Legal

Privacy Policy

Last Updated: March 2, 2026

Kindthing LLC d/b/a Paolo ("Paolo," "we," "us," or "our") operates the website trypaolo.com and the Paolo personal AI memory service (collectively, the "Service"). This Privacy Policy describes how we collect, use, store, and protect your information when you use the Service.

By using the Service, you agree to the collection and use of information as described in this Privacy Policy. If you do not agree, please do not use the Service.

1. Information We Collect

1.1 Information You Provide Directly

• Account Information. When you create an account, we collect your email address and any display name you provide.
• Payment Information. If you subscribe to a paid plan, our payment processor (Stripe) collects your payment details. We do not store your full credit card number on our servers. We receive limited billing information from Stripe (such as last four digits and billing address) for record-keeping.
• User Content. The core of what Paolo stores is data you actively provide or that is provided on your behalf by connected AI tools. This includes conversation context, preferences, taste examples, project information, cognitive profile observations, and other structured data you choose to store in the Service.
• Communications. If you contact us directly (e.g., via email), we retain the content of those communications.

1.2 Information Collected Automatically

• Usage Data. We collect basic analytics about how you interact with our website and Service, including pages visited, features used, and general engagement patterns. We use Google Analytics for website analytics, which collects anonymized usage data.
• Log Data. Our servers automatically record information when you access the Service, including your IP address, request timestamps, referring URLs, and browser/device type. This data is used for security monitoring and debugging and is not linked to your stored content.
• Cookies. We use essential cookies to maintain your session and authentication state. We do not use advertising or tracking cookies. Google Analytics may set its own cookies; see Google's privacy policy for details.

1.3 Information from Third-Party Integrations

When you connect Paolo to AI platforms (such as Anthropic's Claude), those platforms may send data to Paolo on your behalf as part of normal operation. This data is treated as User Content and governed by the same protections described in this policy.

1.4 Data Collected by Connected AI Platforms

Important: When you use Paolo through a connected AI platform, that platform may independently collect, log, or process data that passes through the integration — including the contents of tool calls, responses, and related metadata. For example, when Paolo is connected to Anthropic's Claude, Anthropic may collect data transmitted between Claude and Paolo as part of its platform operations, including for safety monitoring, abuse prevention, and service improvement. This data collection is governed by the AI platform's own terms and privacy policy, not by Paolo's. We encourage you to review the privacy practices of any AI platform you connect to the Service.

2. How We Use Your Information

We use your information for the following purposes:

• Providing the Service. Storing and retrieving your personal context, preferences, and data when requested by you or your connected AI tools.
• Improving the Service. Understanding usage patterns to improve performance, reliability, and features. We may use aggregated, de-identified data for this purpose.
• Account Management. Managing your account, processing payments, and communicating with you about the Service (e.g., service updates, billing notices, security alerts).
• Security. Detecting, preventing, and responding to fraud, abuse, and security incidents.
• Legal Compliance. Complying with applicable laws, regulations, and legal processes.

We do not use Your Content to train machine learning models. We may use aggregated, de-identified data that cannot be linked back to you to improve the Service. We do not sell your personal information to third parties.

3. How We Store and Protect Your Information

3.1 Infrastructure

Your data is stored in Supabase (hosted on AWS infrastructure). Our application server is hosted on Railway.

3.2 Security Measures

We implement the following security measures to protect your data:

• Row-Level Security (RLS). Database-level access controls ensure that each user can only access their own data, enforced independently of application code.
• Encryption in Transit. All data transmitted between your devices, our servers, and our infrastructure providers is encrypted using TLS.
• Encryption at Rest. Data stored in our database is encrypted at rest.
• API Authentication. Access to the Service requires authenticated API keys or OAuth 2.0 tokens.
• Timing-Safe Comparisons. Authentication checks use timing-safe string comparisons to prevent timing attacks.

3.3 Data Retention

We retain Your Content for as long as your account is active. If you delete your account or request data deletion, we will remove Your Content from our active systems within 30 days. Backup copies may persist for up to 90 days before being fully purged.

Log data and analytics are retained for up to 12 months, after which they are deleted or anonymized.

4. How We Share Your Information

We do not sell your personal information. We share your information only in the following limited circumstances:

• Service Providers. We use third-party service providers to help operate the Service, including Supabase (database hosting), Railway (application hosting), OpenAI (text embeddings for semantic search — conversation text is sent to OpenAI's embedding API to enable context retrieval; OpenAI does not use this data for training), Stripe (payment processing), and Google Analytics (website analytics). These providers access your information only as necessary to perform their services and are bound by their own privacy obligations.
• Connected AI Platforms. When you connect Paolo to an AI platform, your stored data is made available to that platform at your direction. You control which platforms are connected and can disconnect them at any time.
• Legal Requirements. We may disclose your information if required to do so by law, regulation, legal process, or governmental request.
• Business Transfers. If Kindthing LLC is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.
• With Your Consent. We may share your information for other purposes with your explicit consent.

5. Your Rights and Choices

Regardless of where you are located, we provide the following rights to all users:

• Access. You may request a copy of the personal information we hold about you.
• Correction. You may request that we correct inaccurate personal information.
• Deletion. You may request that we delete your personal information. Note that we may need to retain certain information for legal or operational reasons.
• Data Portability. You may request an export of Your Content in a machine-readable format.
• Opt-Out of Analytics. You may disable Google Analytics by using the Google Analytics Opt-Out Browser Add-on or by adjusting your browser settings.
• Withdraw Consent. Where we rely on your consent to process your information, you may withdraw that consent at any time.

To exercise any of these rights, contact us at hello@trypaolo.com. We will respond to verified requests within 30 days.

5.1 California Residents

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to request deletion, and the right to opt out of the sale of personal information. As stated above, we do not sell personal information.

5.2 International Users

If you are located outside the United States, please be aware that your information is transferred to and processed in the United States, where our servers and service providers are located. By using the Service, you consent to this transfer. We apply the same protections to all user data regardless of location.

6. Children's Privacy

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly.

7. Third-Party Links and Services

The Service may contain links to or integrations with third-party websites and services. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you access through Paolo.

8. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes your acceptance of the updated policy.

9. Data Processing Addendum

If you require a formal data processing agreement, our Data Processing Addendum governs the processing of personal data by Paolo on your behalf and includes details on sub-processors, data breach notification, and security measures.

10. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, contact us at:

Kindthing LLC d/b/a Paolo
Email: hello@trypaolo.com
Website: https://trypaolo.com