Privacy Policy

2. Data we collect

We collect only the data needed to run the service:

• Account data: your name, work email address and password. Passwords are never stored in plain text — they are stored as a hash through Supabase Auth.
• Signing in with Google or Microsoft (optional): if you choose to sign in with one of those providers instead of creating a password, we receive from them only your name and verified email address. kalu never receives your password and gains no access to your mail, your calendar or any other data in that account. You can keep using email and password if you prefer.
• Organization profile (radar): the information your organization provides about itself — industry, markets, competitors and topics of interest — used to shape its news feed and, unless your organization opts out, to improve Laya (section 3 bis).
• Usage signals: views, impressions, clicks through to the original source, reading time and how far down a story you scroll, saves, likes and “Not interested” marks, and your votes on the business plays kalu suggests (“I back it”, “Not interested” and “Doesn't work”). When you share a story we record the channel (WhatsApp, SMS, email, your phone's share menu or copying the link) and, if you choose to tell us, what kind of person you are sending it to: someone on your team, a client, a prospect, your company's leadership or someone else — never their contact details. The link you share carries a random code that lets us count how many times it was opened each day, and that count stores no IP address, browser or identity of whoever opens it. These signals are used to rank your organization's feed and plays and, unless you or your organization opt out, to improve Laya, kalu's news filter (sections 3 bis and 5). They are never sold or shared with third parties.
• Billing data: payments are processed by Stripe. kalu never stores card numbers; we keep only subscription references and billing history.
• Technical logs: IP addresses, browser type and timestamps, generated in the ordinary course for security and troubleshooting.
• Site measurement data: Google Analytics records page views, visit source and technical device data, tied to a random identifier rather than to your name. On the public site — and only there — Microsoft Clarity additionally records scrolling and clicks on the page, with on-screen text masked. If you decline measurement cookies — or, when you visit us from the European Economic Area, the United Kingdom or Switzerland, until you accept them — measurement runs without cookies and without identifying you.
• Waiting list (kalu.lat/lista-de-espera): while access is by invitation, we collect your name, work email, company, role, company size, industry, your phone number if you choose to leave one, the package you are interested in, and your answer to an open question about what you would like to hear before your competitors do. We also keep the campaign parameters (`utm_*`) and the page you arrived from, so we know which channel brought you. They serve one purpose: deciding whether your company joins the early-access group, and being able to write to you.
• Commercial prospecting data (collected indirectly): to contact companies that might use kalu we process name, role, company and work email address obtained from publicly available sources and from the Apollo.io platform. You did not give us that data, so the first email you receive from us carries this notice and a direct way to ask us never to write again. If you ask, we stop and delete the contact.
• Protection-related technical data: when you submit a public form we record your IP address for a bounded period to enforce per-IP and per-domain limits, and we process the Cloudflare Turnstile token that proves you are not an automated program.
• iOS application: the native app collects exactly the same data as the site and nothing more. It includes no third-party SDKs, does not use the advertising identifier (IDFA), does not track your activity across other apps or websites, and requests no system permissions — no camera, no location, no contacts, no photos. The site measurement described above does not run inside the app.

3. Purposes

We do not collect sensitive personal data. No ethnic origin, no health status, no beliefs, no sexual preferences, no biometrics: kalu does not need them to work and there is no field in the product where you could give them to us. If you send them to us anyway inside a free-text answer, we delete them.

Primary purposes. These give rise to and are necessary for our relationship with you; without them we cannot provide the service:

• Running the waiting list: receiving your entry, assessing whether your company fits the early-access group, writing to you with the decision and, if you are in, issuing your invitation.
• Providing the service: creating and managing your account, grouping users by corporate email domain, and building and ranking your organization's feed.
• Billing: processing your subscription and invoicing, and telling you before anything about what you are charged changes.
• Asking for and analyzing your feedback if you are in the early-access programme: it is what is asked of you in exchange for that price, and it is why the programme exists.
• Sending you notifications you switched on: push notifications and email digests, which you can turn off at any time.
• Security and compliance: preventing unauthorized access, handling incidents and meeting tax and legal obligations.

