Terms of Service

Last Updated: March 2, 2026

These Terms of Service ("Terms") govern your access to and use of Paolo, operated by Kindthing LLC d/b/a Paolo ("Paolo," "we," "us," or "our"). By accessing or using our website at trypaolo.com, our API, or any related services (collectively, the "Service"), you agree to be bound by these Terms.

If you do not agree to these Terms, do not use the Service.

1. Overview of the Service

Paolo is a personal AI memory layer that provides persistent context and preferences to AI tools. The Service stores user-provided data — including conversation context, preferences, taste examples, and cognitive profile information — and makes it available to connected AI platforms through the Model Context Protocol (MCP) and related integrations.

2. Eligibility

You must be at least 18 years old to use the Service. By using Paolo, you represent and warrant that you meet this age requirement and have the legal capacity to enter into these Terms.

3. Account Registration and Security

To use certain features of the Service, you may need to create an account. You are responsible for maintaining the confidentiality of your account credentials, including any API keys or authentication tokens. You agree to notify us immediately of any unauthorized use of your account.

You are responsible for all activity that occurs under your account.

4. Acceptable Use

You agree not to:

• Use the Service for any unlawful purpose or in violation of any applicable laws or regulations
• Store or transmit content that infringes on the intellectual property rights of others
• Attempt to gain unauthorized access to the Service, other accounts, or any related systems or networks
• Interfere with or disrupt the integrity or performance of the Service
• Use the Service to store sensitive personal information of third parties without their consent
• Reverse engineer, decompile, or attempt to extract the source code of the Service except as permitted by law
• Use automated means to access the Service in a manner that exceeds reasonable usage or places undue burden on our infrastructure
• Resell, sublicense, or redistribute the Service without our prior written consent

5. Your Data

5.1 Ownership

You retain all ownership rights in the data you provide to Paolo ("Your Data"). We do not claim ownership of Your Data.

5.2 License to Us

By using the Service, you grant us a limited, non-exclusive, worldwide license to use, process, and store Your Data solely for the purpose of providing and improving the Service. We will not sell Your Data to third parties.

5.3 Data Portability

You may request an export of Your Data at any time by contacting us. We will provide your data in a reasonable, machine-readable format.

5.4 Data Deletion

You may request deletion of Your Data at any time. Upon receiving a verified deletion request, we will delete Your Data from our active systems within 30 days. Backup copies may persist for up to 90 days before being purged.

6. Third-Party Integrations

The Service connects to third-party AI platforms (such as Anthropic's Claude and others) through API integrations. We are not responsible for the privacy practices, terms, or operations of these third-party platforms. Your use of connected platforms is governed by their respective terms and policies.

7. Fees and Payment

7.1 Pricing

Certain features of the Service may require a paid subscription. Current pricing is available on our website. We reserve the right to change pricing with 30 days' notice to existing subscribers.

7.2 Billing

Payments are processed through Stripe. By providing payment information, you authorize us to charge the applicable fees to your payment method on a recurring basis. You are responsible for keeping your payment information current.

7.3 Refunds

If you are unsatisfied with the Service, you may request a refund within 14 days of your initial payment. Refund requests after this period are handled at our discretion. To request a refund, contact us at hello@trypaolo.com.

7.4 Cancellation

You may cancel your subscription at any time. Cancellation takes effect at the end of your current billing period. No partial refunds are issued for unused time within a billing period.

8. Intellectual Property

The Service, including its software, design, logos, and documentation, is owned by Kindthing LLC and is protected by intellectual property laws. These Terms do not grant you any rights to our trademarks, service marks, or branding.

9. Disclaimer of Warranties

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY. WE DISCLAIM ALL WARRANTIES, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.

We do not warrant that the Service will be uninterrupted, error-free, or secure, or that any defects will be corrected.

10. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, KINDTHING LLC AND ITS OFFICERS, DIRECTORS, EMPLOYEES, AND AGENTS SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR ANY LOSS OF PROFITS, DATA, USE, OR GOODWILL, ARISING OUT OF OR RELATED TO YOUR USE OF THE SERVICE, REGARDLESS OF THE THEORY OF LIABILITY.

OUR TOTAL AGGREGATE LIABILITY FOR ALL CLAIMS ARISING OUT OF OR RELATED TO THESE TERMS OR THE SERVICE SHALL NOT EXCEED THE GREATER OF (A) THE AMOUNTS YOU PAID TO US IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM, OR (B) ONE HUNDRED DOLLARS ($100).

11. Indemnification

You agree to indemnify, defend, and hold harmless Kindthing LLC and its officers, directors, employees, and agents from and against any claims, liabilities, damages, losses, and expenses (including reasonable attorneys' fees) arising out of or related to your use of the Service, your violation of these Terms, or your violation of any rights of a third party.

12. Modifications to the Service and Terms

We may modify the Service or these Terms at any time. If we make material changes to these Terms, we will notify you by email or through the Service at least 30 days before the changes take effect. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the revised Terms.

13. Termination

We may suspend or terminate your access to the Service at any time for violation of these Terms or for any other reason at our discretion, with or without notice. Upon termination, your right to use the Service ceases immediately. Sections 5 (Your Data), 9–11 (Disclaimers, Liability, Indemnification), and 14–15 (Governing Law, Miscellaneous) survive termination.

You may terminate your account at any time by contacting us or through the account settings.

14. Governing Law and Dispute Resolution

These Terms are governed by the laws of the State of Delaware, without regard to its conflict of law principles.

Any dispute arising out of or related to these Terms or the Service shall first be attempted to be resolved through good-faith negotiation. If the dispute cannot be resolved within 30 days, either party may pursue binding arbitration administered by JAMS under its Streamlined Arbitration Rules, conducted in English. The arbitration shall take place remotely unless both parties agree otherwise.

You agree that any dispute resolution proceedings will be conducted on an individual basis and not as a class action or other representative proceeding.

15. Miscellaneous

• Entire Agreement. These Terms, together with our Privacy Policy and Data Processing Addendum, constitute the entire agreement between you and Kindthing LLC regarding the Service.
• Severability. If any provision of these Terms is found to be unenforceable, the remaining provisions will continue in full force and effect.
• Waiver. Our failure to enforce any right or provision of these Terms does not constitute a waiver of that right or provision.
• Assignment. You may not assign your rights or obligations under these Terms without our prior written consent. We may assign our rights and obligations without restriction.
• Force Majeure. We shall not be liable for any failure or delay in performing our obligations due to events beyond our reasonable control.

16. Contact Us

If you have questions about these Terms, contact us at:

Kindthing LLC d/b/a Paolo
Email: hello@trypaolo.com
Website: https://trypaolo.com

Privacy Policy

Last Updated: March 18, 2026

Kindthing LLC d/b/a Paolo ("Paolo," "we," "us," or "our") operates the website trypaolo.com and the Paolo personal AI memory service (collectively, the "Service"). This Privacy Policy describes how we collect, use, store, and protect your information when you use the Service.

By using the Service, you agree to the collection and use of information as described in this Privacy Policy. If you do not agree, please do not use the Service.

1. Information We Collect

1.1 Information You Provide Directly

• Account Information. When you create an account, we collect your email address and any display name you provide.
• Payment Information. If you subscribe to a paid plan, our payment processor (Stripe) collects your payment details. We do not store your full credit card number on our servers. We receive limited billing information from Stripe (such as last four digits and billing address) for record-keeping.
• User Content. The core of what Paolo stores is data you actively provide or that is provided on your behalf by connected AI tools. This includes conversation context, preferences, taste examples, project information, cognitive profile observations, and other structured data you choose to store in the Service.
• Communications. If you contact us directly (e.g., via email), we retain the content of those communications.

