Privacy Policy

1. Introduction

Welcome to Karone Cognitive Enterprise ("Karone," "we," "us," "our"), operating the platform at saveonsource.com and associated subdomains (collectively, the "Platform"). Karone is a multi-tenant AI-powered business operating system that provides procurement, accounting, finance, legal, HR, and analytics services through autonomous AI agents.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Platform. It applies to all users, including:

• Tenant Administrators (businesses that subscribe to Karone)
• Employees and Contractors (individuals invited by tenants)
• Vendors and Suppliers (third parties interacting with tenants)
• Visitors (individuals browsing our website)

We respect your privacy and are committed to protecting your personal information. This Policy complies with applicable laws including PIPEDA, CCPA/CPRA, GDPR, UK GDPR, and PIPL (China).

2. Information We Collect

2.1 Information You Provide to Us

2.2 Information Automatically Collected

2.3 Information from Third Parties

2.4 Information Collected by AI Agents

3. How We Use Your Information

3.1 Core Platform Operations

• Provide, operate, and maintain the Platform and AI agents
• Process transactions (purchase requests, invoices, payments)
• Authenticate users and enforce access controls
• Generate reports and financial statements
• Communicate with you about your account, invoices, and support

3.2 AI Agent Functionality

• Train and improve AI agents based on user corrections and feedback
• Personalize recommendations (e.g., preferred vendors, expense categories)
• Automate decisions within configured approval limits
• Detect anomalies (unusual transactions, compliance risks)

3.3 Legal & Compliance

• Comply with tax laws (VAT, GST, Zakat calculations)
• Respond to legal requests (court orders, subpoenas)
• Enforce our Terms of Service
• Prevent fraud and unauthorized access

3.4 Marketing & Analytics (with consent)

• Send product updates and feature announcements (opt-out available)
• Analyze usage patterns to improve the Platform
• Conduct research on AI agent performance

4. How We Share Your Information

4.1 Within the Karone Platform

4.2 Third-Party Service Providers

4.3 Legal & Regulatory Disclosures

We may disclose your information if required by law, such as to:

• Tax authorities (CRA, IRS, HMRC, ATO, STA)
• Regulatory bodies (SEC, FINRA, PBOC, SAFE)
• Law enforcement pursuant to a valid legal request
• Courts in response to a subpoena or court order

4.4 Business Transfers

If Karone is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you via email and/or a prominent notice on the Platform.

4.5 With Your Consent

We may share your information for other purposes with your explicit consent.

5. Your Data, Your Cloud

Karone is unique: You control where your data lives.

5.1 Bring Your Own Cloud (BYOC)

If you choose to connect your own cloud storage (Azure, AWS, or GCP):

• Your files never touch Karone's servers — they are uploaded directly to your cloud account
• Karone only stores metadata (file names, timestamps, references)
• You retain full ownership and control of your data
• Karone cannot access your data without your explicit authorization

5.2 Karone Managed Storage

If you use Karone-managed storage:

• Data is stored in Azure Canada Central (default, configurable)
• Data is encrypted at rest (AES-256) and in transit (TLS 1.3)
• Data is backed up daily with 30-day retention
• You may request data export or deletion at any time

5.3 Data Residency

6. Data Retention

Upon account deletion: your data will be deleted within 30 days. Anonymized AI training data may be retained. Legal holds may override deletion (e.g., ongoing litigation).

7. Your Rights

7.1 Rights for All Users

7.2 Additional Rights by Region

7.3 How to Exercise Your Rights

• For tenant employees: Contact your Tenant Administrator first.
• For all users: Email privacy@karone.co or submit a request at saveonsource.com/privacy/request
• Response time: 30 days (GDPR) or 45 days (CCPA)

8. Cookies & Tracking Technologies

8.1 Cookies We Use

8.2 Your Choices

• Browser settings: Most browsers accept cookies by default. You can modify settings to reject cookies.
• Do Not Track: We respect Do Not Track signals.
• Global Privacy Control (GPC): We honor GPC signals as opt-out of sale/sharing.

9. Data Security

9.1 Security Measures

9.2 Breach Notification

In the event of a data breach, we will:

• Notify affected users within 72 hours (GDPR) or without unreasonable delay (other laws)
• Notify supervisory authorities as required
• Provide remediation steps and ongoing updates

10. International Data Transfers

10.1 Transfer Mechanisms

10.2 Your Choices for BYOC

If you use Bring Your Own Cloud, you choose where your data resides. No cross-border transfer occurs unless you configure it.

11. Children's Privacy

Karone is not intended for individuals under 18 years of age. We do not knowingly collect personal information from minors. If we learn we have collected information from a minor, we will delete it promptly.

12. AI-Specific Privacy Considerations

12.1 How AI Agents Use Your Data

• AI agents process your data only for the purposes described in Section 3
• AI agents do not share your data with other tenants
• AI agents do not use your data to train models for other tenants
• You may opt-out of using your data for AI training (see Section 12.3)

12.2 Large Language Model (LLM) Privacy

When you use AI agents that leverage LLMs (e.g., Virtual Lawyer, Virtual Analyst):

• Document text is sent to OpenAI (GPT-4) or Anthropic (Claude) for processing
• No data is used to train OpenAI or Anthropic models
• Data is deleted after processing (30-day retention)
• You may request zero-data retention (contact support)

12.3 AI Training Opt-Out

• Tenant administrators: Navigate to Settings → Privacy → AI Training Opt-Out
• Individuals: Contact your tenant administrator
• Opt-out does not affect core functionality.

12.4 Automated Decision-Making

Karone uses automated decision-making (AI agents) to approve purchase requests, match invoices to POs, classify expenses, and review contracts. You have the right to:

• Request human review of automated decisions
• Challenge automated decisions
• Opt-out of automated decision-making for specific tasks (contact support)

13. California Privacy Rights (CCPA/CPRA)

CCPA Request Methods

• Call: +1 (888) 555-0199
• Email: privacy@karone.co
• Web: saveonsource.com/privacy/ccpa

14. GDPR Rights (EU/UK)

UK ICO Registration: ZB123456 (pending)

15. Canada Privacy Rights (PIPEDA)

• Accountability: We are responsible for all personal information under our control.
• Consent: We obtain consent before collecting, using, or disclosing your personal information.
• Access: You may request access to your personal information.
• Challenge compliance: Contact our Privacy Officer at privacy@karone.co

16. China Privacy Rights (PIPL)

• Sensitive personal information: We obtain separate, explicit consent for processing sensitive information.
• Automated decision-making: You have the right to request an explanation and to refuse decisions made solely by automated means.
• Data localization: If you use Karone Managed Storage, data is stored on Azure China North (Beijing) or your designated location.
• Cross-border transfer: We conduct a security assessment as required by PIPL.
• Representative in China: china-rep@karone.co

17. Changes to This Privacy Policy

18. Contact Us

19. Complaints

If you believe we have violated your privacy rights, contact us first. We will respond within 30 days. If unsatisfied, escalate to:

20. Glossary