Privacy

Who we are

Kala ("we") runs kala.host and agent.kala.host. We play two different parts:

• For kala.host itself (the early-access list, instant previews and the accounts of website owners), we decide how the data is used.
• For conversations on a customer's website, that website's owner decides. We store and process those conversations for them, following their settings.

If you talked to Kala on someone else's website, that website's owner is the first place to ask about your conversation. We'll help them answer.

The early-access list

When you ask for early access, we store your email address, your company name if you give one, the date, and a short tag for where you came from (for example producthunt when you arrived from Product Hunt).

We use it to invite you to Kala and to send you news about its launch. We don't share the list with anyone. We keep your entry until you ask us to remove it.

Instant previews

When you paste a website address on kala.host, Kala reads up to eight of that site's public pages, the ones anyone can open without signing in. It keeps their text so you can talk to Kala about the site.

• To stop abuse, the number of previews one visitor can create in a day is limited. For that we keep your IP address only as a salted hash: a one-way code that can't be turned back into the address.
• The preview, the text read from the site, that hash and every conversation held in the preview are deleted 24 hours after the preview was created.
• We keep one line about each preview for 180 days, to see how many people try Kala: the website's address (the domain only), the date, the tag for where you came from, whether Kala could read the site and how many pages, how many times it was tried, and how many messages were sent in it. That line holds no text from the conversation and nothing that identifies you.
• Preview conversations are not analysed afterwards (see automatic processing).

Conversations on websites that use Kala

When you talk or type to Kala on a website, we store, for that website's owner:

• a text transcript of what you and Kala said, typed or written out from speech;
• the address of the page you started on and of the page you came from, without the part after the "?";
• your browser's name and version as it reports them, the language, the time, how long the conversation lasted and how you opened it;
• a random visitor ID kept in your browser, so the owner can see that two conversations came from the same visitor. It isn't linked to your name unless you give it;
• anything you choose to share, such as your name, email, phone number, company, a booking or a request. When you leave your contact details, they are added to the owner's contact list.

If the website shows a greeting bubble next to the chat button, the widget also records when the bubble is shown, opened or closed, with the visitor ID and page address, so the owner can see how often it helps.

The website owner and the team members they invite can read these conversations, and a team member can take over a chat while it is happening.

Website owners can switch on a setting that hides private details in the transcript Kala stores. The basic level hides card numbers and ID numbers (NIK, NPWP, passport and bank account numbers). The strict level also hides email addresses, phone numbers and street addresses. A hidden detail is replaced when the message is saved, so nobody can read it back later. The contact details you give for a booking or a request are kept as you gave them, so the owner can reach you. This applies to the saved transcript, summaries and logs: your voice still goes to the AI model as audio, and what you type reaches it too, except card numbers, which are held back when the setting is on.

Your voice is streamed live to the AI model provider so Kala can listen and answer. Kala doesn't record or store the audio. The microphone is only used after you choose to talk, and you can always type instead.

What Kala sees on the page

Kala never sees your screen. It doesn't take screenshots, record the page, or read what you type into the website's own forms.

While a conversation is open, the widget tells Kala:

• the page address and title;
• the page's headings and link labels, so Kala can scroll to a section or open a page when you ask;
• the heading of the section you're reading;
• the short label of what your pointer is on, such as a plan name or a button's text.

Automatic processing by AI

Kala's voice and chat run on a third-party AI model provider. It receives what is needed for each request, and nothing more.

• During a conversation: your voice or text, the page details above and the website's own content, so Kala can answer.
• After a conversation ends: on customers' websites, finished transcripts are analysed automatically in the background. The result is a short summary, one to three topics, the language you used, your mood, and the questions Kala couldn't answer. The owner sees these in their dashboard and can use the unanswered questions to add answers to their website's knowledge.
• When the owner asks: website owners can ask the AI questions about a conversation, translate it into their language, ask about their contacts, or have it write a short profile of a contact from their conversations. Those questions and answers are saved with the conversation.

All of this is for the website owner to read. No decision with legal or similar effects on you is made by these automatic steps.

Email, SMS and connected tools

A website owner can send you email or text messages from Kala. These go out through the owner's own accounts with the providers they connect: their mailbox (such as Gmail or another email account), Resend for email, or Twilio for SMS. Replies come back into the owner's inbox in Kala.

