Privacy Policy

1. Information We Collect

When you create a Kite account or use our service, we collect:

• Email address and password (hashed), or your Google account if you sign in with Google
• For each person you add: their name, their ID number in the prison system, which system holds them, and the facility if you tell us. We need these to send a message to them at all — the prison system will not accept one without them.
• Call records and metadata (date, time, duration, cost)
• Messages Kite sends to the person you support, and whether the facility has let them through
• Messages the person you support writes to Kite. We read each one to answer it, and we do not keep what they wrote, with one exception: Kite’s reply is titled with the first few words of their message (up to 40 characters), and that title is kept with the reply.
• Usage data (voice minutes, web lookups)
• Optional information: a note about a caller, if you have asked support to add one

What we do not do with any of it. We do not sell it, share it for advertising, or hand it to anyone who has not asked for it through a legal process we are obliged to answer. We do not give it to the prison system beyond what a message physically requires — the recipient and the words you asked us to send — and everything that goes through a prison system is read by that prison system, which is true of all mail and not something Kite can change.

2. Call Recordings & Transcripts

Calls are not recorded, and nothing said on a call is kept after it ends. There is no setting to turn this on, because there is nothing to turn on:

• No audio is written to disk, during or after a call
• While a call is live, the assistant holds a running text of the conversation in memory so it can keep its place if the connection drops. It is discarded when the call ends and is never written down or stored
• Nothing said on a call is available to a later call
• What we keep about a call is the record needed to bill it — when it happened, how long it lasted, and what it cost

The only thing we can put in front of the assistant about a caller is what you entered yourself — their name and the settings on their line, plus a note if you asked us to add one. Nothing is derived from a previous call.

Two exceptions, and both only happen on request. If a caller asks to contact support, the assistant writes down what they said the problem is and reads it back before sending it. And if a caller asks Kite to send something to their tablet, Kite writes it up from the last part of that call (what they asked and what Kite told them) and sends it as a message through the prison’s messaging service; the part of the call it was written from is deleted as soon as the message has gone out, or could not be sent. Nothing is sent in either case until they agree to it out loud.

3. How We Use Your Information

We use the information we collect to:

• Provide and maintain the Service
• Authenticate you and authorize your calls
• Process payments through our payment processor
• Draw down your prepaid balance as calls and messages are used
• Provide customer support
• Detect and prevent fraud or abuse
• Comply with legal obligations

4. Third-Party Services

Kite uses third-party services to deliver the Service:

• A payment processor, which takes payments and holds any card you choose to save. Kite never receives or stores your card number. If you save a card, we keep only what is needed to tell you which card it is: the brand, the last four digits, and the expiry month and year
• A telephone company, which carries the calls
• The prison system’s own messaging service, which is how a message physically reaches a tablet inside. It receives the recipient and the message text, and the facility reviews every message before it is delivered
• An email service, which sends the email we send you and receives the email you send to support
• AI services, which process call audio so the assistant can hear and answer, look things up on the web when asked, write replies to messages, and help our team look into support requests
• Hosting and network providers, where Kite runs and stores its data

Each receives only what it needs to do its part, and each has its own privacy policy. Kite does not sell your information, does not connect to your email, social accounts or messaging apps, and holds no credentials for them.

5. What the assistant hears

Audio is sent to an AI speech service so the assistant can hear and answer in real time. It is processed to produce the reply and is not retained by us. We do not record it, and nothing written from it is kept after the call.

Calls placed from a correctional facility are separately monitored and recorded by the facility and its phone provider, under their own terms and outside our control. Nothing in this policy changes that, and using Kite does not make a call private from them.

6. Data Retention & Deletion

We retain your data according to the following policy:

• Account information: until account deletion
• Call records (CDR): 13 months for billing and compliance
• Usage events: indefinitely (audit trail)
• Support messages you send from a call: until the request is resolved, then as part of our support records
• The words of the messages Kite sends to a tablet, including each one’s title (the first words of the message it answers, or, for a message asked for on a call, a short title Kite writes for it): 30 days. The record that a message was sent, and whether the facility let it through, is kept with the account

You may ask us to delete your account at any time, from the Account page of your dashboard or by emailing [email protected] from the address on your account. Closing your account ends your sessions, releases your numbers and deletes your saved card. We keep your email, payment and usage records and the numbers you held, so we can issue your refund and keep our billing records; everything else is deleted on the schedule above.

7. Data Security

We take security seriously:

• Passwords hashed with argon2id
• All data in transit encrypted with TLS
• Short-lived session tokens in httpOnly, secure cookies
• Incoming payment and telephony webhooks signature-verified before they are acted on
• Repeated failed sign-in and password-reset attempts rate limited
• Each person’s passphrase is kept encrypted. You can read it on your own dashboard, so you can tell it to the person it belongs to; our support tools show only whether one is set, never the words. An account-wide fallback passphrase, where one exists, is kept only as a one-way hash that nobody can read back

However, no method of transmission over the Internet is 100% secure. We are not liable for unauthorized access resulting from user negligence.

8. Your Rights

You have the right to:

• Access your personal data in your account
• Request deletion of your account and associated data
• Update your information at any time

To exercise these rights, email [email protected] from the address on your account.

9. Children’s Privacy

Kite is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we become aware of such collection, we will delete the information immediately.

Our Terms of Service separately require account holders to be at least 18. These are two different rules, not a contradiction: 13 is the age below which US law bars us from collecting personal information at all, and 18 is the age at which someone can enter the agreement that governs paying for and running an account.

10. Policy Updates

We may update this privacy policy from time to time. We will notify you of any material changes by posting the updated policy here and updating the effective date.

11. Payments and your card

Payments are processed by Stripe. Your card details go to Stripe directly and are governed by Stripe’s privacy policy. Kite never receives or stores your card number. If you save a card, we keep only the brand, the last four digits and the expiry date, so we can tell you which card is on file. If you pay from your bank account through Link, Stripe’s saved-payment service, the bank connection is made with Stripe and Kite keeps none of your bank details.

What we charge, how refunds work, and how to dispute a charge are set out in our Terms of Service.

12. Contact

If you have questions about this privacy policy or our practices, or you want to access or delete your data, email [email protected] from the address on your account.