1.2 Information Collected Automatically

• Usage Data. We collect basic analytics about how you interact with our website and Service, including pages visited, features used, and general engagement patterns. We use Google Analytics for website analytics, which collects anonymized usage data.
• Log Data. Our servers automatically record information when you access the Service, including your IP address, request timestamps, referring URLs, and browser/device type. This data is used for security monitoring and debugging and is not linked to your stored content.
• Cookies. We use essential cookies to maintain your session and authentication state. We do not use advertising or tracking cookies. Google Analytics may set its own cookies; see Google's privacy policy for details.

1.3 Information from Third-Party Integrations

When you connect Paolo to AI platforms (such as Anthropic's Claude), those platforms may send data to Paolo on your behalf as part of normal operation. This data is treated as User Content and governed by the same protections described in this policy.

1.4 Data Collected by Connected AI Platforms

Important: When you use Paolo through a connected AI platform, that platform may independently collect, log, or process data that passes through the integration — including the contents of tool calls, responses, and related metadata. For example, when Paolo is connected to Anthropic's Claude, Anthropic may collect data transmitted between Claude and Paolo as part of its platform operations, including for safety monitoring, abuse prevention, and service improvement. This data collection is governed by the AI platform's own terms and privacy policy, not by Paolo's. We encourage you to review the privacy practices of any AI platform you connect to the Service.

2. How We Use Your Information

We use your information for the following purposes:

• Providing the Service. Storing and retrieving your personal context, preferences, and data when requested by you or your connected AI tools.
• Improving the Service. Understanding usage patterns to improve performance, reliability, and features. We may use aggregated, de-identified data for this purpose.
• Account Management. Managing your account, processing payments, and communicating with you about the Service (e.g., service updates, billing notices, security alerts).
• Security. Detecting, preventing, and responding to fraud, abuse, and security incidents.
• Legal Compliance. Complying with applicable laws, regulations, and legal processes.

We do not use Your Content to train machine learning models. We may use aggregated, de-identified data that cannot be linked back to you to improve the Service. We do not sell your personal information to third parties.

3. How We Store and Protect Your Information

3.1 Infrastructure

Your data is stored in Supabase (hosted on AWS infrastructure). Our application server is hosted on Railway.

3.2 Security Measures

We implement the following security measures to protect your data:

• Row-Level Security (RLS). Database-level access controls enforce user isolation on every table, ensuring that queries through the application can only return data belonging to the authenticated user.
• Encryption in Transit. All data transmitted between your devices, our servers, and our infrastructure providers is encrypted using TLS.
• Encryption at Rest. Data stored in our database is encrypted at rest using AES-256 via our infrastructure provider's disk-level encryption.
• API Authentication. Access to the Service requires authenticated API keys or OAuth 2.0 tokens.
• Timing-Safe Comparisons. Authentication checks use timing-safe string comparisons to prevent timing attacks.

3.3 Administrative Access

Your Content is not reviewed, accessed, or analyzed by Paolo personnel except where required for:

• Responding to a support request you initiate
• Investigating a security incident or suspected abuse
• Complying with a valid legal obligation

Administrative database access is restricted to essential infrastructure maintenance. We do not browse, search, or read individual user data for product development, analytics, or any other internal purpose. Aggregated, de-identified data that cannot be linked to any individual may be used to improve the Service as described in Section 2.

3.4 Data Retention

We retain Your Content for as long as your account is active. If you delete your account or request data deletion, we will remove Your Content from our active systems within 30 days. Backup copies may persist for up to 90 days before being fully purged.

Log data and analytics are retained for up to 12 months, after which they are deleted or anonymized.

