Kaiora – Privacy Policy

Last updated: November 6, 2026

1. Eligibility

Kaiora is intended only for users aged 18 and over. We do not knowingly collect data from minors under 18.

2. Information We Collect

• Account Information: name, email, region, login credentials
• Health & Activity Data: nutrition, activity, sleep, and recovery data via integrations (Apple Health, Google Fit, Garmin, Fitbit, etc.). For Garmin Connect, see Section 5.
• Device & Usage Data: device ID, IP address, browser details, usage statistics
• Payment Data:
  • For Stripe payments: limited billing information (email, country, last four digits), securely processed by Stripe. Kaiora does not store full payment details.
  • For Apple App Store or Google Play purchases: billing is fully managed by those platforms.
• Analytics & Communications: Mixpanel (product analytics) and Klaviyo (email & engagement)
• Creator data: if you are an Instagram creator we consider partnering with, see Section 6.
• Instagram messages: if you send a direct message to our Instagram account, see Section 7.

3. How We Use Data

• Deliver and personalize your app experience
• Provide activity, nutrition, and recovery insights, and answer your questions in the AI coach, using a third-party AI service (see Section 5.4)
• Improve app functionality and performance
• Communicate updates and offers
• Comply with legal obligations

Processing of health-related data occurs only with your explicit consent and in compliance with applicable laws (including GDPR, UK GDPR, and the Australian Privacy Act).

4. Data Sharing

• Service providers: Mixpanel, Klaviyo, Stripe, our hosting provider Supabase, the AI service OpenAI, which phrases insights and generates AI coach answers on our behalf (see Section 5.4), and the AI service Anthropic, which analyses Instagram creators' post captions and drafts our messages to creators on our behalf (see Section 6.3)
• Integrations you choose to connect to Kaiora
• Legal authorities when required to comply with the law or protect rights and safety

We do not sell personal or health data.

5. Garmin Connect Data

This section explains what happens to your data when you connect your Garmin Connect account to Kaiora. It adds to the rest of this policy; where the two differ for Garmin data, this section applies.

5.1 How we get it

We receive Garmin data only if you connect your Garmin Connect account in the Kaiora app. Garmin then asks your permission, and you choose which data types to share. We receive the data directly from Garmin whenever your device syncs with Garmin Connect. You can disconnect at any time (5.7).

5.2 What we collect

Depending on the permissions you grant, we receive:

• Daily activity: steps, distance, floors, active and total calories, intensity minutes, heart rate (including resting heart rate), stress levels and Body Battery.
• Sleep: sleep start and end, sleep stages, and heart rate, blood oxygen and breathing rate during sleep.
• Health measurements: heart rate variability (HRV), blood oxygen (pulse ox), respiration, skin temperature, VO2 max and fitness age.
• Body composition: weight, body fat and related measurements, if you record them in Garmin Connect.
• Menstrual cycle data: only if you track your cycle in Garmin Connect and grant this permission.
• Activities: your workouts, including type, start time, duration, distance, heart rate, pace, power, calories and the name of the device that recorded them.
• Account details: your Garmin user ID, the permissions you granted, and the access tokens that let us receive your data. We never receive your Garmin password.

5.3 How we use it

We use Garmin data only to provide Kaiora's features to you:

• showing your activity, sleep and health data in the app, together with data from your other sources;
• calculating Kaiora's own scores, such as the Kaiora sleep score and health score (these are Kaiora's calculations, not Garmin's);
• creating and adjusting your training and nutrition plans;
• generating personal insights and answering your questions in the AI coach (5.4).

We do not sell Garmin data, use it for advertising, or share it for anyone else's marketing.

