customer. The customer is responsible for the consents, notices, and do-not-call and suppression rules that apply to its calls; the Services provide consent checks, suppression, and call-duration limits that the customer configures. We do not create voiceprints or other biometric identifiers from call audio.

Information collected automatically

Usage and log data: IP address, browser and device type, pages viewed, actions taken in the product, timestamps, and diagnostic logs.
Cookies and similar technologies: we use strictly necessary cookies for authentication and session management. Our website analytics are privacy-preserving and do not use cookies or track you across sites. You can control cookies through your browser settings.

3. How we use information

To provide, operate, secure, and maintain the Services, including reading from and writing to the systems you have connected and sending communications you have approved, at your direction;
To set up and manage accounts, authenticate users, and provide support;
To process billing, invoicing, and payments, and to comply with tax and accounting obligations;
To improve the Services using aggregated or de-identified usage and diagnostic data. We do not use one customer’s Customer Data, reviewer corrections, or configured rules to build or improve the Services for another customer, and we do not train general-purpose models on Customer Data;
To communicate with you about the Services, including service announcements and security notices;
To comply with law and enforce our agreements.

AI processing

The Services use artificial-intelligence models, including models operated by third-party AI providers, to generate and process content at your direction. Customer Data submitted for AI processing is sent to these providers under agreements that restrict use to providing the service to us; we do not permit our AI providers to use Customer Data to train their generally available models. AI-generated content can be inaccurate; customers are responsible for reviewing content before publication as described in our Terms of Service.

4. How we share information

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We share information only with:

Service providers (subprocessors): hosting and infrastructure, AI model providers, payment and banking providers, email delivery, analytics, and customer-support tooling, each bound by contract to process information only on our instructions. A current list of subprocessors is available on request at privacy@kadrelabs.ai, and customers receive notice of changes under their agreement;
Connected systems: when you instruct the Services to perform an action in a connected system (for example, sending an approved email through your CRM, creating a draft invoice, or publishing an approved post to a connected social media account), the relevant content and metadata are transmitted to that system and become subject to its terms and privacy policy;
Legal and safety: when required by law, subpoena, or legal process, or to protect the rights, safety, and property of Kadre Labs, our users, or others;
Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to confidentiality protections.

5. Data retention

We retain account information for as long as your account is active and as needed to comply with legal, tax, and accounting obligations. Customer Data is retained according to our agreement with the customer and is deleted or returned upon termination of the agreement, subject to a reasonable wind-down period and legal retention requirements. Platform access tokens are deleted promptly when you disconnect an account or terminate the Services. Backup copies are purged on a rolling basis.

6. Data deletion, including connected social media data

You can request deletion of your data at any time:

Disconnect a system: in the product settings, or by asking us, disconnect any connected system; this revokes our access and we delete the associated access tokens and the data we hold from that system, subject to the retention terms in your agreement.
Revoke access from a social media platform: you can also remove Kadre’s access from the platform itself, for example in Facebook under Settings → Apps and websites, or in the connected apps settings of Instagram, LinkedIn, TikTok, or X. If you remove access this way, you can also email privacy@kadrelabs.ai to ask us to delete any platform data we still hold, and we will delete it within 30 days.
Full account deletion: email privacy@kadrelabs.ai from the email associated with your account requesting deletion. We will verify the request, delete your personal information and Customer Data (except where retention is legally required, e.g., invoices for tax purposes), and confirm completion within 30 days.

Customers can connect business accounts on LinkedIn, Facebook, Instagram, TikTok, and X so the Services can publish approved posts to them. This section describes exactly what data we handle from each platform. We collect it only when a customer chooses to connect an account, and the commitments below apply to every platform.

What we collect

For every platform, when a customer connects an account we store:

The email address of the Kadre user account of the person who connects it.
OAuth access tokens, and a refresh token if the platform issues one, stored encrypted.
The scopes or permissions the person granted, and when they granted them.
For each post we publish: the platform’s post ID, its public URL, and the time it was published.
If analytics are enabled: aggregate performance figures for those posts, such as impressions, reactions, and clicks.

