Privacy Policy

This Privacy Policy explains how Caliradi LLC ("we", "us", or "our"), the operator of Caliradi.ai (the "Service"), collects, uses, shares, and protects your personal information when you visit our website at caliradi.ai or use our products.

We are committed to protecting your privacy and complying with applicable data-protection laws including the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA / CPRA), and equivalent laws worldwide.

1. Information we collect

Information you provide directly

• Account & contact data: name, email address, phone number, company name, job title.
• Payment data: processed securely through Stripe. We do not store full credit-card numbers on our servers.
• Communications: messages you send to our chatbot Kaira, support emails, and form submissions.
• Google sign-in data: if you choose to sign in with Google, the basic profile information Google shares with us — see Section 6.

Information collected automatically

• Usage data: pages visited, click events, time spent, language preference, referring URL.
• Device data: browser type, operating system, screen size, IP address (anonymized for analytics).
• Cookies and similar technologies: see Section 4 below and our Cookie Policy.

2. How we use your information

We use your personal information to:

• Provide, operate, and improve the Caliradi Service.
• Process payments and manage your plan.
• Match you to the right plan via our AI assistant Kaira.
• Send transactional emails (welcome, receipts, security alerts).
• Send marketing communications, where you have opted in or where allowed by law (you can unsubscribe at any time).
• Detect, investigate, and prevent fraudulent or abusive activity.
• Comply with legal obligations.
• Improve the Service using aggregated, de-identified usage telemetry (which features are used, error rates, response times) across accounts. We never train AI models on your customer data or on the content in your account (see our Security page).

3. Legal bases for processing (GDPR)

If you are in the European Economic Area, United Kingdom, or Switzerland, we rely on these legal bases:

4. Cookies and tracking

We use cookies and similar technologies for essential site functions, analytics, and advertising attribution. You can accept or reject non-essential cookies via the cookie banner shown on first visit, or change your preferences at any time.

Our third-party tracking services include:

• Meta Pixel (Facebook / Instagram) — for ad attribution and remarketing. Loads only after you accept cookies. Meta Privacy Policy
• Google Analytics 4 — for traffic analytics with IP anonymization. Loads only after you accept cookies. Google Privacy Policy
• Microsoft Clarity — product analytics including session replay and heatmaps: it records how you move, scroll and click on our pages so we can find broken layouts and confusing steps. Text you type into form fields is masked by Clarity before it leaves your browser. Loads only after you accept cookies. Microsoft Privacy Statement
• Baidu Analytics (百度统计) — traffic analytics for visitors reaching us from Chinese search and social platforms, where Google Analytics is not reachable. This means some visit data is processed on servers in mainland China. Loads only after you accept cookies. Baidu Analytics Terms
• PostHog — product analytics (which features get used). Loads only after you accept cookies. PostHog Privacy Policy
• Umami — privacy-first traffic analytics (page views, referrer, country, device type). This one loads before the cookie banner, because it is cookieless: it stores nothing on your device, does not retain your IP address, and cannot follow you across other websites, so it does not require cookie consent. If your browser sends a Global Privacy Control signal, it is not loaded at all. Umami Privacy Policy
• Sentry — crash and error reporting. This one loads before the cookie banner, because an error that happens while the page is still loading can only be captured while the page is still loading; it receives the error, the page URL and browser type. It is not used for advertising or profiling. Sentry Privacy Policy
• Caliradi first-party analytics (selfserve.caliradi.ai) — our own page-view and click counter, run on our own infrastructure and not shared with anyone. Loads only after you accept cookies. Covered by this policy.
• HubSpot — marketing and CRM tooling behind some of our forms. HubSpot Privacy Policy
• Our messaging and scheduling platform — powers the live-chat bubble and the call-booking calendar embedded on our pages. It loads when you open chat or book a call, and receives what you type there plus the usual connection data (IP, browser). Contact us at the address below if you need the processor named for a data-protection request; we will provide it.
• Stripe — for payment processing and fraud prevention. Stripe Privacy Policy
• Google Sign-In — provides the "Sign in with Google" button on our customer sign-in pages, such as console.caliradi.ai and selfserve.caliradi.ai. It is not loaded on caliradi.ai itself. Because it is part of signing in, it loads on those sign-in pages regardless of your cookie choice, and Google receives the usual connection data (IP, browser) when it loads. We use it only to sign you in, never for advertising or tracking — see Section 6. Google Privacy Policy

If you decline cookies, everything above except Umami (cookieless, and not loaded at all under Global Privacy Control), HubSpot on our homepage (not loaded for Chinese-language or mainland-China visitors), Sentry, Google Sign-In on our sign-in pages, and the embedded chat/booking widgets stays switched off — we do not load it and it receives nothing about you.

See our full Cookie Policy for the complete list of cookies we use.

