Privacy Policy

Effective Date: April 1, 2026

Last Updated: April 1, 2026

1. Introduction and Scope

This Privacy Policy (“Policy”) describes how Karley AI, Inc., a subsidiary of Expedition Community, Inc. (“Karley AI,” “we,” “us,” or “our”), collects, uses, stores, shares, and protects personal information when you interact with our AI-powered shopping assistant, our website at www.karley.ai, and any related services, applications, or platforms (collectively, the “Services”). Karley AI provides an artificial intelligence conversion agent that is embedded on our business clients’ websites to help website visitors discover products, answer pre-purchase questions, and complete transactions. Our AI technology learns from website content, product catalogs, and visitor interactions to provide personalized, conversational shopping assistance.

This Policy applies to all individuals who interact with our Services, including end users (“you” or “your”) who engage with Karley AI’s conversational interface on our clients’ websites, visitors to www.karley.ai, and representatives of businesses that use our platform (“Business Clients”). By using the Services, you acknowledge that you have read and understood this Policy. If you do not agree with the practices described in this Policy, please do not use the Services.

We are committed to transparency about how we handle your data, particularly in the context of AI-driven technologies. Because our Services are powered by artificial intelligence, including large language models provided by third-party providers such as OpenAI, we believe it is important to clearly explain how your information is processed through AI systems.

2. Information We Collect

We collect several categories of personal information in connection with the operation of our AI-powered Services. The specific types of information we collect depend on how you interact with our Services.

2.1 Information You Provide Directly

When you interact with our Services, you may provide us with the following categories of personal information:

Account and contact information, including your name, email address, phone number, company name, and job title, which you may provide when requesting a demo, creating an account, or contacting us.
Conversational inputs and prompts, meaning the text-based messages, queries, and questions you submit when interacting with the Karley AI shopping assistant on a Business Client’s website. This may include product questions, sizing or compatibility inquiries, shipping questions, and any other information you choose to share during a conversation with our AI agent.
Transaction-related information you voluntarily disclose during a conversation, such as product preferences, budget parameters, or order-related details.
Feedback and support information, including any correspondence you send to us regarding the Services.

2.2 Information Collected Automatically

When you access or use our Services, we automatically collect certain information, including:

Device and browser information, such as your device type, operating system, browser type and version, screen resolution, and language preferences.
Network information, including your Internet Protocol (IP) address and general geographic location derived from your IP address.
Usage and interaction data, such as the pages you visit, timestamps, click patterns, scroll behavior, session duration, referring URLs, and how you interact with the Karley AI assistant (e.g., frequency of conversations, length of interactions, and features used).
Cookies and similar technologies. We use cookies, pixel tags, web beacons, and similar tracking technologies to collect information about your browsing activity and preferences. Please see Section 10 of this Policy for more information about our use of cookies.

2.3 Information Generated or Inferred by AI

Our AI systems generate or infer additional information based on your interactions with the Services, including:

AI-generated outputs, meaning the responses, product recommendations, and conversational content produced by our AI models in response to your inputs.
Behavioral inferences and engagement signals, such as inferred product interests, purchase intent, shopping preferences, and browsing patterns derived from your interactions with the AI assistant.
Conversion and engagement analytics, including data about whether and how AI interactions contributed to product views, cart additions, or completed purchases.

2.4 Information Received from Third Parties

We may receive personal information from the following third-party sources:

Business Clients who integrate Karley AI on their websites may share product catalog data, website content, and aggregated or anonymized visitor data to train and configure the AI assistant for their specific use case.
Third-party AI model providers, such as OpenAI, may process data in connection with generating AI outputs as described further in Section 6.
Analytics and advertising partners that provide us with aggregated insights about website traffic and user engagement.

2.5 Sensitive Personal Information

We do not intentionally collect sensitive personal information (as defined under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”)), such as Social Security numbers, financial account credentials, precise geolocation, racial or ethnic origin, religious beliefs, health information, or sexual orientation data. If you voluntarily include sensitive personal information in your conversational inputs to the AI assistant, we strongly encourage you not to do so. To the extent we inadvertently receive sensitive personal information through conversational interactions, we will treat it in accordance with applicable law.

