Privacy Policy

This policy covers Airis, an AI-powered enterprise knowledge assistant operated by Kerra Innovation Hub Limited ("Kerra Hub", "Airis", "we", "us"). It applies to the Airis web app at airisinsight.com (including organisation subdomains and custom domains), the Airis Assistant desktop app for macOS and Windows, the Airis Assistant Chrome extension, Airis chatbots and embedded widgets, and Airis on WhatsApp, Telegram, SMS, and email. It explains what information we collect, how we use and share it, and the choices you have.

1. About Airis and Our Role

Airis helps people search and get answers from their organisation's knowledge, build a searchable knowledge base from documents, transcribe, translate, and summarise meetings, ask questions about what is on their screen, run AI agents and automations, query databases they connect, search the web, and run chatbots on websites, WhatsApp, and Telegram. It can be used by individuals and by organisations with team members and administrators.

For individual accounts, Kerra Hub is responsible for the personal information processed in your account. For organisation accounts, the organisation decides who is invited, which integrations are connected, and what content is added; for the content and member information it puts into Airis, the organisation is the data controller and Kerra Hub processes that information on its behalf. Kerra Hub remains responsible for account, billing, security, and service-operation information.

When an organisation runs an Airis chatbot on its website, WhatsApp, or Telegram, the people who chat with it are that organisation's customers or visitors. The organisation is responsible for telling them how their information is used, and questions about those conversations should go to the organisation first.

2. Information We Collect

Account and profile information. Your name, preferred name, email address, phone number (optional), profile picture, password (stored only as a one-way hash), organisation, team, role, and preferred language.

Organisation information. Organisation name, subdomain or custom domain, branding, teams, members, roles, permissions, plan, credit limits, and settings.

Chat and knowledge-base content. Messages you send to Airis, its answers and the sources it cites, files you attach in chat, and documents you or your administrator upload or sync into a knowledge base, together with the text and vector embeddings Airis extracts from them so they can be searched.

Meeting content. Live transcripts, translations, meeting titles, AI-generated summaries and action items, and links to recordings (see Section 4).

Screenshots. Images of your screen or browser tab that you choose to send to Airis with a question (see Sections 4 and 5).

Agents and automations. Agent and workflow settings, instructions, triggers, schedules, run inputs and outputs, logs, reports, and review decisions. Depending on the agents you use, this can include your CV, career details, job preferences, tailored CVs, cover letters, and application status (job search agent); target countries and the personal circumstances you provide for visa and relocation research (relocation agent); draft social media posts and schedules for platforms such as Instagram, Facebook, and YouTube (content and marketing agents); and the business records, contacts, and instructions you give sales, support, collections, recruiting, and bookkeeping agents.

Database connections. If your organisation connects its own database to a data agent, or stores its Airis data in its own database, we keep the connection details (encrypted) and process the query results Airis retrieves to answer questions.

Messaging identities. The WhatsApp or SMS phone number you verify so you can chat with Airis and receive reviews and approvals on it, plus a hashed one-time verification code.

Chatbot and channel settings. Chatbot names, welcome and fallback messages, colours, logos, embed keys, WhatsApp numbers, and Telegram bot tokens (stored encrypted).

Chatbot end users. When someone chats with an organisation's Airis chatbot, Airis processes their messages and the replies, and stores their WhatsApp phone number or Telegram chat ID with the time of their last message, so it can reply within that platform's rules. A website widget may also receive information the organisation passes to Airis to identify a signed-in visitor.

Support communications. Your name, email address, subject, message, and our replies when you contact support.

Payment information. Payments are processed by Paystack and Stripe. Airis does not receive or store full payment-card numbers; we keep a record of your plan, subscription status, transactions, credit purchases, and credit balance.

Technical and usage information. To operate, secure, and troubleshoot Airis, we collect IP address, browser and device type, signed-in devices and sessions, timestamps, pages and features used, AI model usage and credit consumption, document ingestion events, audit logs of administrative actions, and error and crash reports. We do not use this information for advertising.