The same goes for other tools an owner connects, such as Slack or a calendar: Kala passes them the request you made. Each of these providers handles the message under its own terms.

An owner can also send one email to many contacts at once (a campaign), through their own Resend account. Every campaign email names the sender and their postal address, says why you are getting it, and has an unsubscribe link that works with one click. Kala records whether each email was delivered, whether a link in it was clicked, and whether you replied or unsubscribed. It does not track whether you opened it.

Kala's own emails to account holders, such as invitations and password resets, are sent through Resend.

Website owners' accounts

For people who sign in to Kala, we store their name, email address, role, and password as a salted hash, never in plain text. Each sign-in is recorded with its IP address and browser, to keep accounts secure.

Owners also add content for Kala to answer from: pages read from their website, frequently asked questions and settings.

Payments are handled by Dodo Payments, which acts as the seller of record. We never see or store full card numbers.

What is stored in your browser

Kala sets no cookies and runs no analytics or advertising trackers. The widget and the kala.host pages keep a few small items in your browser's storage so they work as you expect:

Visitor ID

A random ID per website, kept in local storage, described above.

Widget appearance

A copy of the website's widget settings in local storage, so the chat button appears quickly.

Greeting bubble

Whether you have already seen or closed it, so it doesn't keep coming back.

Open conversation

The messages on screen, your language choice and whether a call was open, in session storage, so a page change doesn't lose them. Cleared when you close the tab.

Where you came from

On kala.host only: a tag such as producthunt in session storage, saved with your early-access request.

Signed in

For website owners: the sign-in token and display preferences, in local storage.

You can remove all of these by clearing the site's data in your browser. The kala.host pages load their fonts from Google Fonts, which receives your IP address when your browser fetches them.

Who else handles data

We don't sell personal data or share it for advertising. These services handle it so Kala can work:

AI model provider

Voice and text during conversations; transcripts for insights, questions, translations and contact profiles.

Hosting

Our cloud servers, and Cloudflare, which carries traffic to Kala and hosts the database.

Email

Resend, for Kala's own account emails.

Payments

Dodo Payments, for website owners who pay for Kala.

Chosen by the owner

The mailbox, email, SMS, chat and calendar services a website owner connects.

We may also disclose data when the law requires it.

How long we keep it

Early-access entry

Until you ask us to remove it.

Instant previews

24 hours: the preview, the text read from the site, the hashed IP address and every conversation held in it.

Preview log

180 days: one line per preview with the website's domain, the date, the source tag and usage counts. No conversation text, no IP address.

Website conversations

Transcripts, their insights, and the owner's questions and translations stay until the owner deletes the conversation or the website, or until the period the owner has set (30, 90, 180 or 365 days), after which Kala deletes the conversation automatically. Unless the owner sets a period, nothing deletes them automatically.

Contacts

Until the owner deletes them, or the website.

Unsubscribes

When you unsubscribe from an owner's emails, or an email to you bounces or is reported as spam, your address stays on that website's do-not-email list, even after the owner deletes your contact, so you are not emailed again. It is removed with the website.

Abuse limits

To limit how many conversations one address can open, the widget counts IP addresses in memory only. An address can appear in our server logs when a limit is reached.

Accounts

While the account exists. Sign-ins expire after 24 hours, or after 30 days if you choose to stay signed in.

Security

Connections to Kala are encrypted (HTTPS). Passwords are stored as salted hashes. Only the website owner and the team members they invite can open a website's conversations and contacts, and the owner can limit the widget to their own domains.

No system is perfectly secure, and Kala doesn't hold a security certification such as SOC 2 or ISO 27001. If we learn of a breach that affects your data, we will tell the affected website owners, and you if we can reach you.

Your choices and rights

Write to [email protected] to:

• get a copy of the data we hold about you;
• correct it;
• delete it, including your early-access entry;
• object to how it is used.

We may ask you to confirm that the data is yours, and we reply within 30 days. For a conversation on someone else's website, we pass your request to that website's owner and help them answer it. You can also complain to the data protection authority where you live.

Children, other countries and changes

Kala is not meant for children under 16, and we don't knowingly collect their data. If you think a child has given us personal data, write to us and we will delete it.

The services listed above may process data in countries other than yours.

When this page changes, the date at the top changes too. We will email account holders about changes that matter to them.

Questions: [email protected].