We also store the following, depending on the platform:

LinkedIn company pages

The LinkedIn member ID of the person who connects the account.
The ID, name, and URL of each LinkedIn company page that person administers, and their role on each page (administrator or content administrator).

Facebook Pages

The Facebook user ID that Meta issues to our app for the person who connects the account.
The ID, name, and URL of each Facebook Page that person manages, and the tasks they can perform on it.

Instagram business accounts

The ID and username of each Instagram business account the person connects.
Where the account is connected through a Facebook Page, the ID of that Page.

TikTok

The TikTok account ID that TikTok issues to our app, and the account’s display name.

X

The X user ID and handle of the connected account.

What we do not do

We never post to personal profiles or personal accounts, only to business pages and accounts a customer connects.
We never publish anything without a named person at the customer approving that exact post first.
We do not collect the personal profiles, followers, connections, messages, or contact details of anyone on these platforms, and we do not scrape any of them.
We do not automate engagement: no likes, comments, replies, reposts, follows, or messages.
We do not sell platform data, and we do not share it with third parties for advertising.
We do not use platform data to train machine learning models.

How we use it

To publish approved posts to the customer’s own pages and accounts at the time they schedule.
To confirm a post published. We read the account’s recent posts back so we never post the same thing twice.
Where analytics are enabled, to show the account’s own administrators how their posts performed.

Retention and deletion

Tokens are deleted when a customer disconnects the account in Kadre, or when they close their Kadre account.
A customer can disconnect at any time from Integrations in the Kadre dashboard, and can also revoke Kadre’s access from the platform’s own settings.
Records of posts we published (their IDs and links), and any analytics for those posts, are kept as part of the customer’s publishing history for 90 days after each post is published, and are then deleted.
For data questions and deletion requests, email privacy@kadrelabs.ai. See also Data deletion.

Security

Tokens are encrypted at rest. Each customer’s data is held in an isolated per-customer environment. Access is limited to staff who need it to run the service.

Platform terms

Our use of data received from these platforms complies with each platform’s developer terms and policies, including the LinkedIn API Terms of Use, the Meta Platform Terms, the TikTok Developer Terms of Service, and the X Developer Agreement and Developer Policy, including their limits on use, sharing, and retention of platform data.

8. Security

We use industry-standard safeguards to protect information, including encryption in transit (TLS), encryption of stored credentials and tokens, secrets management, least-privilege access controls, and separation of each customer’s data, keys, records, and memory from every other customer’s. No method of transmission or storage is completely secure; we encourage strong, unique passwords and prompt reporting of any suspected compromise to security@kadrelabs.ai.

9. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, and to opt out of certain processing.

United States state rights (including California)

If you are a resident of California or another U.S. state with a comprehensive privacy law, you have the right to: (a) know/access the personal information we hold about you; (b) correct inaccurate information; (c) delete your information; (d) opt out of the sale or sharing of personal information (we do neither); and (e) not be discriminated against for exercising these rights. Submit requests to privacy@kadrelabs.ai; we will verify your identity and respond within the time required by law. You may use an authorized agent to submit requests on your behalf.

European Economic Area / United Kingdom

If we process your personal data subject to the GDPR or UK GDPR, our legal bases are performance of a contract, legitimate interests (e.g., securing and improving the Services), and consent where required. You additionally have rights to object to or restrict processing and to lodge a complaint with your supervisory authority. Where we transfer data internationally, we rely on appropriate safeguards such as Standard Contractual Clauses.

10. Children

The Services are business tools intended for users 18 and older. We do not knowingly collect personal information from children under 13 (or the applicable age of digital consent). If you believe a child has provided us information, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. We will post the updated version at this URL and update the “Last updated” date; for material changes we will provide additional notice (e.g., email or in-product notice). Continued use of the Services after changes take effect constitutes acceptance.

12. Contact us

Kadre Labs, Inc.
254 Chapman Road, STE 208 #27637
Newark, DE 19702, United States
Email: privacy@kadrelabs.ai
Phone: 512-698-2347
Website: https://kadrelabs.ai