Last updated 1 October 2026

Privacy Policy

Kio is operated by Autowork AI (“we”, “us”), based in United Arab Emirates. This policy explains what we collect when you visit our website or use Kio, why we collect it, who we share it with and how you can exercise your rights. It applies to the website at this domain and to the Kio application.

Who this policy covers

There are three kinds of people whose data passes through Kio:

Visitors to this website.
Merchants — businesses and their team members who create a Kio account to answer their customers.
End customers — people who message a merchant on Instagram, WhatsApp, Telegram or the merchant’s website, where Kio replies on the merchant’s behalf.

For end-customer conversations, the merchant decides what Kio is used for and is the controller of that data; we process it on the merchant’s instructions under our Terms of Service. If you are an end customer with a question about your data, contact the business you messaged first; you can also write to us at the address at the end of this page.

What we collect

Account data

When a merchant signs up we collect a name, email address and password through our authentication service (Amazon Cognito, part of Amazon Web Services); we never see or store the password itself. Team members invited to a workspace are collected the same way. We record the business name, sector and the answers given during onboarding.

Business knowledge

Merchants upload documents, menus, price lists, policies, photos and website content so that Kio can answer from them. This content is stored for the merchant’s workspace only and is used solely to generate replies and reports for that merchant.

Conversations and customer records

When a merchant connects a channel, we receive the messages end customers send to that channel and the replies sent back: the message text, media, timestamps, the platform’s user identifier, and — where the platform provides it — the customer’s display name, handle and profile picture. Kio keeps a transcript per conversation, a customer record (contact details the customer shared, tags and notes the merchant adds) and, when a conversation closes, a short summary of stable facts about the customer (for example a standing order or an allergy) so later replies can take them into account.

Channel credentials

Connecting Instagram, WhatsApp or Telegram gives us an access token for that account. Tokens are encrypted at rest (AES-256-GCM) and used only to receive and send messages for that merchant. Credentials merchants add for their own integrations (payment links, booking tools, order lookups) are stored the same way and never shown back in full.

Billing

Payments are processed by Stripe. We receive the subscription status, plan, invoice references and the last four digits of a card; we never receive or store full card numbers. Stripe’s own privacy policy governs the payment itself.

Usage and device data

We log requests to our servers (IP address, browser, time, page or endpoint), product usage inside the app (which features were used, reply counts, latency) and diagnostics for each AI reply, to run the service, meter plans, detect abuse and fix problems.

Website analytics and advertising

On the public website we may use Google Analytics and the Google Ads tag to understand how visitors find us and whether our advertising works. These set cookies and send an identifier, page views and conversion events (such as creating an account) to Google. You can opt out with Google’s browser add-on or by blocking cookies for this site; the product works without them.

How we use data

To provide Kio: receive messages, generate replies, take the actions a merchant has approved, and hand conversations to the merchant’s team.
To generate AI replies and summaries. Message text and business knowledge are sent to large-language-model providers (Amazon Bedrock and Google Gemini) for processing; these providers do not use the content to train their models under the terms we hold with them.
To notify merchants of handoffs, health problems and reports, by dashboard, email, push notification or WhatsApp as they choose.
To bill subscriptions and enforce plan limits.
To secure the service, prevent abuse and comply with law.
To improve the product, using aggregate and diagnostic data.

We do not sell personal data. We do not use end-customer conversations to advertise to end customers.

Meta platform data

Data received from Instagram and WhatsApp through Meta’s APIs is used only to provide Kio to the merchant who connected the account, in line with Meta’s Platform Terms and Developer Policies. We do not use it for any other purpose, do not sell it, and delete it when the merchant disconnects the channel or deletes their account (see Data deletion).

Who we share data with

We use these service providers to run Kio. Each processes data only on our instructions:

Amazon Web Services — hosting, storage, email delivery, account authentication (Cognito) and the Bedrock AI models.
Google — the Gemini models for merchant copilots and memory summaries; Analytics and Ads on the public website.
Stripe — payments and subscriptions.
Meta Platforms and Telegram — the messaging channels a merchant connects.
Integrations a merchant chooses to connect (for example Shopify, Calendly or Stripe payment links) receive only the data needed for the action the merchant configured.

We may also disclose data when required by law, to protect our rights or the safety of others, or as part of a merger or acquisition, in which case this policy continues to apply.

International transfers

Our infrastructure runs on Amazon Web Services and may be located outside the country you are in. Where we transfer data internationally we rely on our providers’ standard data protection terms.

Retention

Account and workspace data: for as long as the account exists, then deleted within 30 days of deletion.
Conversations and customer records: for as long as the merchant keeps them; merchants can delete a customer’s record and memory at any time.
Channel tokens: until the channel is disconnected or the account deleted.
Billing records: as long as tax and accounting law requires.
Server logs and diagnostics: up to 90 days.

Security

Data is encrypted in transit and at rest. Channel and integration credentials are sealed with AES-256-GCM under versioned keys. Access to production systems is limited to staff who need it. No system is perfectly secure; if we learn of a breach affecting you, we will notify you as the law requires.

Your rights

Depending on where you live you may have the right to access, correct, export, restrict or delete personal data we hold about you, and to object to certain processing. Merchants can export their customer records to CSV from the app and delete their account from Settings. Instructions for every deletion path are on the Data deletion page. For anything else, email privacy@autowork.ae and we will respond within 30 days.

Cookies

We use strictly necessary cookies to keep you signed in and to remember your preferences, and — on the public website only — analytics and advertising cookies from Google as described above. The app stores your display preferences in your browser’s local storage.

Children

Kio is a business tool and is not directed at children under 16. We do not knowingly collect data from them; if you believe we have, contact us and we will delete it.

Changes

We will post any material change to this policy here and update the date at the top. If a change significantly affects how we use your data we will also tell merchants by email.

Contact

Autowork AI, United Arab Emirates.
Privacy requests: privacy@autowork.ae
Everything else: support@autowork.ae