5.4 AI processing

Some Kaiora features use a third-party AI service, OpenAI (OpenAI, L.L.C., USA), to process your data, including Garmin-derived data (for example last night's sleep stages or a workout's heart rate):

• Daily, sleep, workout, weekly, and onboarding insights. Kaiora's own system decides what your data means and which facts to surface — the AI is only used to phrase that pre-determined message in natural, varied language. It does not interpret your data or decide what happened.
• The AI coach. When you chat with the AI coach, it reasons over your data, including Garmin-derived data, to answer your questions. We show a disclaimer in the chat telling you the AI coach uses data derived from your connected Garmin device before you use it.
• Kai's voice. OpenAI also turns your coach Kai's replies into speech. If you ask Kai by voice, Apple or Google turns your speech into text on your phone; we don't receive or store your recording.

OpenAI processes this data on our behalf and only to generate your response. Under our agreement with them, they do not use it to train their AI models. We ask for your consent to AI processing when you connect a wearable, and you can withdraw it at any time.

5.5 Who else processes it

Besides the AI service in 5.4, Garmin data is processed only by our hosting provider, Supabase (Supabase, Inc.), which stores it in the European Union (Frankfurt, Germany). We do not share Garmin data with any other third party unless the law requires us to. If you connected Garmin before 1 October 2026, your Garmin data came to us through our previous integration partner, Terra (Terra Enabling Developers, Inc.). Terra no longer receives your Garmin data.

5.6 Storage and retention

We store Garmin data in encrypted form, in the EU (5.5), for as long as you have a Kaiora account. When you disconnect Garmin, we stop receiving new data at once; data already imported stays in your history until you delete it or your account.

5.7 Your choices

• Disconnect: in the Kaiora app, or in Garmin Connect under Connected Apps. Either way we stop receiving your data immediately.
• Delete: when you delete your Kaiora account, we delete all Garmin data we hold about you and remove Kaiora's access to your Garmin account.
• Your rights: access, correction, export and the other rights in Section 11 apply to Garmin data too.

5.8 What we send to Garmin

If you turn on “Push trainings to Garmin” in the app, we send your planned Kaiora runs and rides for the next 7 days (name, steps and targets) to your Garmin Connect calendar, so your device can guide you, and keep them up to date. We send nothing else to Garmin. When you turn the setting off, we remove the upcoming Kaiora workouts from your Garmin calendar.

6. Instagram Creators

If you are an Instagram creator, we may check whether your audience and content fit Kaiora before we contact you about a partnership. This section explains what data we use for that. It adds to the rest of this policy. You don't need a Kaiora account, and we use this data for nothing else.

6.1 What we collect

We use only Meta's official interfaces and never scrape Instagram:

• Creator Connect: if you connect your Instagram professional account on kaiora.ai/creators, we get read-only access to your profile, follower and post counts, reach and engagement, and audience statistics (country, city, age range, gender).
• Public profiles: for public Business and Creator accounts, your public profile and post statistics through Meta's Business Discovery.
• Instagram Creator Marketplace: the profile, metrics, audience statistics, past brand partners and similar creators that Meta shows brands there.
• Our conversation with you: if we contact you about a partnership, or you write to us, the messages between us on Instagram (including partnership messages) and by email, your name and email address when we write by email, and our notes on the conversation.

Audience data is always aggregated. Apart from our own conversation with you, we never receive data about individual followers, the text of comments, or messages, and we don't store your captions. From this data we create a content analysis (6.3) and a fit score.

6.2 Why we use it

Only to decide which creators to contact about a partnership, and to prepare it. A person at Kaiora makes every decision. We don't contact creators automatically, sell this data, or use it for advertising.

• Creator Connect: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time (6.5).
• Public profiles, Creator Marketplace and our conversation with you: our legitimate interest in finding suitable partners and talking to them about a partnership (Art. 6(1)(f) GDPR). You can object at any time (6.5).

6.3 AI processing

For public profiles and Creator Marketplace data, we send your username, bio and recent captions to Anthropic's Claude API (Anthropic, PBC, USA), which classifies your content, for example its languages, topics, sponsored posts and brand safety. Anthropic processes this data only on our behalf and does not use it to train its models. We keep the classification, not the captions. Creator Connect data is not sent to an AI service.

