This Privacy Policy explains how Khem ("Khem," "we," "our," or "us") collects, uses, shares, and protects information in connection with https://khemhq.com (the "Website") and the products, services, software, demonstrations, communications, and consultations we provide (collectively, the "Services").
This Policy works together with our Terms and Conditions. Capitalized terms not defined here have the meaning given in the Terms and Conditions.
By using the Website or Services, you agree to the practices described in this Policy.
1. Who This Policy Covers
This Policy applies to:
- Website visitors — people who browse https://khemhq.com or submit inquiries.
- Clients — businesses that engage Khem for Services.
- End users — individuals who interact with a Client's AI agents, receptionists, booking flows, or other Services we operate on the Client's behalf (for example, callers or people who book appointments).
For data processed on behalf of a Client (including most End User data), the Client is the controller (or business) and Khem acts as the processor (or service provider). In those cases, the Client's own privacy policy governs how that data is collected and used, and individuals should direct requests to the relevant Client. This Policy describes Khem's own practices.
2. Information We Collect
Information you provide directly:
- Contact details such as name, business name, email address, and phone number.
- Information submitted through inquiry or consultation forms.
- Business information shared during onboarding or implementation.
Client and integration data:
- Business information, configurations, and content a Client provides to set up the Services.
- Data accessed through integrations a Client authorizes (for example, CRM records, calendars, or email).
End user interaction data (processed on a Client's behalf):
- Information provided during calls, messages, bookings, or intake — which may include name, contact details, appointment details, and the content of the communication.
- Call audio and transcripts where call recording is enabled by the Client.
Information collected automatically (server logs):
When you access the Website, our hosting infrastructure automatically records standard log data, which may include:
- IP address and hostname of the accessing device
- Browser type and version
- Operating system
- Referrer URL
- Date and time of the request
- Pages visited
This log data is used for security, troubleshooting, and aggregate/statistical analysis, and is generally not used to identify you individually. We may review it retrospectively if we detect indications of misuse or illegal activity.
- Limited cookies and similar technologies, as described in Section 7. Our site does not use analytics or advertising trackers.
Where we obtain information. We typically receive personal information directly from you. We may also receive information from a Client (for example, when a Client provides data to configure the Services), from individuals who interact with a Client's AI agents, and from authorized third-party integrations a Client connects.
Do you have to provide it? You are not required to provide personal information, but if you choose not to, we may be unable to provide the Website or Services to you in whole or in part.
3. How We Use Information
We use information to:
- Provide, operate, maintain, and improve the Website and Services.
- Respond to inquiries and provide consultations.
- Set up, configure, and support Client implementations.
- Operate AI agents, receptionists, booking, intake, and related automation on a Client's behalf.
- Communicate with you about your account, projects, or support requests.
- Maintain the security and integrity of our systems.
- Comply with legal obligations and enforce our agreements.
We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined under applicable U.S. state privacy laws.
Legal bases for processing. We process personal information only where we have a valid reason to do so. Depending on the situation, that basis is one or more of the following:
- Your consent — for example, where you opt in to marketing communications.
- Performance of a contract — to provide the Services you or your organization have requested, or to take steps before entering into a contract.
- Legal obligations — to comply with applicable laws, regulations, and lawful requests.
- Legitimate interests — where we have a reasonable business interest (such as operating, securing, and improving our Services) that is not overridden by your rights and freedoms.
Where we rely on consent, you may withdraw it at any time, as described in Section 10.
4. AI Processing
Our Services use artificial intelligence technologies, including third-party AI model providers, to generate responses, summaries, recommendations, and communications.
Information processed by these systems may be transmitted to and processed by AI model providers solely to deliver the Services. AI-generated outputs may contain errors and should be reviewed by the Client where appropriate, as described in our Terms and Conditions.
5. Calls, Messages & Recording
Where a Client enables calling, messaging, or call recording, we process the associated communication data on the Client's behalf.
The Client is responsible for providing any required notices and obtaining any required consents from individuals before calls, messages, or recordings occur, including disclosure that an individual is interacting with an automated or AI system and consent to recording where the law requires it. See Section 7 of our Terms and Conditions.
6. How We Share Information
We may share information with:
- Service providers and integrations that help us operate the Services, including, but not limited to:
- Cal.com
- CRM platforms
- Email providers
- Telephony providers
- Calendar providers
- AI model providers
- Clients, where the information was collected on that Client's behalf.
