This document is a draft. Its effective date has not been set, so it is not yet in force. Do not rely on it.

Kairos Privacy Policy

Version 1.0 Last updated [DATE]

Familiare Management LLC ("Kairos", "we", "us") operates the Kairos platform, a customer relationship management system for insurance and financial professionals. This policy explains what we do with personal information.

Our Terms of Service govern our agreement with subscribing organizations. Where this policy and section 9 of those Terms describe the same thing, they are meant to agree. If they ever conflict, section 9 of the Terms governs as between us and a subscriber.

1. The two kinds of information, and why the difference matters

This is the most important section in this policy, because it decides who you should contact about your information.

Information about our subscribers and their users. If you are a subscribing organization, or a person who uses Kairos as part of one, we hold information about you because you are our customer. For this information we are the business responsible for it, and the rights described in section 9 apply to you directly against us.

Information about end clients. Kairos is software that insurance and financial professionals use to manage their own client relationships. The information about those clients and prospects belongs to the professional or their firm, not to us. We process it on their instructions, as their service provider. We do not decide what goes into it, we do not use it to market to anybody, and we do not sell it.

If you are a client of an advisor who uses Kairos, and you want to see, correct or delete your information, contact that advisor or their firm. They hold the relationship with you and the legal obligation to answer you. We will help them answer, and we will not act on your information independently of them. If you do not know who holds your information, write to info@familiaremgmt.com and we will try to help you work it out, though we may not be able to tell you which of our subscribers holds a record about you.

2. Information we collect about subscribers and users

You give us:

• Account information: name, business email address, telephone number, job title, role, and the organization you belong to.
• Billing information: billing contact, billing address, and a payment reference. Payment card details are handled by our payment processor and we do not store card numbers.
• Configuration: your organization's settings, team structure, pipelines, email templates, branding and automation rules.
• Credentials you choose to connect: for example your own data enrichment provider keys, or authorization to send email from your mailbox. We store these encrypted and use them only to carry out the actions you ask for.
• Anything you send us in support requests.

We collect automatically:

• Usage information: which features you use, when, and for how long.
• Technical information: internet protocol address, browser type and version, operating system, and timestamps.
• Security and audit records: sign-in events, administrative actions, and acceptance of our Terms of Service, including the version accepted, the date and time, and the network address it came from.

3. Information we process on behalf of subscribers

When a subscriber uses Kairos, the system holds information about that subscriber's own clients, prospects and recruits. Depending on what the subscriber chooses to put in, that can include:

• name, contact details and address;
• date of birth, age, marital status, employment and occupation;
• financial information relevant to a needs analysis, such as income, assets, existing coverage, retirement goals and expenses;
• policies, applications and deal history;
• notes written by the advisor, and records of calls, messages and appointments; and
• information retrieved from third party data providers about prospects, such as job title, employer and professional history.

We hold this because our subscriber put it there. We use it to run the Service for them, and for the limited further purposes in section 5. We do not use it to market anything to anybody, and we do not sell it.

4. How we use information

• To provide the Service: to operate it, authenticate users, carry out the actions you ask for, and store your data.
• To support you: to answer questions and investigate faults.
• To bill you: to take payment and keep accounting records.
• To keep the Service secure: to detect and prevent unauthorized access, abuse and fraud.
• To improve the Service: described in section 5.
• To communicate with you: service notices, security notices, changes to our Terms, and billing messages. These are part of the Service and are not marketing. We will only send you marketing about Kairos if you have asked for it, and you can stop it at any time.
• To meet our legal obligations, and to establish or defend legal claims.

5. Improvement, modeling and learning

We build and improve statistical and machine learning models so that Kairos gets better at the work our subscribers do. Those models help rank prospects, suggest next actions, flag incomplete records, improve research features and support new features that depend on learning from patterns.

What the models learn from. We compute coarse, categorical values from the data in the Service and use those. They are ranges rather than exact figures, categories rather than free text, counts rather than content, and flags rather than detail. An income band rather than an income. A product type rather than a policy number. A count of recorded facts in a category rather than the facts.

What they never learn from. We do not use any of the following for modeling or learning:

• names of individuals or households;
• email addresses, postal addresses or telephone numbers;
• government identifiers, including Social Security numbers and driver licence numbers;
• financial account numbers, policy numbers or card numbers;
• free text written by advisors, including notes and internal commentary;
• the contents of messages, call recordings or call transcripts; or
• uploaded documents.

What crosses between subscribers. A model we train is used across the Service, so improvements learned from aggregate patterns benefit everyone using it. Where we show a subscriber insights or benchmarks drawn on data beyond their own organization, those are computed only from the coarse values described above, are aggregated across at least 20 distinct organizations or individuals, and are never presented in a way that identifies another subscriber or any individual. We do not disclose one subscriber's data, or values attributable to them, to another subscriber in any form that identifies anybody.

