Karos Labs

Privacy Policy

Effective 25 October 2026Last updated 25 October 2026

This policy explains how Karos Limited, a Delaware corporation, trading as "Karos Labs"("Karos Labs", "we", "us") handles personal data when you visit karoslabs.com, use the Karos software at app.karoslabs.com ("Karos"), book a call with us or use our e-commerce managed service.

1. Who we are

Karos Labs decides how and why your personal data is used for the website, your account and our services, so we are responsible for it (the "controller").

Some data belongs to our customers' own audiences, for example people who fill in a lead form on a landing page Karos hosts for a customer. For that data, the customer is the controller and we process it on the customer's behalf. If you filled in such a form, please contact that business first; we will help them answer you.

2. What we collect

What you give us

  • Account details: your name, email address, company and sign-in details.
  • Business information: your website address, goals, brand materials, files, photos and anything you tell Karos in chat.
  • Your choices in Karos: what you approve, edit or skip, and the reasons you give.
  • Messages and calls: what you write to us, and the name, email and notes you give when you book a call.
  • Billing details: handled by Stripe. We see the plan, the payment status and the last digits of your card, never the full card number.

What Karos reads from public sources

  • Your public website and public social accounts.
  • Your competitors' public pages and public posts.
  • How ChatGPT, Gemini and Claude answer questions about your business.

Public pages and posts can include names and words of other people, such as a person who replied to a post. We use them only to understand your market and write your drafts.

What comes from accounts you connect

  • From X, LinkedIn, Meta (Instagram and Facebook), TikTok and Google: your account name and ID, your posts, and how they perform (such as views, likes, comments and followers), as far as the permissions you granted allow.
  • From tracked links and forms Karos sets up for you: clicks, and the details people enter in a form, such as a name and email. We count them as requests and leads for you.
  • For the e-commerce managed service: the seller account data you give our team access to, such as listings, orders, inventory, advertising and reports.

What is collected automatically

  • Server logs: IP address, browser type, pages requested and the time, used to keep the website and Karos running and secure.
  • The small items this website keeps in your browser, described in Cookies and browser storage.

3. How we use it, and why we may

  • To provide Karos: read your public presence, plan campaigns, write drafts, publish what you approved, count results and keep your account working. Our basis is our contract with you.
  • To improve the drafts we write for you, using your approvals, edits and skip reasons. Basis: our contract with you.
  • To bill you, keep records and meet tax and legal duties. Basis: legal obligation and our contract with you.
  • To answer your messages, run calls and send service emails such as sign-in links, reminders and notices. Basis: our contract with you, or our legitimate interest in answering people who contact us.
  • To keep Karos and the website secure, prevent abuse and fix problems. Basis: our legitimate interest in running a safe service.
  • To read public pages about your competitors and your market. Basis: our legitimate interest in providing the service you asked for, limited to what is public.

We do not sell personal data, and we do not use it for advertising.

4. AI processing

To write drafts, summaries and answers, Karos sends your business information and content to AI model providers, such as Anthropic, Google, OpenAI, Perplexity and ElevenLabs. They process it under their API terms for business customers. Karos Labs does not use your content to train public AI models. To measure how AI answers describe you, Karos asks ChatGPT, Gemini and Claude questions about your business and your market.

5. Connected accounts

You connect accounts yourself, through each platform's own sign-in (OAuth). Karos acts only within the permissions you grant: it publishes only what you approved, and reads only what it needs to show your results. We store the access tokens encrypted and never show them in the browser. You can disconnect at any time, in Karos or in the platform's own settings. When you disconnect, Karos stops reading and publishing there and we delete the stored token.

6. Google user data

If you connect a Google account (for example when you sign in with Google), Karos uses the data only to provide the features you turned on, such as signing you in. Karos Labs' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In line with that policy, data from Google APIs is:

  • used only to provide or improve the features you can see in Karos;
  • never sold, and never used or transferred for advertising;
  • never used to train general or third-party AI or machine-learning models;
  • not read by people, unless you ask us to, it is needed for security or the law, or it has been aggregated and made anonymous.

You can remove Karos from your Google account at any time at myaccount.google.com/permissions.

7. Who we share it with

We share personal data only with the service providers who help us run Karos, under contracts that limit their use of it to the work they do for us:

  • Google Cloud and Firebase: Hosting for this website and the Karos app, our database, file storage and sign-in.
  • Anthropic, OpenAI and Google: AI models that read your business information and write drafts, summaries and answers.
  • Perplexity: AI models that search the public web when Karos researches your business, your market and your competitors.
  • ElevenLabs: AI voices that narrate the films Karos makes for you.
  • Web data services: Services that fetch public web pages and public social posts for us, when Karos reads your site, your public accounts and your competitors.
  • Resend: The emails Karos sends you, such as sign-in links, reminders and notices.
  • Stripe: Payments and billing. Stripe holds your card details; we never see your full card number.
  • Calendly: Booking a call with us, when you choose to.

We also share data:

  • with the platforms you connect, when Karos publishes what you approved or reads your results there. Their own privacy policies apply;
  • when the law requires it, or to protect the rights and safety of people or of Karos Labs;
  • as part of a merger, acquisition or sale of our business, under this policy;
  • with anyone else, only when you ask us to.

8. International transfers

We and our providers work in several countries, including the United States, so your data may be processed outside the country where you live. When data from the European Economic Area, the United Kingdom or Switzerland goes to a country without an adequacy decision, we rely on the Standard Contractual Clauses approved for that purpose, or another lawful safeguard.

9. How long we keep it

  • Account data and your content: while your account is open.
  • After you close your account or ask us to delete your data: we delete it or make it anonymous within a reasonable time, except what we must keep by law.
  • Billing and tax records: as long as tax and accounting law requires.
  • Connected-account tokens: until you disconnect the account.
  • Server logs: for a short time, for security and to fix problems.

10. Security

We use encryption in transit (HTTPS) and encrypt stored access tokens. Access to data is limited to the people and systems that need it, and each customer can only see their own workspace. No system is perfectly secure; if a breach affects your data, we tell you and the authorities as the law requires.

11. Cookies and browser storage

This website sets no advertising or tracking cookies and loads no analytics scripts. It keeps two small items in your browser:

  • Your light or dark choice, if you change it, kept in your browser's local storage ("karos-theme").
  • If you arrive from a link with campaign tags (utm_ or ref), those tags, kept for the open tab only ("karos-attr") and added to the sign-up link so we know where you found us.

The Karos app uses a sign-in cookie to keep you signed in. It is needed for the app to work.

12. Your rights

Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it or send it to you in a portable format, and you can object to or ask us to limit how we use it, or withdraw consent you gave. Write to [email protected]. We answer within the time the law sets, usually one month. We may need to confirm who you are first.

  • European Economic Area and United Kingdom (GDPR and UK GDPR): you can also complain to your local data protection authority.
  • California (CCPA and CPRA): you can ask what we collect and why, and ask us to delete or correct it. We do not sell or share personal data for cross-context behavioural advertising, and we will not treat you differently for using your rights. You can use an authorised agent to make a request.

13. Children

Karos and this website are for businesses. They are not meant for anyone under 16, and we do not knowingly collect data from children under 16. If you think a child has given us data, write to us and we will delete it.

14. Changes to this policy

We may update this policy. We change the date at the top when we do, and for a material change we tell you by email or in Karos before it takes effect.

15. Contact

Karos Limited, a Delaware corporation (trading as Karos Labs)
Email: [email protected]

Read with our Terms of Service.