This policy explains how Kyros handles information when businesses use our website, account portal and AI receptionist features, and when people interact with a receptionist provided through Kyros.
01About this policy
Kyros is operated by KYROS AI LLC. We provide an AI receptionist for businesses. This policy explains how we handle information to provide the service, support accounts and protect personal information. Businesses using Kyros are also responsible for the caller and customer information they ask us to process.
If you call a business using Kyros, contact that business about its services, appointment decisions or instructions to its receptionist. You can contact us about Kyros’s handling of information at hello@kyroshq.com.
02Information we handle
The information processed depends on the features a business connects and enables.
- Account information: names, business contact details, account identifiers and login or verification records.
- Business setup: services, hours, location, greetings, FAQs, receptionist instructions and selected preferences.
- Calls and customers: caller contact details, call times and duration, call outcomes, messages, summaries, transcripts, follow-ups and optional audio recordings.
- Appointments: scheduling requests, selected calendar information, availability, event details and appointment-change verification records.
- Billing: selected plan, subscription identifiers, payment status, invoices and usage records. Stripe processes payment details; Kyros does not need your full payment-card number to provide the service.
- Technical and security information: connection and application records needed to operate the website, diagnose failures, authenticate users and protect accounts.
- Website inquiries and demos: contact and business information you submit, messages, the page and time of submission, referring page and campaign parameters included in the link you used. Information comes from you, the business you contact, connected providers and service activity.
03How we use information
We use information to create and authenticate accounts, apply business settings, answer calls, organize messages and follow-ups, and perform authorized scheduling actions. We also use account and usage records to manage subscriptions, reconcile charges, provide support, and investigate security or service problems.
Kyros AI uses OpenAI to answer support questions using your messages and limited account context, such as your plan and setup status. Caller recordings, transcripts and individual customer records are not automatically included. Recent chats are saved in your browser. OpenAI processes messages under its data-handling and retention policies.
Service emails include account verification, password recovery, appointment-change verification and action-needed notifications. The business notification flow is intended to highlight calls that require attention, rather than email the business after every resolved call.
We limit access and processing to the purpose involved. The Google Calendar restrictions below apply even if another section could otherwise be read more broadly.
Website inquiry information is used to respond, provide requested demonstrations and understand how inquiries reach us. If we send promotional emails, you can unsubscribe through the message or contact us. Essential account, security and billing messages may continue.
04Calls, transcripts and recording
The receptionist uses speech and AI processing to understand callers and respond using the business’s instructions. Call information can appear in that business’s Kyros portal.
Audio recording is optional and subject to required notices and consent. When recording is enabled, authorized business users can access available replay, download and deletion controls.
Turning off audio recording does not turn off all call processing or necessarily disable transcripts, summaries or call history. Businesses must give callers the notices and choices required for their use of the service.
05Connecting Google Calendar
When enabled and connected with your permission, the Google Calendar integration identifies your Google account, lists calendars and their ownership and time zones, checks availability, and reads, creates, changes or deletes events on calendars you own.
You select one owned calendar for Kyros scheduling. Google’s permission can cover other owned calendars; Kyros restricts scheduling operations to the selected calendar. Connecting a calendar is optional and separate from signing up. This integration does not request access to your Gmail messages.
06How calendar information is used and shared
We process Google account and calendar identifiers, event details, appointment times and availability to provide the scheduling features you authorize. Our hosting provider processes this information for Kyros. Our email provider receives the details needed to verify appointment changes. Google refresh credentials are stored encrypted in Kyros’s backend.
When voice scheduling is enabled, the AI service receives the relevant availability or action result to respond to the caller. Those results may include information derived from Google Calendar. Google access and refresh credentials are not sent to the voice service or callers.
Google API information, including derived information, is used only for the authorized scheduling features described here. It is not sold or used for advertising or credit decisions. Google user data, including information derived from it, is never used to develop, train, or improve any artificial intelligence or machine learning model, by Kyros or by any service provider. Any transfer or human access must meet Google’s Limited Use requirements.
These limits take precedence over broader data-use permissions elsewhere in this Privacy Policy and our Terms. Kyros’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
07Disconnecting Google Calendar
Disconnecting in Kyros removes the active stored credential and account/calendar connection identifiers and prevents new operations through that connection. It does not delete events already in Google Calendar or retained Kyros booking records. An operation already in progress may require reconciliation.
You can separately revoke Kyros access in your Google Account connections. Disconnecting, revoking Google access, deleting a particular record and closing your Kyros account are different actions. Contact hello@kyroshq.com about retained Kyros data.