Our commitments. We do not sell personal information. We do not share it for cross-context behavioural advertising. We will not attempt to re-identify any individual, household or organization from these derived values, we will not permit anyone else to do so, and we maintain reasonable technical and organizational measures to prevent it. We will not use a subscriber's data to contact their clients on our own behalf, and we will not use it to build a book of business for ourselves or for any other subscriber.

Opting out. A subscribing organization can opt out of contributing to this, using the control in its settings or by writing to info@familiaremgmt.com. Two honest points about opting out. It is prospective: we stop using the organization's data going forward, but we cannot remove the contribution of data already used from a model that has already been trained. And it is reciprocal: an organization that opts out of contributing also stops receiving the cross-subscriber insights described above. Everything else about the Service continues to work normally, and opting out does not affect pricing, access or support.

6. Who we share information with

Service providers. We use other companies to run Kairos. Each gets only what it needs for its part, and is contractually required to protect it and use it only for that purpose. The categories are:

Within a subscriber's own organization. Administrators and managers can see records belonging to people below them, as the subscriber configures. That is a decision the subscriber makes, not us.

Between organizations. We do not give one subscribing organization access to another's data, whatever business relationship exists between them outside the Service, unless both configure it deliberately.

Legal and protective disclosure. We may disclose information if required by law, or where necessary to protect our rights, the Service, or the safety of any person. Where we are legally permitted to tell the affected party first, we will.

Business transfer. If we are involved in a merger, acquisition or sale of assets, information may transfer as part of it. Any acquirer remains bound by the commitments in section 5.

7. We do not sell your information

We do not sell personal information, and we have not in the preceding twelve months. We do not share personal information for cross-context behavioural advertising, and we do not use it for targeted advertising of any kind. We do not knowingly sell or share the personal information of anyone under sixteen.

8. Cookies and similar technologies

We use cookies and local browser storage to keep you signed in, remember your preferences, and keep the Service secure. We use a small amount of analytics to understand how the Service is used, in aggregate. We do not use advertising cookies and we do not allow third party advertising trackers in the Service.

Your browser can block or delete cookies. If you block the ones we use to keep you signed in, the Service will not work.

9. Your rights

If you are a subscriber or a user of a subscribing organization, you may ask us to:

• tell you what personal information we hold about you, and where we got it;
• give you a copy of it in a portable format;
• correct it if it is wrong;
• delete it, subject to information we must keep for legal, accounting or security reasons; and
• limit how we use it.

Depending on where you live you may also have the right to object to certain processing, to withdraw consent you have given, and to appeal a decision we make about your request.

How to exercise them. Write to info@familiaremgmt.com. We will acknowledge within ten days and respond within forty five days, and if we need longer we will tell you why and complete within ninety days. We may need to verify who you are before we act, and we will only ask for what is necessary to do that. An authorized agent may act for you with written proof.

We will not discriminate against you for exercising any of these rights. We do not offer financial incentives in exchange for personal information.

If you are a client of an advisor who uses Kairos, see section 1. Your request goes to that advisor or firm. We will support them in answering you within the timescales their own obligations require.

California. California residents have the rights described above under the California Consumer Privacy Act as amended. The categories of personal information we collect, the sources, the purposes and the categories of recipient are in sections 2, 3, 4 and 6 of this policy. We do not sell or share personal information as those terms are defined in that Act.

10. Security

We maintain administrative, technical and physical safeguards appropriate to the nature of the information and the size of our operation. These include encryption of data in transit, encryption of stored credentials, access controls, separation of each organization's data, and logging of administrative actions.

No system is perfectly secure and we do not claim otherwise. If we become aware of unauthorized access to or disclosure of personal information, we will notify affected subscribers without undue delay, give them the information we reasonably have, and support them in meeting their own notification obligations.

11. How long we keep information

• Subscriber and user account information: for as long as the subscription is active.
• Data in the Service: for as long as the subscription is active. After a subscription ends we keep it for 90 days so the subscriber can export it, and then delete it. Routine backups expire in the ordinary course after that.
• Billing and accounting records: as long as tax and accounting law requires.
• Security and audit records, including Terms of Service acceptances: for as long as needed to establish or defend a legal claim.
• Coarse derived values and trained models: derived values computed before a subscription ended do not identify any individual or organization and may be retained. As explained in section 5, anything already incorporated into a trained model cannot be extracted from it.

12. Where information is held

We hold information on infrastructure in the United States. If you access Kairos from elsewhere, your information will be transferred to and processed in the United States.

13. Children

Kairos is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under sixteen as our own customer. A subscriber may record information about a minor as part of a family or beneficiary record, in which case that information is the subscriber's responsibility under section 1.

14. Changes to this policy

We may update this policy. We will change the version and date at the top, and we keep previous versions available. Where a change materially affects how we use personal information, we will give subscribers notice before it takes effect, in the same way we give notice of a change to our Terms.

15. Contact

Familiare Management LLC 5939 Babbitt Ave, Encino, CA 91316 info@familiaremgmt.com

If you are unhappy with how we have handled a privacy request, write to us first. If you are a California resident you may also complain to the California Privacy Protection Agency or the California Attorney General.