3 bis. Secondary purposes, and how to refuse them

The following purposes are not necessary to provide the service, and you can refuse them without it affecting anything you signed up for:

• Commercial prospecting: contacting you to offer kalu, including email sent to contacts obtained from publicly available sources and from Apollo.io.
• Information about kalu: product news, content and commercial communications.
• Internal statistics: aggregate analysis of platform usage and of how our acquisition channels perform. It does not identify individuals.
• Improving Laya, kalu's news filter, with your organization's business profile and your team's reactions. Laya is kalu's own model for judging whether a news item matters to your business (section 5), and it learns from three things: your organization's business profile, its commercial DNA (what it sells and to whom, its industries, segments, markets and geographies, its value proposition, its keywords, its competitors, and the names and industries of its clients); the original headline and excerpt of public news items; and a label for each story and organization that sums up how your team reacted to it: whether they opened the story or its original source, how much of it they read, whether they liked it or marked it “Not interested”, whether they saved or shared it and whether the shared link was opened, and their “I back it” and “Not interested” votes on the plays built from it. The label does not say who reacted: your user ID never leaves kalu's database. It never uses the name or email address of anyone on your team, passwords, billing data or IP addresses, nor the contact details of whoever you shared a story with, which kalu never learns. Laya is a single model for every organization: what it learns from yours improves the filter for all of them, without any of them seeing your business profile or your team's reactions. This purpose takes effect on October 7, 2026, ten days after the email in which we announced it to you, and it only uses reactions recorded from that day on.

How to refuse, at any time and without giving reasons: write to us at our contact email with the subject “No to secondary purposes”, or reply to any of our commercial emails asking us not to write again. All our commercial communications also carry an unsubscribe link. You can also opt out of improving Laya from Settings → Privacy: an administrator of your organization does so for the business profile and the reactions of the whole team, and each person for their own reactions. Your refusal takes effect immediately and does not affect operational email — billing, security and access — which you will keep receiving while your account is active. For Laya, nothing your refusal covers goes into any later training run, and whatever the model had already learned from it stops having any influence as of the next monthly retraining (section 7).

4. Service providers (sub-processors)

We rely on a small set of providers to run kalu, each with access limited to what is strictly necessary.

Every provider on this list is a PROCESSOR, not a third party. They process your data on kalu's behalf, on our instructions and under a data-processing agreement: handing them data is a *remisión* under Mexican law, not a transfer, and therefore does not require your consent. kalu does not transfer your personal data to third parties who would use it for their own purposes, and does not sell it. The only possible exceptions are the ones the law imposes: a competent authority requiring it in writing, or a corporate reorganization — and in that second case we would tell you first.

Several of these providers operate in the United States. See section 9.

• Supabase — hosting and database (US-East region, United States). Stores accounts, organization profiles and usage signals.
• Stripe — payment processing. Receives billing and card details directly; kalu never sees or stores them.
• Resend — transactional email (sign-in messages, notices and digests).
• Artificial-intelligence model provider with web search (United States) — news search and drafting (see section 5). Receives no personal data whatsoever: only your organization's topical radar terms.
• Cloud computing provider (United States) — infrastructure that runs kalu's own models: Laya, which judges whether a news item is relevant to your organization, and one that turns the text of your profile and of the news into numerical representations to rank your feed by closeness of meaning (see section 5). To judge and rank, it receives the text of your organization's business profile — what it sells, to whom, the names of its clients and competitors, and the markets where it operates — together with the text of the public news items. From the time the purpose in section 3 bis takes effect, it also trains Laya on kalu's behalf at least once a month with the data described there, leaving out the data of anyone who has opted out. It receives no name, email, password or billing data of yours. It processes all of this under its data-processing agreement, for kalu and not for itself: it does not use any of it to train models of its own or anyone else's.
• Model repository (United States) — it keeps Laya's weights, meaning the model each training run produces, in a private repository (see section 5). The weights do not contain the training texts as records that can be looked up.
• Vercel — hosting of the web application.
• Google (Google Tag Manager and Google Analytics 4) — site usage measurement. From the European Economic Area, the United Kingdom and Switzerland it writes no cookies until you accept them in the banner; from every other country it writes them until you decline. With consent denied, measurement runs in cookieless mode without identifying you.
• Microsoft (Clarity) — heatmaps and screen replays of the public site only: the home page, the blog, the topic pages and the legal documents. Never inside the app: your feed, your commercial DNA, your client portfolio and the admin console are never recorded. On-screen text travels masked, it is governed by the same banner as Google's measurement — and stops entirely if you decline — and its advertising signals stay denied at all times.
• Sentry — application error logging (programming faults, screens that fail to load). Receives the technical detail of the failure plus your internal user and organization identifiers, never your name or your email. It writes no advertising cookies and does not track you across sites: it exists so that we learn about a breakage before you have to report it.
• Apollo.io — commercial prospecting platform (United States). It is the source of the professional contact data described in section 2 and the channel through which prospecting email is sent. If you join the waiting list, we pass your name, work email address, company and role to Apollo.io in order to send you the waiting-list communications you asked for, and to stop sending you the prospecting email that no longer applies. It receives no kalu customer data: your account, your radar and your activity on the platform are never sent to it.
• Cloudflare (Turnstile) — verification that whoever submits a public form is a person. Receives the challenge token and your IP address, nothing else.
• Calendly — scheduling of the call (Calendly, LLC, United States). It lets you pick the time of the call you asked for. When you open our booking page — the button to pick a time shown after you send your request, or the link we send you — Calendly receives your name, your email address and the reference of your request, which travel in the link so that you do not have to type them. If you book, it also receives the time you choose and whatever you write in its form, and we read them from Calendly to attach the appointment to your request. If you book without having sent a request, or with an email address other than the one on your request, we open a demo request with what the booking carries: your name, your email address, the phone number you leave for reminders, the time and the campaign parameters of the link. If you cancel, the reason you write reaches our team. That request is handled like any other: if we discard it, it is deleted automatically after 60 days, and if you ask us to delete it, we do.
• Unsplash — fallback image library used to illustrate news. Receives only topical search terms, no personal data.
• Your team's channel (optional, only if your organization turns it on): an administrator at your company can connect a Slack, Microsoft Teams, Discord, Google Chat or Cisco Webex channel — or any address of their own, such as an internal Mattermost or an automation flow — to receive the daily digest there. In that case we send that destination the headlines and summaries of the stories — never anyone's personal data — and it is your company, not kalu, that decides which one it is and who reads it. It can be disconnected from Settings at any time.