08Service providers
Kyros uses the following providers for the roles listed. Each receives the information needed for its role; this does not mean every provider receives every category of information.
- Railway: application hosting, database storage and background processing.
- Auth0: account authentication and identity verification.
- Twilio: phone numbers and call transport.
- ElevenLabs / ElevenAgents: receptionist conversations, speech processing and the model services used for responses.
- OpenAI: support-question responses for Kyros AI.
- Google: calendar authorization and scheduling APIs.
- Stripe: payment processing and subscriptions.
- Resend: transactional email delivery.
- Cloudflare: domain, DNS and configured web infrastructure.
09Other disclosures and access
Information needed to handle a call, message or appointment is made available to the business the caller contacted. Authorized support and operational access must be limited to the work being performed.
We may need to disclose information to comply with an applicable legal obligation or to investigate misuse and protect accounts. A request for disclosure does not remove the additional restrictions that apply to Google API information.
10How long information is kept
Kyros applies the following retention periods:
Website inquiry and support records are retained as needed to respond, maintain the relationship, address disputes and meet applicable legal obligations. Contact us to request deletion. Required financial or legal records are kept separately with access limited to that purpose; they do not justify keeping every call recording indefinitely.
- Transcripts and enabled audio recordings: 90 days.
- Call summaries and history: 365 days.
- Customer and appointment records: deletion 30 days after account closure.
- Expired verification secrets: cleanup within 24 hours.
- Encrypted backups: expiration after 30 days.
- Financial records: kept separately as needed for applicable accounting and legal obligations.
11Deletion and backup copies
Provider and backup copies may remain until their applicable deletion process completes. Deleting an item from the portal or disconnecting a provider does not promise immediate erasure of every copy.
Closing an account revokes account access and initiates its deletion schedule. Financial records may remain on a separate basis. Google Calendar events are not deleted simply because the calendar is disconnected or a Kyros account is closed.
12Protecting information
We protect account access and connection credentials and limit access to service information. Security measures are designed to separate business accounts and protect information during storage and processing.
No internet service can promise that information will never be lost, accessed improperly or interrupted. Keep your login secure and contact us promptly if you believe an account has been compromised.
14Your choices and requests
You can update business information, choose optional connections, and request access, correction or deletion by contacting hello@kyroshq.com. Export, replay and deletion controls are available only where the relevant feature has been enabled.
Depending on the laws that apply, you may have additional rights concerning your personal information. We may need to verify your identity and your authority over the account or record before acting. A request may be limited where information must be retained for a legal obligation or to protect another person’s rights.
If your information is held for a business using Kyros, we may direct the request to that business or work with it to respond. Do not send passwords or full payment-card details in a privacy request.
Where applicable law provides them, rights may include obtaining a copy of your information, correcting or deleting it, restricting certain processing, and appealing a denied request. Send requests or appeals to hello@kyroshq.com with the subject Privacy request or Privacy appeal. We respond within the period required by the law that applies, explain any permitted extension or denial, and do not retaliate for exercising privacy rights. An authorized agent may contact us, subject to verification of authority. You may also contact the appropriate privacy regulator or state attorney general.
15Kyros and the business you contact
Kyros determines how information is used for its own account administration, billing, security and support. When we handle calls, messages or appointment information on a business’s instructions, that business determines the purpose of those activities and remains responsible for its notices and lawful instructions.
If a privacy request concerns a call to one of our customers, we may need that business’s instructions or assistance to identify the record and respond. We do not require you to open a Kyros account to contact us about a privacy concern.
16Business accounts and children
Kyros accounts are intended for authorized business representatives who are at least 18 years old. The service is not directed to children, and businesses must not configure it to knowingly collect information from children under 13.
A business account age requirement does not establish the age of every caller. If you believe a child’s information has been collected inappropriately, contact hello@kyroshq.com so we can investigate with the business and take appropriate action.
17Where information is processed
Kyros serves businesses in the United States. Our providers may process information in the United States and other countries where they operate. A U.S. customer address does not mean every provider processes information only in the United States.
We do not promise exclusive U.S. data residency. Transfers remain subject to applicable law, provider agreements and the additional Google API restrictions described in this policy.
18Policy updates and contact
We will keep this page aligned with the service’s actual data handling and identify material policy updates before relying on them. Contact hello@kyroshq.com with a privacy question or request.
You may also write to: KYROS AI LLC, Attn: Privacy, 9783 E 116th Street #A297, Fishers, IN 46037-2822, United States.