3. How We Use Your Information

We use the personal information we collect for the following purposes:

3.1 Providing and Operating the Services

We use your information to deliver the core functionality of our AI-powered shopping assistant, including processing your conversational inputs, generating AI-powered responses and product recommendations, facilitating product discovery and purchase decisions, and providing customer support.

3.2 AI Model Training, Improvement, and Optimization

We may use conversational data, interaction data, and engagement signals to train, fine-tune, and improve our AI models and algorithms. This includes using aggregated or de-identified conversational data to enhance the accuracy, relevance, and quality of AI-generated responses; analyzing interaction patterns to optimize the AI assistant’s ability to guide shoppers toward informed purchasing decisions; and developing new features, capabilities, and product offerings.

Where we use personal information for AI training purposes, we implement appropriate safeguards, including de-identification and aggregation techniques, to minimize privacy risks. We conduct risk assessments for AI training activities in accordance with applicable law, including the CCPA/CPRA’s requirements for processing personal information to train automated decision-making technology.

3.3 Analytics and Performance Measurement

We use information to measure and analyze the performance of our Services, including tracking conversion rates, engagement metrics, average order value, and other key performance indicators for our Business Clients.

3.4 Communications

We may use your contact information to send you service-related notices, respond to your inquiries, provide product updates, and, where permitted, send marketing communications. You may opt out of marketing communications at any time as described in Section 9.

3.5 Safety, Security, and Legal Compliance

We use information to detect and prevent fraud, abuse, and security threats; enforce our Terms of Service and other agreements; comply with applicable laws, regulations, and legal processes; and protect the rights, property, and safety of Karley AI, our Business Clients, and users.

4. Automated Decision-Making, Profiling, and AI-Generated Outputs

4.1 How Our AI Makes Decisions

Karley AI uses artificial intelligence, including large language models, to process your conversational inputs and generate responses in real time. Our AI assistant analyzes your questions, browsing context, and product-related inquiries to produce personalized product recommendations, answer pre-purchase questions, and suggest complementary or higher-value products. These AI-generated outputs are designed to assist you in making informed purchasing decisions. They are not intended to serve as the sole basis for decisions that produce legal effects or similarly significant effects on you.

4.2 Profiling Activities

Our Services may engage in profiling, meaning the automated processing of personal information to evaluate or predict certain aspects of your behavior, preferences, or interests. Specifically, our AI may analyze your browsing behavior and conversational inputs to infer product preferences, purchase intent, and shopping patterns. We use these inferences to provide you with more relevant and personalized shopping assistance.

4.3 Limitations of AI-Generated Outputs

AI-generated outputs, including product recommendations, answers to questions, and other conversational responses, are produced by machine learning models and may not always be accurate, complete, or up to date. You should independently verify any information provided by our AI assistant before making purchasing or other decisions. Karley AI does not guarantee the accuracy, reliability, or completeness of any AI-generated output.

4.4 Your Rights Regarding Automated Decision-Making

Under certain U.S. state privacy laws, you may have certain rights related to automated decision-making and profiling, including the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, the right to obtain meaningful information about the logic involved in automated decision-making, and the right to request human review of an automated decision. To exercise these rights, please contact us as described in Section 9.

Beginning January 1, 2027, to the extent our use of automated decision-making technology constitutes a “significant decision” under the CCPA/CPRA’s finalized regulations on automated decision-making technology, we will provide applicable pre-use notices, opt-out mechanisms, and access rights as required.

5. Data Retention

We retain personal information only for as long as reasonably necessary to fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law.

5.1 Conversational and Interaction Data

Conversational inputs, AI-generated outputs, and related interaction data collected through the AI shopping assistant are retained for up to twenty-four (24) months from the date of collection, after which they are either deleted or de-identified.

5.2 Account and Contact Information

If you have an account with us or have submitted a demo request, we retain your contact information for the duration of your business relationship with us and for up to thirty-six (36) months following the termination of that relationship, unless otherwise required by law.

5.3 AI Training Data

Data that has been incorporated into AI model training in de-identified or aggregated form is not subject to individual deletion requests, as it is no longer reasonably linked to an identifiable individual. We retain training datasets for as long as the associated AI models are in active use or development.

5.4 Usage and Analytics Data

Automatically collected usage data, including device information, IP addresses, and browsing activity, is retained for up to eighteen (18) months from the date of collection. Aggregated analytics data may be retained indefinitely.

