Privacy Policy

summary. We collect what we need to verify who you are (a legal requirement for a financial service), run your account and payments, keep the Services safe, and meet our regulatory obligations. We do not sell your personal information. Your data is protected with strong security, kept only as long as the law and legitimate operations require, and you have real rights over it — described below, including who to complain to if we get it wrong.

1. Who We Are: Your Data Controller

Kairo operates through separate companies in each market. The company responsible for your personal information (your “data controller”) depends on where you live:

Kairo group companies provide technology and operational services to one another under intercompany agreements containing data-protection terms equivalent to those we require of third-party processors. Wherever “Kairo”, “we” or “us” appears below, it means your data controller as set out above.

2. Information We Collect

We do not collect precise GPS location, and we do not access your contacts, photos or files except where you explicitly share something with us (for example, uploading a document).

3. How We Use Your Information: and Our Legal Bases

In Canada, we collect, use and disclose personal information with your knowledge and consent, and for purposes a reasonable person would consider appropriate, in accordance with PIPEDA. We never use your information for automated decisions with legal effect without human review rights.

4. Kai: Our In-App Assistant

• Conversations with Kai are processed to answer you and, where you explicitly confirm an action, to carry it out. Every payment through Kai requires your explicit, authenticated confirmation. Kai never moves money on its own.
• Kai conversation transcripts are automatically deleted within 24 hours. Records of transactions you actually made (through Kai or otherwise) are kept as required by financial-services law, deleting the conversation never deletes your money records.
• Your conversations are not used to train third-party AI models.

5. Identity Verification & Biometric Data

When you verify your identity, our provider Sum and Substance Ltd (Sumsub) processes your ID document and a selfie/liveness capture on our instructions, which involves biometric facial-comparison data. This is done to meet our legal obligations to verify who you are and to protect you from impersonation. Biometric verification data is processed and retained by Sumsub under a data-processing agreement and applicable law; we receive the verification result and document data, not raw biometric templates for our own use. Where your local law requires specific consent for biometric processing, we ask for it in the verification flow.

6. Who We Share Information With

We do not sell personal information, and we do not share it with advertisers. We share it only with:

Every service provider acts on our documented instructions under contracts requiring confidentiality, security, breach notification and use limited to the services they provide us.

7. International Transfers

Kairo operates across borders, so your information may be processed in countries other than your own — principally Canada (where customer data for the Canadian service is hosted), the United Kingdom/EU (identity verification), Nigeria (group engineering and operational support, and Nigerian banking partners), and the United States (certain infrastructure providers). Wherever information crosses borders we use recognised safeguards appropriate to your market, contractual data-protection clauses with every recipient, adequacy findings where available, and the NDPA’s transfer conditions for Nigeria. Canadian end-user data remains hosted in Canada; group engineering access is remote, controlled and logged, and Canadian end-user data is not stored in Nigeria.

8. How Long We Keep Information

When retention ends, information is deleted or irreversibly anonymised. Closing your account does not shorten legally required retention, but it stops all processing except what the law requires.

9. Your Rights

Subject to your local law, you can: access the personal information we hold about you; correct inaccurate information; delete information (where legal retention duties do not override); object to or restrict certain processing; receive a portable copy of information you provided; and withdraw consent where processing is based on consent. Exercise any of these at compliance@kairo.finance; we respond within the timelines your local law sets (30 days in most of our markets), free of charge except where the law allows a reasonable fee for repeated requests. We will never discriminate against you for exercising your rights.

Complaints

• Canada: Office of the Privacy Commissioner of Canada (OPC): priv.gc.ca.
• Nigeria: Nigeria Data Protection Commission (NDPC): ndpc.gov.ng.
• United Kingdom (when services launch): Information Commissioner’s Office (ICO): ico.org.uk.
• We would appreciate the chance to resolve your concern first, but you may contact your authority directly at any time.

10. Security

We protect your information with encryption in transit and at rest, strict role-based access on a least-privilege basis with multi-factor authentication for our personnel, comprehensive access logging with quarterly reviews, and continuous security monitoring, under a board-approved risk management framework. No system is perfectly secure; if a breach occurs that creates a real risk of significant harm to you, we will notify you and the relevant authorities as the law requires.

11. Cookies & Similar Technologies

Our website uses strictly necessary cookies to function, and analytics cookies only with your consent, managed through the cookie banner. We do not use third-party advertising cookies. The app uses device storage for session security and your preferences. Full details: [Cookie Policy Doc].

12. Children

The Services are for adults 18 and over. We do not knowingly collect information from anyone under 18; if we learn we have, we delete it and close the account.

13. Marketing

We send marketing only with your consent, and every message includes a working unsubscribe. Opting out never affects service communications we must send (transaction confirmations, security alerts, legal notices).

14. Changes to This Policy

We will post any updated version here with a new effective date, and for material changes we will notify you in the app or by email before they take effect. Continued use after the effective date means the updated policy applies.

15. Contact

Privacy questions, rights requests and complaints: compliance@kairo.finance . Canadian users may also write to Kairo Finance Limited, 1216-200 Old Carriage Dr, Kitchener, Ontario N2P 0C7, Canada; Nigerian users to KAIRO KONNECT LIMITED, Nigeria, RC 9622481 · 131, Obafemi Awolowo Way Road, Ikeja, Lagos State, Nigeria.