4. How We Share Your Information

We do not sell your personal information. We share your information only in the following limited circumstances:

• Service Providers. We use third-party service providers to help operate the Service, including Supabase (database hosting), Railway (application hosting), OpenAI (text embeddings for semantic search — conversation text is sent to OpenAI's embedding API to enable context retrieval; OpenAI does not use this data for training), Anthropic (AI-powered analysis — conversation summaries and content are processed by Anthropic's Claude API for cognitive profiling, content classification, search optimization, and entity extraction; Anthropic does not use this data for model training), Stripe (payment processing), and Google Analytics (website analytics). These providers access your information only as necessary to perform their services and are bound by their own privacy obligations.
• Connected AI Platforms. When you connect Paolo to an AI platform, your stored data is made available to that platform at your direction. You control which platforms are connected and can disconnect them at any time.
• Legal Requirements. We may disclose your information if required to do so by law, regulation, legal process, or governmental request.
• Business Transfers. If Kindthing LLC is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.
• With Your Consent. We may share your information for other purposes with your explicit consent.

5. Your Rights and Choices

Regardless of where you are located, we provide the following rights to all users:

• Access. You may request a copy of the personal information we hold about you.
• Correction. You may request that we correct inaccurate personal information.
• Deletion. You may request that we delete your personal information. Note that we may need to retain certain information for legal or operational reasons.
• Data Portability. You may request an export of Your Content in a machine-readable format.
• Opt-Out of Analytics. You may disable Google Analytics by using the Google Analytics Opt-Out Browser Add-on or by adjusting your browser settings.
• Withdraw Consent. Where we rely on your consent to process your information, you may withdraw that consent at any time.

To exercise any of these rights, contact us at hello@trypaolo.com. We will respond to verified requests within 30 days.

5.1 California Residents

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to request deletion, and the right to opt out of the sale of personal information. As stated above, we do not sell personal information.

5.2 International Users

If you are located outside the United States, please be aware that your information is transferred to and processed in the United States, where our servers and service providers are located. By using the Service, you consent to this transfer. We apply the same protections to all user data regardless of location.

6. Children's Privacy

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly.

7. Third-Party Links and Services

The Service may contain links to or integrations with third-party websites and services. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you access through Paolo.

8. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes your acceptance of the updated policy.

9. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, contact us at:

Kindthing LLC d/b/a Paolo
Email: hello@trypaolo.com
Website: https://trypaolo.com

Data Processing Addendum

Last Updated: March 2, 2026

This Data Processing Addendum ("DPA") supplements the Terms of Service and Privacy Policy of Kindthing LLC d/b/a Paolo ("Paolo," "we," "us," or "our") and governs the processing of personal data by Paolo on behalf of its users ("you" or "Data Controller").

This DPA applies when Paolo processes personal data on your behalf in connection with the Service. By using the Service, you agree to this DPA.

1. Definitions

• "Personal Data" means any information relating to an identified or identifiable individual, as defined by applicable data protection laws.
• "Processing" means any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, or deletion.
• "Data Controller" means you, the user, who determines the purposes and means of Processing Personal Data through the Service.
• "Data Processor" means Paolo, which Processes Personal Data on behalf of the Data Controller.
• "Sub-processor" means a third party engaged by Paolo to Process Personal Data on behalf of the Data Controller.

2. Roles and Scope

You are the Data Controller for any Personal Data you store in or transmit through the Service. Paolo acts as the Data Processor, Processing your data solely to provide and maintain the Service as described in our Terms of Service and Privacy Policy.