Integrations. If you connect a third-party service, Airis processes only the information needed for that integration: Google sign-in and Google Drive (see Section 3); Zoho WorkDrive, to save recordings, chat attachments, and agent documents and to sync selected files into a knowledge base; WhatsApp (Meta) and Telegram, to run chatbot channels, deliver notifications, and let you chat with Airis and approve agent work; and Slack and Microsoft Teams, to post alerts into a channel you choose. Airis can only post to that Slack or Teams channel; it cannot read messages there. You can disconnect any integration in your account or organisation settings.

3. Google User Data

This section explains exactly what data Airis collects from your Google Account, how we use it, who we share it with, how we protect it, and how long we keep it. Airis only accesses Google user data after you choose a Google feature and approve the permissions on Google's consent screen.

Google data we collect

Sign in with Google (scopes: https://www.googleapis.com/auth/userinfo.email, https://www.googleapis.com/auth/userinfo.profile). We collect your Google account ID, email address, name, and profile picture.

Personal Google Drive (scopes: https://www.googleapis.com/auth/drive.file, https://www.googleapis.com/auth/userinfo.email). We collect the email address of the Google account you connect, and the name, type, size, ID, link, and contents of only (a) the files Airis itself creates in an "Airis" folder in your Drive and (b) the files you explicitly pick with Google's file picker. Airis cannot see, list, or open any other file in your Drive.

Organisation Google Drive (scopes: https://www.googleapis.com/auth/drive.readonly, https://www.googleapis.com/auth/drive.file). When an organisation administrator connects a Drive for their organisation, we collect the names, types, sizes, IDs, and folder structure of files the administrator browses, and the contents of the documents the administrator chooses to add to the organisation's knowledge base. We also collect the IDs and links of the files Airis creates in per-member Airis folders in that Drive.

Access tokens. For each connection we receive an OAuth access token and refresh token from Google.

How we use Google data

We use Google user data only to provide the features you can see in Airis:

Your Google account ID, email, name, and picture are used to create your Airis account, sign you in, show your name and picture in the app, and tell you which Google account is connected.

Files you pick, or an administrator chooses, are downloaded to Airis servers, converted to text, split into passages, and turned into vector embeddings so Airis can search them and answer your questions with citations back to the file. When you ask a question, the relevant passages are sent to the AI model that writes the answer.

The drive.file permission is used to save your meeting recordings, chat attachments, and documents produced by your agents (such as reports, tailored CVs, and cover letters) into the Airis folder in your Drive, and to open those files again when you play or download them in Airis.

The drive.readonly permission is used only so an administrator can browse their organisation's Drive and choose documents for the knowledge base. Airis never uses it to create, edit, move, share, or delete files.

Access tokens are used only to make these requests to Google on your behalf.

We do not use Google user data for advertising, to build user profiles, for credit or lending decisions, or to train or improve general-purpose AI or machine-learning models.

How we share Google data

We do not sell Google user data, and we do not share it with anyone for their own use. It is shared only with these service providers, only to provide the feature you asked for: Google Cloud, which hosts our servers and database; and the AI model providers we use (such as Google Gemini, OpenAI, and Anthropic), which receive only the passages from your files that are relevant to a question you ask, so they can write the answer. If your organisation has set Airis to use its own AI provider account, the passages go to that provider instead. Within an organisation, documents added to its knowledge base are available to the members the administrator gives access to. We may also disclose data if the law requires it.

How we store and protect Google data

Google user data is stored in our database on Google Cloud. All connections to Google and to our servers use TLS encryption. Google OAuth access and refresh tokens are encrypted at rest, are only used by our servers, and are never sent to your browser or apps. Each organisation's data is kept separate, access within an organisation is controlled by roles and permissions, and access to our production systems is restricted to authorised staff. Recordings and other files Airis saves to Google Drive are stored in that Drive, not on our servers.

How long we keep Google data and how to delete it

Your Google account ID, email, name, and picture are kept for as long as you have an Airis account. Text and embeddings from Drive files are kept until the file is removed from the knowledge base. Access tokens are kept until you disconnect Google Drive.

You can delete Google data at any time: remove a file from the knowledge base to delete its text and embeddings; delete a recording, attachment, or conversation in Airis to delete the Drive file Airis created for it; disconnect Google Drive in your Airis settings to revoke Airis's access with Google and delete the stored tokens; or revoke access at any time from your Google Account permissions page. To delete your account and all associated Google data, email support@kerrahub.com; we delete it within 30 days, except where the law requires us to keep it.