5. Use of artificial intelligence

kalu relies on artificial-intelligence systems to operate. Models from an artificial-intelligence provider with web search, in the United States, search for news, draft the summaries and article bodies, and generate the strategy notes and company research you read on the platform.

What we send those models is your organization's topical radar terms, the names of the companies and industries you follow, and the text of the public news items being processed. We do not send your name, your email, your password or your billing data, and your data is not used to train third-party models.

In addition, two models of kalu's own run on the infrastructure of the cloud computing provider in section 4, in the United States: Laya, which judges whether each news item is relevant to your organization, and another that ranks it by closeness of meaning to your profile. To do so they receive your organization's business profile — what it sells, to whom, its clients, its competitors and its markets — and the text of the public news item. The one that ranks is a public model that kalu does not retrain.

Laya was first trained only on public news and on fictitious companies. From the time the purpose in section 3 bis takes effect, and subject to the opt-outs set out there, it also learns from your organization's business profile and from your team's reactions, summed up in a label for each story that does not say who reacted. It never learns from the name or email address of anyone on your team, from passwords, from billing data or from IP addresses. That computing provider trains it on kalu's behalf without using that data to train models of its own or anyone else's, and the resulting weights are kept in the private model repository in section 4.

AI-generated content may contain errors, omissions or incorrect interpretations. That is why every news item is published with its sources linked and attributed: the original source is always the authority on its own content. kalu is an informational service and is not legal, financial or investment advice.

We do not make automated decisions that produce legal effects concerning you or similarly significantly affect you. Your feed ranking is a content recommendation, and you can correct it at any time from your organization's radar and settings.

6. Push notifications and email digests

With your consent, we send browser push notifications and email digests with the news most relevant to your organization.

You can turn them off at any time from your account settings, and every email we send includes an unsubscribe link. Strictly operational emails (for example, password resets or billing notices) are sent for as long as your account is active.

7. Data retention

• Radar and organization data: kept while the subscription is active. If you cancel, 30 days after access ends the radar and everything we learned about your organization — its business profile, clients, watched accounts, feed affinity, reading signals, plays and reports — are deleted, unless you reactivate before then. If you come back afterwards, you start from scratch. Your user account, billing records and the cancellation record are kept.
• Usage signals: pruned on a rolling basis after 90 days — saved stories excepted, see below; we keep only aggregates that do not identify individuals. When a share is pruned, its recipient type and the open count of its link go with it. Votes on plays do not expire after 90 days: they are kept for as long as your account and your organization exist, and are deleted along with either one.
• Stories you save: kept for as long as you do not remove them. A save is not a measurement of your reading but a bookmark you created, and it is also what keeps a story readable after it falls outside your package's archive window. You can remove any of them from the story itself, and all of them at once from Settings → Preferences.
• Waiting-list entries: kept for 12 months from sign-up. After that, entries that did not turn into an account are deleted or anonymized — we keep only the aggregate count of how many people arrived through each channel, which identifies nobody. If you ask us to delete yours sooner, we do.
• Commercial prospecting contacts: kept while the campaign is running and, in any case, no longer than 12 months without a reply. If you ask us not to write again, we keep only your address on a suppression list — which exists precisely so that we never contact you again — and delete the rest.
• Feed stories: pruned after 90 days, except for the ones you saved.
• Billing records: kept for as long as applicable tax law requires.
• If you delete your account: deletion is immediate and permanent — it does not wait for those 30 days and there is no grace period. Your profile, your saved stories and your reading history go; if you were also the last person in your organization, the whole organization goes with it — radar, feed, stories and history — and the subscription is canceled. Only the billing records that tax law requires us to keep survive.
• What Laya learns: the training examples drawn from your organization are put together at training time and are not stored anywhere; all that remains of them is the model's weights (section 4). Laya is retrained at least once a month on the data as it stands that day, so anything deleted (by you, by the 90-day pruning or under any other timeframe in this section) and anything a refusal covers stops influencing the model as of the next monthly retraining.

