Privacy Policy

Kaya UAE, of Dubai Hills, Dubai, United Arab Emirates, is the controller of the personal data described here.

We are based in the United Arab Emirates and subject to Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. Because we offer Kaya to people in the United Kingdom and the European Economic Area, UK and EU GDPR also apply to that processing, and this policy is written to meet both.

Our representative for UK data protection matters is [UK representative — to be appointed]. For the EEA, [EU representative — to be appointed].

For anything in this policy, including exercising your rights, write to hello@talktokaya.com.

We do not read your conversations. We do not sell your data or share it for advertising. Nothing you write trains an AI model. You can download everything we hold, or delete all of it, from Settings at any time. Your employer — if you came to Kaya through work — can never see anything you write.

The rest of this page is the detail behind those sentences.

Your account. Email address, name, password (stored hashed by our authentication provider — we never see it), and a record of when you agreed to this policy and which version.

What you write. Conversations with Kaya, journal entries, unsent letters, glow notes, intentions, calendar notes and weekly check-ins.

What Kaya remembers. Short factual notes drawn from your conversations, so Kaya has continuity between them, and a log of recurring emotional themes — a label and a date, never the sentences behind it.

Your preferences. Onboarding answers and how you want Kaya to respond.

An emergency contact, if you choose to add one.

Safety records. If our system detects you may be at risk of harming yourself, it records that this happened, with keyword fragments and indicators — enough for us to check the safety system is working correctly.

Released letters. When you release an unsent letter rather than saving it, the words are never written to our database. They exist in your browser for the length of the animation and then they are gone. We keep only who it was addressed to and when.

Photographs. Images you attach in a conversation are used for that one reply and are never stored.

Your words in theme tracking. The recurring-themes feature records a label and a date. Never a sentence.

Ordinary personal data is processed under UK GDPR Article 6. Because what you write reveals information about your health, that content also needs a condition under Article 9 — for us that is your explicit consent, which is why account creation asks for it directly rather than treating signing up as agreement.

You can withdraw your consent at any time by deleting your account, which removes everything. Withdrawing does not affect processing that already happened.

Everything is encrypted in transit, and encrypted at rest by our database provider. Access is enforced by the database itself rather than only by our code: your account is the only one permitted to read your rows, and that holds even if we ship a bug in the application.

To be straight with you about the limit of that: this is not end-to-end encryption. We can technically read what you write, because Kaya has to read it to reply to you, to remember what matters to you, and to notice when you might be in danger. End-to-end encryption would make all three impossible.

We do not read your conversations. There is no team review of what people write, no conversation is shown to another user, and none of it is sold or shared for advertising.

Two honest exceptions. Like any team that runs a database, our engineers hold credentials that could technically reach it — we treat looking as a disciplinary matter rather than pretending it is impossible. And safety records are reviewed by a small number of people so we can confirm the crisis-detection system is behaving correctly.

Your employer pays for your seat. They are not a controller of anything you write, and they have no route to it.

They can never see your conversations, letters, journal entries, notes, moods, themes, scores or activity — not in full, not in summary, not on request. There is no administrative view that exposes them and no interface setting that turns them on.

What an organisation can see is aggregate figures covering at least ten people who contributed in a period, rounded, and never broken down small enough to identify anyone. Groups below that threshold produce no figure at all. Crisis-related signals never enter organisational reporting at any size. Nothing an employer sees records whether a particular person used Kaya, or when.

Your account is yours. If you leave the organisation, what you wrote goes with you and your employer inherits nothing.

Anthropicgenerates Kaya’s replies, so your messages are sent to their API. Under their commercial terms your messages are not used to train their models.

Supabase stores your data and runs sign-in. Vercel hosts the application. Resend sends account emails such as confirmation and password resets.

Your data is stored in the European Union. It is also accessed by us in the United Arab Emirates, and processed by providers in the United States.

Neither the UAE nor the United States has been found by the UK or the EU to offer equivalent protection, so those transfers rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, together with the technical protections described above. You can ask us for a copy of the safeguards that apply.

What you write is kept until you delete it, or until you delete your account — whichever comes first. We do not impose a time limit on your own entries, because a journal you cannot look back on is not much of a journal.

Safety records are deleted automatically after 90 days.

Deleting your account removes everything associated with it, in one operation, permanently. We cannot recover it afterwards.

Kaya’s replies are generated by an AI model, and an automated system reads each message to classify emotional signals and to detect possible crisis. That detection can cause Kaya to offer crisis resources and, if you nominated someone, to contact them.

No automated decision is made about you that produces legal effects or anything similarly significant. Kaya does not diagnose you, score you for anyone else’s benefit, or make decisions about your employment. If you want a human to look at something the system did, write to us.

You have the right to access your data, correct it, delete it, restrict or object to how we use it, take it elsewhere in a portable form, and withdraw consent.

Two of those work immediately in the app: in Settings, under Your data, you can download everything we hold as a single file, or delete your account and everything in it. For anything else, write to us and we will respond within one month.

If you think we have handled your data badly, please tell us first. You also have the right to complain to a regulator: in the UK, the Information Commissioner’s Office at ico.org.uk; in the EEA, your national supervisory authority; and in the UAE, the UAE Data Office.

Kaya is for people aged 16 and over. We do not knowingly collect data from anyone younger. If you believe a child has created an account, contact us and we will remove it.

Kaya is a companion for reflection, not a medical or crisis service, and nothing it says is clinical advice. If you are in immediate danger, contact your local emergency services.

This is version 1, dated 2026-08-16. If we change anything material we will ask you to agree again rather than quietly updating the page, and the version recorded against your account will tell us which version you agreed to.

Kaya is in closed beta. Backup and recovery practices are still being finalised, so please don’t treat it as the only home for something you could not bear to lose.

See also our Terms.