- Legal and safety recipients, where disclosure is required by law, to enforce our agreements, or to protect the rights, safety, or property of Khem, our Clients, or others.
- Business transfers, in connection with a merger, acquisition, financing, or sale of assets.
These third parties are authorized to use the information only as needed to provide their services to us or as required by law. Their handling of data is subject to their own terms and privacy policies.
7. Cookies & Tracking Technologies
Our Website is a self-built site hosted on Vercel. We do not use Google Analytics, advertising or marketing trackers, or third-party analytics cookies, and we do not use cookies to build advertising profiles about you.
Our hosting provider may set a limited number of strictly necessary cookies or process basic technical data required to deliver the site securely and reliably (for example, for load balancing or security). We do not use these for tracking or advertising.
If we add analytics or other tracking technologies in the future, we will update this Policy and, where required by law, provide a consent mechanism.
You can control or delete cookies through your browser settings. Disabling cookies may affect some Website functionality.
8. Data Retention
We retain personal information for as long as needed to provide the Services, fulfill the purposes described in this Policy, comply with legal obligations, resolve disputes, and enforce our agreements.
Data processed on behalf of a Client is retained according to the Client's instructions and the applicable Client Agreement. Upon termination, and subject to legal retention requirements, we return or delete Client Data within a commercially reasonable period upon written request.
As a general rule, we retain call recordings and their transcripts for 30 days, after which they are deleted, unless a longer period is required by law, needed to resolve a dispute, or otherwise agreed with the Client in writing. Other categories of data (such as inquiry form submissions and account records) are kept only as long as needed for the purposes described above.
9. Data Security
We maintain commercially reasonable technical and organizational measures designed to protect personal information against unauthorized access, loss, misuse, or alteration. These measures may include access restrictions, encryption of data in transit and at rest, and use of reputable service providers.
The Website uses SSL/TLS encryption to protect information transmitted between your browser and our site. You can recognize an encrypted connection by the "https://" prefix and the lock icon in your browser's address bar.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
10. Your Privacy Rights
Depending on where you live, you may have rights regarding your personal information, including the right to:
- Access the personal information we hold about you.
- Request correction of inaccurate information.
- Request deletion of your information.
- Opt out of certain processing, including the "sale" or "sharing" of personal information, where applicable.
- Receive a copy of your information in a portable format.
- Withdraw consent at any time where our processing is based on consent (for example, by unsubscribing from marketing emails or emailing us). Withdrawal does not affect processing that already took place before your request.
To exercise these rights, contact us at support@khemhq.com. We will respond as required by applicable law. We will not discriminate against you for exercising your rights.
If your information was collected by Khem on behalf of a Client (for example, as an End User of a Client's AI agent), please direct your request to that Client; we will assist the Client in responding as required.
California residents (CCPA/CPRA). If you are a California resident, you have the right to know what personal information we collect, use, and disclose; to request access to and a copy of that information; to request correction or deletion; and to opt out of the sale or sharing of personal information. As stated above, we do not sell or share personal information. We will not discriminate against you for exercising your rights. You may also designate an authorized agent to make a request on your behalf, and you may appeal a denial by contacting us. Where we act as a service provider on behalf of a Client, requests relating to that data should be directed to the relevant Client, and we will assist as required.
EU/UK/EEA residents (GDPR/UK GDPR). If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, the right to data portability, and the right to withdraw consent where processing is based on consent. The legal bases on which we rely are described in Section 3. You also have the right to lodge a complaint with your local data protection or supervisory authority. Where we process personal data on a Client's behalf, the Client is the controller and we act as the processor; in those cases, please direct your request to the Client, and we will assist as required. Information about international transfers and safeguards is provided in Section 11.
We will respond to verifiable requests within the timeframes required by applicable law.
11. International Data Transfers
We are based in the United States, and information we process may be stored and processed in the United States or other countries where we or our service providers operate. These countries may have data protection laws different from those in your country. Where required, we take steps to ensure appropriate safeguards for international transfers.
12. Children's Privacy
The Website and Services are intended for businesses and are not directed to children under 13 (or the equivalent minimum age in the applicable jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us so we can take appropriate action.
13. Third-Party Links
The Website may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies.
14. Changes to This Policy
We may update this Privacy Policy periodically. The "Effective Date" above reflects the most recent revision. Continued use of the Website or Services after changes are posted constitutes acceptance of the updated Policy.
15. Contact Us
Questions or requests regarding this Privacy Policy may be directed to:
Khem
Email: support@khemhq.com
Website: https://khemhq.com