Limited Use disclosure

Airis's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Humans at Kerra Hub do not read your Google user data unless you give us permission for a specific item, it is necessary for security purposes such as investigating abuse, it is necessary to comply with the law, or the data has been aggregated and anonymised for internal operations.

4. Airis Assistant Desktop App

The Airis Assistant desktop app for macOS and Windows helps during meetings and other work. It only captures audio or your screen when you start listening or ask it to, and your operating system asks for your permission first.

Audio and transcription. While listening is on, the app captures your microphone and, where supported, your computer's audio output (the other people in a call). The audio is streamed to our speech-to-text providers, Deepgram or Soniox, to produce a live transcript that can tell speakers apart. If you turn on live translation, transcript text is sent to our speech or AI provider to translate it. When you save a meeting, its transcript, summary, and action items are stored in your account under Call Sessions. If you have connected Google Drive or Zoho WorkDrive, the recording is uploaded there and Airis keeps only its link.

Screenshots. When you press the capture shortcut or ask about your screen, the app takes a screenshot of the display you have chosen and sends it, with your question, to an AI provider to generate an answer. It does not take screenshots in the background.

Voice profiles. To label who is speaking, the app can create a voice fingerprint from short audio samples. Voice fingerprints are biometric information. Our servers compute them without storing the audio or the result, and the profiles are stored only on your device. Remembering other people's voices is off unless you turn it on, and you can delete voice profiles at any time.

Local history. Your recent assistant conversations (up to 100) and app settings are stored only on your device. The assistant window is designed to be hidden from screen recording and screen sharing.

You are responsible for telling meeting participants and getting their consent before you record, transcribe, or create voice profiles of them, as the law where you and they are located requires.

5. Airis Assistant Chrome Extension

The Airis Assistant Chrome extension lets you ask Airis questions while you browse and during web meetings. When you ask a question that needs it, the extension captures an image of the tab you are viewing and sends it, with your question, to Airis; it does not capture tabs in the background. On Google Meet, Zoom, Microsoft Teams, and Webex it adds an Airis panel to the page, and it does not read your messages or meeting content there unless you start a feature that uses them. It stores your sign-in and settings in Chrome's extension storage. The extension's use of information follows the Chrome Web Store User Data Policy, including its Limited Use requirements.

6. How We Use Information

We use information to provide Airis features (answering questions, searching documents, connected databases, and the web, running agents and automations, and producing transcripts, translations, and summaries); to run chatbots and channels for organisations and deliver reviews, approvals, and updates on the channels you choose; to measure AI usage, manage plans, trials, and credits, and process payments; to operate, maintain, troubleshoot, and improve the service; to send service notices, security alerts, verification codes, and support replies; and to detect and prevent fraud, abuse, and security incidents and comply with the law.

We do not sell personal information or use your content for advertising. We do not use your content, meeting audio, screenshots, or Google user data to train general-purpose AI models. We use AI providers through their business APIs, whose terms restrict them from using the content we send to train their models.

7. How We Share Information

Within your organisation. If you use Airis through an organisation, its administrators may be able to see organisation-level information, team membership, usage and credit information, agent runs, and content stored in the organisation, depending on its settings and permissions. When an agent pauses for review or approval, the work is sent to the reviewers set for that step on the channels they have chosen.

Service providers. We share information only with providers that help us run Airis, and only as needed to provide the feature you use: AI providers such as Google (Gemini), OpenAI, Anthropic, and other model providers offered in Airis (or the provider your organisation chose, if it uses its own keys); Deepgram and Soniox for speech-to-text; Tavily, Firecrawl, and Brave Search for web search; Meta (WhatsApp Cloud API) and Telegram for chat channels and notifications; Termii and eBulkSMS for SMS; Resend for email; Slack and Microsoft Teams for alerts you set up; Paystack and Stripe for payments; and Google Cloud and Cloudflare for hosting, databases, background tasks, and network security.

Job sites and social platforms. Airis does not submit job applications or publish social media posts for you. It prepares them, and you submit or post them yourself on the platform, which then handles your information under its own terms.

Legal reasons and business transfers. We may disclose information if required by law or valid legal process, or to protect the rights, property, or safety of Airis, our users, or others. If Kerra Hub is involved in a merger, acquisition, or sale of assets, information may be transferred as part of it, subject to this policy. We may also share information for another purpose when you ask us to or give your consent.