3. Data Processing Details

Element	Description
Subject Matter	Provision of the Paolo personal AI memory service
Duration	For the duration of your use of the Service, plus the retention period described in our Privacy Policy
Nature and Purpose	Storage, retrieval, and delivery of user-provided context, preferences, taste data, cognitive profile observations, and project information to connected AI platforms via MCP and API integrations
Categories of Personal Data	Account information (email, display name); user-generated content (conversation context, preferences, taste examples, cognitive observations, project data); usage and log data (IP addresses, timestamps, browser information)
Categories of Data Subjects	Users of the Service

4. Our Obligations as Data Processor

Paolo shall:

• Process on your instructions. Process Personal Data only in accordance with your documented instructions, which are defined by your use of the Service and these terms. We will not Process your Personal Data for any other purpose unless required by law, in which case we will inform you (unless legally prohibited from doing so).
• Maintain confidentiality. Ensure that any personnel authorized to Process Personal Data are bound by appropriate confidentiality obligations.
• Implement security measures. Maintain appropriate technical and organizational measures to protect Personal Data, including:
  • Row-Level Security (RLS) enforced on every database table
  • Encryption in transit (TLS) and at rest (AES-256 disk-level encryption)
  • OAuth 2.0 and API key authentication
  • Timing-safe authentication comparisons
  • Administrative access restricted to essential infrastructure maintenance
  • Regular security monitoring and logging
• Assist with data subject rights. Assist you in responding to requests from data subjects to exercise their rights (access, correction, deletion, portability) by providing the tools and mechanisms described in our Privacy Policy.
• Support compliance obligations. Provide reasonable assistance with data protection impact assessments and consultations with supervisory authorities, where required by applicable law.
• Delete or return data. Upon termination of your account or upon your request, delete your Personal Data from active systems within 30 days. Backup copies will be purged within 90 days.
• Make information available. Provide information reasonably necessary to demonstrate compliance with this DPA upon request.

5. Sub-processors

5.1 Authorized Sub-processors

You authorize Paolo to engage the following sub-processors to assist in providing the Service:

Sub-processor	Purpose	Location
Supabase	Database hosting and storage	United States (AWS infrastructure)
Railway	Application server hosting	United States
Stripe	Payment processing	United States
OpenAI	Embedding generation for semantic search	United States
Google Analytics	Website analytics (anonymized)	United States

5.2 Sub-processor Obligations

Paolo ensures that each sub-processor is bound by data protection obligations no less protective than those in this DPA. Paolo remains liable for the acts and omissions of its sub-processors.

5.3 Changes to Sub-processors

We will notify you of any intended changes to our sub-processors at least 14 days before the change takes effect, by email or through the Service. If you object to a new sub-processor, you may terminate your account before the change takes effect.

6. Connected AI Platforms

When you connect Paolo to an AI platform (such as Anthropic's Claude), data flows between Paolo and that platform at your direction. These connected platforms are not sub-processors of Paolo — they operate as independent controllers or processors under their own terms and privacy policies.

Important: When you use Paolo through Anthropic's Claude or other AI platforms, those platforms may collect, log, or process data that passes through the integration as part of their own platform operations, including for safety monitoring, abuse prevention, and service improvement. This data handling is governed by the platform's own terms and privacy policy, not by Paolo's. We encourage you to review the terms of any AI platform you connect to Paolo.

7. Data Transfers

Paolo and its sub-processors are located in the United States. If you are located outside the United States, your Personal Data will be transferred to the United States for Processing. We rely on the data protection measures described in this DPA and our Privacy Policy to safeguard your data during and after transfer.

8. Data Breach Notification

In the event of a Personal Data breach that is likely to result in a risk to your rights and freedoms, Paolo will notify you without undue delay and no later than 72 hours after becoming aware of the breach. The notification will include, to the extent available:

• The nature of the breach, including the categories and approximate number of data subjects and records affected
• The likely consequences of the breach
• The measures taken or proposed to address the breach and mitigate its effects

9. Term and Termination

This DPA remains in effect for the duration of your use of the Service. Obligations related to data deletion, confidentiality, and security survive termination.

10. Conflicts

In the event of a conflict between this DPA and our Terms of Service or Privacy Policy, this DPA shall prevail with respect to the Processing of Personal Data.

11. Contact

For questions about this DPA or to exercise your data protection rights:

Kindthing LLC d/b/a Paolo
Email: hello@trypaolo.com
Website: https://trypaolo.com