When we write to you, Claude may draft our next message from our conversation so far. A person at Kaiora reviews and sends every message. Anthropic processes the conversation only on our behalf and does not use it to train its models.

6.4 Storage and retention

Our hosting provider, Supabase (Supabase, Inc.), stores creator data in the European Union (Frankfurt, Germany). Apart from Anthropic (6.3), we share it with no one unless the law requires us to. For transfers outside the EU, see Section 9.

• Creator Connect: until you remove Kaiora's access or ask us to delete your data.
• Public profiles and Creator Marketplace: deleted within 90 days, unless we start a partnership with you.
• Our conversation with you: for as long as we are in contact or work together. If we don't start a partnership, we delete it 180 days after our last contact.

6.5 Your choices

• Remove access: in Instagram, go to Settings and activity → Website permissions → Apps and websites, and remove Kaiora. We then delete your Creator Connect data automatically.
• Object or ask for deletion: email info@kaiora.ai with your Instagram username.
• Your rights: the rights in Section 11 apply to creator data too.

7. Messages to Kaiora on Instagram

If you send a direct message to our Instagram account @kaiora.ai, we keep a copy of the conversation so our team can answer you. This section explains what we keep. It adds to the rest of this policy. You don't need a Kaiora account.

7.1 What we store

• Your messages and our replies, with the time each was sent. For photos, videos, shares and voice messages we store only a note that one was sent, not the content.
• Your Instagram username and the ID Instagram gives you for our account.

We receive this through Meta's official interface when a message arrives, and by reading our inbox the same way. If you write about your health, that is part of your message, so please don't send us health details on Instagram that you don't want us to keep. For questions about your data in the app, email info@kaiora.ai.

7.2 Why we use it

• To answer you and keep our team's conversations in one place: our legitimate interest in replying to people who contact us (Art. 6(1)(f) GDPR), or, where you ask about your Kaiora subscription, our contract with you (Art. 6(1)(b) GDPR).
• To notice creators among the people who write to us. If we would like to talk to you about a partnership, Section 6 applies from then on.

Only people at Kaiora read these messages. We don't send them to an AI service, sell them or use them for advertising. Instagram is run by Meta, which processes your messages under its own privacy policy.

7.3 Storage and retention

Our hosting provider, Supabase (Supabase, Inc.), stores the copy in the European Union (Frankfurt, Germany). We delete each message automatically 90 days after it was sent. If we start a partnership conversation with you, it is kept as described in Section 6.4. For transfers outside the EU, see Section 9.

This copy is not linked to your Kaiora account: deleting your account does not delete it. Deleting our copy also doesn't remove the conversation from Instagram itself.

7.4 Your choices

• Ask for deletion or object: email info@kaiora.ai with your Instagram username.
• Your rights: the rights in Section 11 apply to these messages too.

8. Data Retention

Your data is retained while your account remains active or as necessary for legal or operational purposes. You may request deletion at any time (see Section 11). For Garmin data, see Section 5.6; for creator data, Section 6.4; for Instagram messages, Section 7.3.

9. International Transfers

Data may be stored or processed in the United States or other countries with appropriate safeguards (e.g., Standard Contractual Clauses).

10. Security

We employ encryption, secure access controls, and monitoring to protect your information. However, no online service can guarantee absolute security.

11. Your Rights

• Access, correct, or delete your data
• Withdraw consent or object to processing
• Request data portability
• Lodge a complaint with your local authority

Contact: info@kaiora.ai

12. Cookies & Tracking

Our site uses cookies and similar technologies for analytics and personalization. You can manage preferences through your browser settings or the privacy settings in the app.

13. Updates

We may update this policy periodically. Continued use of Kaiora constitutes acceptance of the revised policy.

14. Contact

Kaiora Inc.
1111B S Governors Ave, STE 40887
Dover, DE 19904, USA

Email: info@kaiora.ai