We do not sell personal information or share it with advertising networks.

8. Legal Bases for Processing

Where the Nigeria Data Protection Act 2023 or similar laws apply, we process personal information to perform our contract with you or your organisation; with your consent for optional features such as integrations, meeting recording, voice profiles, and WhatsApp or SMS messaging (which you can withdraw at any time by turning the feature off); for our legitimate interests in keeping Airis secure, preventing abuse, and improving reliability; and to meet legal obligations such as keeping financial records.

9. Your Controls and Choices

You can update your profile, connect or disconnect integrations, delete documents, chat conversations, attachments, and call sessions, remove a verified WhatsApp or SMS number, choose which channels you receive reviews on, and review or revoke your signed-in devices from your settings. In the desktop app you can stop listening at any time, delete voice profiles and local history, and revoke microphone and screen recording permissions in your operating system settings. You can revoke Airis's Google access from your Google Account permissions page; this does not by itself delete content already synced into Airis. To delete your Airis account and associated data, email support@kerrahub.com.

10. Data Retention

Chat history, attachments, meeting transcripts, summaries, agent runs, reports, job applications, relocation research, and content drafts are kept until you or your organisation delete them or the account is deleted. Knowledge-base documents, with their extracted text and embeddings, are kept while they remain in the knowledge base. Recordings saved to Google Drive or Zoho WorkDrive stay there until deleted from that service. Voice profiles and desktop assistant history stay on your device until you delete them or uninstall the app. Chatbot conversation records are kept for as long as the organisation keeps the chatbot or channel. Temporary agent memory, review links, and verification codes expire automatically. Billing records are kept as needed for accounting, tax, and legal purposes.

When an account is deleted, we delete or anonymise its data within a reasonable period, except where we must keep it for legal, security, or financial record-keeping purposes. Copies in backups are overwritten in the normal backup cycle.

11. Bring Your Own Database

Some plans let an organisation store its Airis data in its own PostgreSQL database, or connect a database for a data agent to query. The organisation controls that database, including where it is hosted, who can access it, and how long data is kept in it. Airis stores the connection details encrypted and uses them only to provide the features the organisation has enabled.

12. Security

We protect information with TLS encryption in transit; encryption at rest for OAuth tokens, integration credentials, bot tokens, webhook links, and database connection details; one-way hashing of passwords and verification codes; separation of each organisation's data; role-based permissions; immediate revocation of signed-out sessions; audit logs for administrative actions; and restricted access to production systems. No system is completely secure, so we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and the relevant authorities as the law requires.

13. Cookies and Local Storage

Airis uses cookies and your browser's local storage to keep you signed in, remember your preferences (such as theme and language), and keep the service secure. The desktop app and Chrome extension use their own local storage for the same purposes. We do not use them for advertising or cross-site tracking.

14. Your Rights

Where the Nigeria Data Protection Act 2023 or similar laws apply, you may have the right to be informed about how your data is used; to access, correct, or delete it; to object to or restrict certain processing; to withdraw consent; to receive a portable copy of your data; and not to be subject to decisions based solely on automated processing that significantly affect you. To make a request, email support@kerrahub.com. We may need to verify your identity, and we aim to respond within 30 days. If your data was added by an organisation that uses Airis, we may refer your request to that organisation and help it respond. You can also complain to the Nigeria Data Protection Commission or the data protection authority where you live.

15. International Processing

Airis and its service providers may process or store information outside the country where you live, including in the United States and the European Union. Where required, we rely on appropriate safeguards, such as contractual data-protection commitments from our providers.

16. Children's Privacy

Airis is a business and productivity tool and is not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided personal information to Airis, contact us and we will review and delete it where appropriate.

17. Changes

We may update this policy as Airis changes; the "Last updated" date at the top of this page always reflects the most recent revision. Where a change is material, we will give notice through the product or by email before it takes effect. If our use of Google user data changes, we will give any notice or obtain any consent required before using it for a new purpose.

18. Contact

Questions, privacy requests, and account deletion requests can be sent to support@kerrahub.com, or by post to Kerra Innovation Hub Limited (RC 9692022), Lagos, Nigeria. Website: airisinsight.com.