5. Sharing your information

We never sell your personal information. We share it only with:

• Service providers who help us operate the platform. They fall into these categories: cloud hosting and CDN, AI model providers, customer-record systems, payment processing (Stripe), email delivery, and internal team notification tools. A current, named list is available on request — email support@ydygroup.com. Each has signed a Data Processing Agreement with us.
• Advertising partners (Meta, Google) — only event signals (e.g., "page viewed", "checkout started"), never your name, email, or phone.
• Legal authorities — when required by law, court order, or to protect rights, safety, or property.
• In a business transfer (merger, acquisition, sale of assets), with notice to you in advance.

SMS / text messaging data

6. Sign in with Google

On our customer sign-in pages, such as console.caliradi.ai and selfserve.caliradi.ai, you can choose to create an account or sign in with your Google Account. This section explains what we receive from Google when you do, and what we do with it.

What we receive from Google

Sign in with Google asks only for Google's basic sign-in permissions (your sign-in identity, email address and basic profile). When you use it, Google shares with us:

• your name;
• your email address, and whether Google has verified it;
• your profile picture (a link to the image hosted by Google);
• your Google account ID (a unique number Google uses to identify your account); and
• your language setting, if your Google Account provides one.

Signing in with Google does not give us your Google password, and it does not give us access to your Gmail, Google Drive, Google Calendar, contacts or any other data in your Google Account. We do not receive tokens that would let us use Google services on your behalf. If a product offers to connect other apps to your account, that is a separate, optional step with its own permission screen; it is not part of Sign in with Google.

How we use it

We use this information only to:

• create your account, or link Google sign-in to an existing account that uses the same email address;
• sign you in and keep you signed in, including when you move from one of our products to another;
• show your name and profile picture in your account, and set your account's default language;
• contact you about your account and the service you signed up for.

Your Google account ID is used only to recognise you the next time you sign in with Google.

How we store and protect it

We keep this information with your account record on our servers. Depending on the product, we store your email address and name, and on some products also your Google account ID, the link to your profile picture and your preferred language (English, Chinese or Spanish). Some of our sign-in pages are run by service providers that host parts of the Service on our behalf; on those pages the same sign-in information is received and stored on their servers for us. On our own servers it is protected in the same way as the rest of your account data (see Section 11); on a provider's servers it is covered by that provider's security and confidentiality obligations to us.

How we share it

We do not sell information we receive from Google, we do not use it for advertising, and we do not send it to our analytics or advertising tools. We share it only:

• with service providers that host parts of the Service on our behalf — cloud hosting, email delivery, internal team notifications, our own customer management system, and, only if you choose to buy a plan, our payment processor (which receives your email address to prepare your checkout); and
• when required by law.

How long we keep it, and how to delete it

We keep this information for as long as your account exists; after an account is closed we keep only the records described in Section 8. You can ask us to delete your account and the Google information linked to it at any time by emailing support@ydygroup.com; on selfserve.caliradi.ai you can also use Request account deletion under Privacy & data in your account. We verify the request, delete the information (except records the law requires us to keep, such as payment records) and confirm by email. We respond within 30 days.

You can also remove Caliradi's access to your Google Account at any time at myaccount.google.com/permissions. Google will then ask for your permission again if you later choose to sign in with Google. Removing access does not delete information we already hold — email us as above if you want that deleted too.

7. International data transfers

Caliradi is operated from the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S. We rely on the EU Standard Contractual Clauses (SCCs) and equivalent safeguards for cross-border data transfers.

8. Data retention

We keep your personal information only as long as needed for the purposes described in this Policy. Specifically:

• Account data: for the lifetime of your account, plus 12 months after closure for tax / audit purposes.
• Payment records: 7 years (legal requirement).
• Marketing emails: until you unsubscribe.
• Analytics data: 14 months (Meta & GA4 default).
• Chat transcripts with Kaira: 90 days, then anonymized.

9. Your rights

Depending on your location, you have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Delete your information (right to be forgotten)
• Restrict or object to certain processing
• Receive a copy of your data in a portable format
• Withdraw consent at any time
• Lodge a complaint with a supervisory authority

California residents (CCPA/CPRA): you also have the right to know what categories of personal information we collect, to opt out of the sale or sharing of personal information (we do not sell), and to non-discrimination for exercising your rights.

To exercise any right, email support@ydygroup.com. We respond within 30 days.

10. Children's privacy

Caliradi is a B2B service intended for use by businesses and adults aged 18 and older. We do not knowingly collect personal information from children under 13 (or 16 in the EU). If you believe a child has provided us information, contact us immediately and we will delete it.

11. Security

We implement industry-standard security measures including TLS encryption in transit, AES-256 at rest, role-based access controls, and regular security audits. We are working toward SOC-2 Type II certification. No system is 100% secure, but we work hard to protect your data.

12. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will post the new Policy here and update the "Last updated" date. For significant changes, we will notify you via email or a prominent site notice at least 14 days in advance.

13. Contact us

Questions, concerns, or requests about this Privacy Policy or your personal information: