Privacy Policy

Cairo AI ("Cairo," "we," "us," or "our") is operated by Cairo Technologies AB, a company registered in Sweden. We provide AI-powered customer support automation for e-commerce businesses.

Data Protection Officer: privacy@cairo.ai

Address: Cairo Technologies AB, Stockholm, Sweden

2.1 Account Data (You as the User)

When you create an account, we collect:

• Name and email address
• Company/store name
• Billing information (processed by our payment provider)
• Account preferences and settings

2.2 Integration Data

When you connect your accounts, we access:

• Email (Gmail): Email content, sender/recipient addresses, timestamps, thread information, and attachments for customer support emails
• E-commerce (Shopify): Order data, customer information, product details, shipping/tracking information, and refund status
• OAuth tokens: Securely stored credentials to maintain your integrations

2.3 End-Customer Data

Through your integrations, we process data about your customers, including:

• Names and email addresses
• Order history and purchase details
• Shipping addresses
• Support inquiries and communication history

Important: For this data, you are the data controller and Cairo is the data processor. See our Data Processing Agreement.

2.4 Learning and Feedback Data

To improve the AI for your account, we collect:

• Your approval, edit, or rejection decisions on AI drafts
• Edits you make to AI-generated responses
• Patterns and preferences derived from your feedback
• Confidence scores and accuracy metrics

2.5 Usage Data

We automatically collect:

• Log data (IP address, browser type, access times)
• Feature usage and interaction patterns
• Performance and error data

Specifically:

• Each customer account has isolated data storage
• AI models are personalized per-account based on your feedback
• No cross-tenant learning or data sharing occurs
• Aggregated, anonymized statistics may be used for service-wide improvements

We share data only in these circumstances:

5.1 Sub-processors

We use trusted service providers to operate Cairo. See our Sub-processors page for a complete list.

5.2 AI Providers

Email content is processed by our AI providers (e.g., Anthropic) to generate responses. These providers:

• Process data only as instructed by us
• Do not use your data to train their general models
• Are bound by strict data processing agreements

5.3 Legal Requirements

We may disclose data if required by law, court order, or to protect our rights and safety.

5.4 Business Transfers

In the event of a merger, acquisition, or sale, your data may be transferred to the successor entity under equivalent privacy protections.

Upon account deletion, we delete or anonymize your data within 30 days, except where retention is required by law.

We protect your data with:

• Encryption: All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• Access controls: Role-based access with multi-factor authentication for our team
• Infrastructure: SOC 2 compliant cloud infrastructure hosted in the European Union
• Monitoring: 24/7 security monitoring and incident response
• Audits: Regular security assessments and penetration testing

Your data is primarily stored and processed in the European Union. When data is transferred outside the EU (e.g., to AI providers in the US), we ensure appropriate safeguards:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements with all sub-processors
• Assessment of third-country data protection laws

Under GDPR, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Limit how we process your data
• Portability: Receive your data in a structured format
• Object: Object to processing based on legitimate interests
• Withdraw consent: Where processing is based on consent

To exercise these rights, contact us at privacy@cairo.ai. We will respond within 30 days.

You also have the right to lodge a complaint with your local data protection authority. In Sweden, this is Integritetsskyddsmyndigheten (IMY).

We use cookies and similar technologies for:

• Essential cookies: Required for the Service to function (authentication, security)
• Analytics cookies: To understand how you use the Service (with your consent)

You can manage cookie preferences through your browser settings or our cookie consent banner.

Cairo is designed for business use and is not intended for individuals under 18 years of age. We do not knowingly collect data from children. If you believe we have collected data from a minor, please contact us immediately.

We may update this policy from time to time. We will notify you of material changes via email or through the Service. The "Last updated" date at the top indicates when changes were made.

For privacy-related questions or to exercise your rights:

• Email: privacy@cairo.ai
• Address: Cairo Technologies AB, Stockholm, Sweden

We aim to respond to all inquiries within 30 days.