Privacy policy

1. Who we are

ARCSCALE Group (FZC), Sharjah Research Technology and Innovation Park, Block B, Office B59-076, Sharjah, United Arab Emirates (licence 11814). Contact: privacy@klui.ai.

2. What we collect

• Account. Google sign-in gives us your email and display name. We do not collect a date of birth, phone number, or password of our own.
• Your content. Chats, uploads, project files, study material, memory you turn on, and reports you submit.
• Voice. If you use voice input, audio is sent to a speech-to-text provider. Klui does not keep the audio file.
• Billing. Plan, status, provider, and period dates. Card details stay with Mamo or Ziina. We do not vault cards.
• Usage. Weekly API-credit usage so we can apply plan limits. We do not run ad analytics or advertising SDKs.
• Device and security data. Appearance and similar preferences stored on your device, plus limited IP and request information used for delivery, security, and rate limiting.
• Desktop (Windows beta). If you use Klui Anything, screen or voice you choose to share can be sent so the desktop features work.

We do not collect GPS from the device. Camera photos you upload can contain location in EXIF; we strip EXIF/GPS before we keep those images. We do not collect video or calendar data.

3. Why we use it

To run the product: sign you in, generate replies, search the web when you ask, store files, meter usage, take payment, handle reports, and delete or export your account when you ask. Staff can see account email, plan, payments, and content in a report, to operate Klui and handle abuse.

We do not sell personal information. We do not share it for cross-context advertising. We honor Global Privacy Control as the default for everyone, because there is no ad-tech to turn off. See /.well-known/gpc.json.

4. Legal bases

Where data-protection law requires a legal basis, we rely on: performing our contract with you to provide Klui; our legitimate interests in securing, maintaining, and improving the service; legal obligations; and consent where we specifically ask for it. You may object to legitimate-interest processing or withdraw consent where applicable.

5. Models and training

We send prompts, conversation history, attachments the model needs, and tool results to OpenRouter, which routes them to model hosts. We do not route requests to providers OpenRouter classifies as ones that “may use prompts for training.” Some providers “may retain prompts, but do not use them for training” (abuse, legal, or operational logging). That is allowed. We do not promise zero retention. OpenRouter’s labels are their catalog, not a warranty of each host’s law.

Klui does not train its own models on your chats.

6. Memory

Memory is off until you turn it on. It starts with messages you send after that. Klui does not build memory from AI replies, uploaded files, images, tool results, generated documents, or temporary chats. You can edit or clear it in Settings.

7. Search

If a turn uses web search, the query and fetched page text go to a search provider (SearXNG and/or Jina and/or Brave) so we can answer you. We do not keep a shared search-query cache and we do not share raw queries across users. There is no daily search-count cap; search cost is part of weekly usage.

8. Files

Uploads and generated images live on Cloudflare R2. Uploaded photos are stored without EXIF/GPS. Generated illustrations are cartoon explainers, not photoreal people. We do not currently stamp C2PA on those files.

9. Sharing and international processing

We share data only with the service providers needed for the purposes above, when you direct us to share it, or when required by law. See our Subprocessors page. Providers may process data outside your country, including outside the UAE. Where applicable law requires safeguards for an international transfer, we use the required contractual or other lawful mechanism.

10. How long we keep it

Account content remains until you delete the conversation, file, or account. Unused pending uploads may remain for up to seven days before cleanup. We may retain limited billing, security, dispute, or legal records when required, and service providers may have their own documented retention periods. Deletion from backups can take longer than deletion from the live service.

11. Your rights

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your data; restrict or object to processing; withdraw consent; and complain to your local data-protection authority. Settings → Account provides data export and account deletion. For another request, email privacy@klui.ai. We may need to verify your identity before acting on a request.

12. Children

Klui is 18+. We do not knowingly keep accounts for anyone under 18.

13. Security

We use signed-in APIs, access controls, and private object storage to protect product data. No online service can guarantee absolute security. Report a privacy or security concern to privacy@klui.ai.

14. Changes

We may update this policy as Klui or the law changes. We will update the date above and provide additional notice when a change materially affects your rights and applicable law requires it.