8. Your rights

If you are in Mexico, you may at any time exercise your ARCO rights — access, rectification, cancellation and objection — under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares, as well as withdraw your consent and limit the use or disclosure of your data.

If you are outside Mexico, we honor equivalent GDPR-style rights: access, rectification, erasure, portability and objection.

Erasure takes no paperwork. You can delete your account yourself, without writing to anyone and without waiting for a reply, from Settings → Account → Delete account, both on kalu.lat and in the iOS app. Deletion happens there and then; what exactly is erased is set out in section 7.

To exercise the other rights, write to our contact email from the email address associated with your account, stating the right you wish to exercise. We will respond within the legally applicable timeframes.

9. International transfers

Your data is stored on Supabase servers located in the United States (US-East region) and shared with the providers listed in this policy, some of which operate outside Mexico.

These transfers take place under data-processing agreements with each provider and are necessary to deliver the service you contract. The one exception is training Laya on the cloud computing provider, with its weights kept in the model repository: it serves the secondary purpose in section 3 bis, and you can refuse it. By using kalu, you consent to these transfers under the terms of this policy.

10. Security measures

We protect your data with technical and organizational measures reasonable for a service of this nature:

• Encryption in transit (TLS) on every connection to the platform and to our providers.
• Row-level security (RLS) in the database, so each organization can only reach its own information.
• Least-privilege access internally: only staff who need personal data can access it, and only to operate the service.
• Incident notification: if a security breach affecting your data were to occur, we will notify you as required by applicable law.

11. Cookies and local storage

kalu uses cookies and local storage that are strictly necessary to run the service — keeping you signed in and remembering preferences such as the interface language — which by their nature require no consent. One precision is worth making: kalu writes no cookies of its own; your session lives in your browser's local storage, not in a cookie.

We also use measurement cookies from Google Analytics 4, loaded through Google Tag Manager, to understand how the site is used. If you visit us from the European Economic Area, the United Kingdom or Switzerland, none is written until you accept them in the banner shown on your first visit. From every other country — including Mexico, where the law grants you a right to object rather than requiring your prior consent — cookie-based measurement starts on your first visit, and the same banner lets you decline at any time: cookies stop being written the moment you do. With measurement declined, Google's consent mode keeps it cookieless and non-identifying. You can change your decision at any time from "Cookie preferences": in the footer of the home page and of every legal document, and inside the app under Settings → Legal. When you decline, measurement stops and any measurement cookies already on your device are deleted at that moment.

We use no ad trackers and we do not sell your data to advertising platforms. Google's advertising consent signals — ad storage, ad user data and ad personalization — stay denied in every country and at all times, whether or not you accept measurement. Product signals (views, saves, reading time) are first-party and serve only to rank your organization's feed and improve the service, Laya included, as described in section 3 bis.

The full inventory — every cookie and every storage key, who sets it, what it is for and how long it lasts — lives in the Cookie Policy, at `kalu.lat/cookies-policy`.

12. Changes to this policy

We may update this policy as the service or applicable law changes. The current version will always be published on this page with its update date. When a change alters what this policy promises, we will email you at least ten days in advance, before applying it to your data.

Continuing to use the service after a change takes effect means you accept the updated policy.

13. Governing law and contact

This policy is governed by the laws of the United Mexican States, in particular the Ley Federal de Protección de Datos Personales en Posesión de los Particulares published in the Diario Oficial de la Federación on 20 March 2025 and the rules derived from it.

For questions, requests or complaints about your personal data, write to us at our contact email. If you believe your request was not properly handled, or that your rights were breached, you may turn to the Secretaría Anticorrupción y Buen Gobierno, the authority to which the 2025 law entrusted the protection of personal data held by private parties.