5.5 Legal and Compliance Records

We may retain personal information for longer periods where necessary to comply with legal obligations, resolve disputes, enforce our agreements, or as required by applicable law.

6. How We Share Your Information

We do not sell your personal information in the traditional sense of exchanging it for monetary consideration. However, certain data-sharing activities described below may constitute a “sale” or “sharing” of personal information under the CCPA/CPRA or other state privacy laws, and you have the right to opt out of such activities as described in Section 8.

6.1 Third-Party AI Model Providers

To power our AI shopping assistant, we transmit certain data, including conversational inputs and contextual information, to third-party large language model providers, such as OpenAI, for the purpose of generating AI-powered responses. These providers process data on our behalf and in accordance with their own terms and privacy policies (e.g., OpenAI’s policies at https://openai.com/policies). We contractually require these providers to implement appropriate security measures and to limit their use of data processed on our behalf.

6.2 Business Clients

We share certain information with our Business Clients whose websites host the Karley AI assistant, including aggregated and de-identified analytics data regarding user engagement, conversion metrics, and frequently asked questions. We may also share individual-level conversational data or user interaction data with Business Clients where necessary to provide the Services, in accordance with the Business Client’s own privacy practices.

6.3 Cloud Infrastructure and Hosting Providers

We use third-party cloud infrastructure providers to host and operate our Services. These providers may process personal information on our behalf in accordance with our instructions and contractual obligations.

6.4 Analytics and Advertising Partners

We may share or make available certain usage data and online identifiers with analytics and advertising partners for purposes of measuring ad performance, attributing conversions, or delivering targeted advertising. To the extent this constitutes “sharing” under the CCPA/CPRA, you may opt out as described in Section 8.

6.5 Service Providers and Contractors

We engage service providers and contractors to perform functions on our behalf, such as payment processing, email delivery, customer support, and data analytics. These parties are contractually required to use personal information only for the purposes for which it was disclosed and in accordance with this Policy.

6.6 Legal and Regulatory Disclosures

We may disclose personal information to law enforcement agencies, courts, regulators, or other governmental authorities where required by law, legal process, or governmental request, or where we believe disclosure is necessary to protect our rights, property, or safety, or the rights, property, or safety of others.

6.7 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, personal information may be transferred to the acquiring entity, subject to applicable law.

7. Your Privacy Rights Under U.S. State Law

Depending on your state of residence, you may have certain rights regarding your personal information under applicable state consumer privacy laws. These laws include, but are not limited to, the CCPA/CPRA (California), the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), the Texas Data Privacy and Security Act (TDPSA), and other state privacy laws that are currently in effect or will take effect in the near future.

7.1 Right to Know and Access

You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which that information was collected, the business or commercial purposes for which the information was collected, used, sold, or shared, and the categories of third parties to whom the information was disclosed.

7.2 Right to Delete

You have the right to request the deletion of personal information we have collected from you, subject to certain exceptions permitted by law (for example, where retention is necessary to complete a transaction, comply with a legal obligation, or detect security incidents).

7.3 Right to Correct

You have the right to request that we correct inaccurate personal information that we maintain about you.

7.4 Right to Opt Out of Sale or Sharing

You have the right to direct us to stop selling or sharing your personal information. You may exercise this right by clicking the “Do Not Sell or Share My Personal Information” link on our website or by submitting a request as described in Section 9. We honor Global Privacy Control (“GPC”) signals as valid opt-out requests.

7.5 Right to Limit Use of Sensitive Personal Information

If we collect sensitive personal information, you have the right to direct us to limit its use to purposes that are necessary to perform the Services or as otherwise permitted by law.

7.6 Right to Opt Out of Profiling and Automated Decision-Making

Under certain state laws, you have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. Where applicable, you also have the right to request information about the logic of automated decision-making processes and to appeal automated decisions.

7.7 Right to Non-Discrimination

We will not discriminate against you for exercising any of your privacy rights. We will not deny you goods or services, charge you different prices, provide a different level or quality of service, or suggest that you will receive a different level of service because you exercised your rights.

7.8 Right to Appeal

If we deny your privacy rights request, in whole or in part, you have the right to appeal that decision. To submit an appeal, please contact us using the information provided in Section 9.

7.9 Authorized Agents

You may designate an authorized agent to submit a privacy rights request on your behalf. We may require verification of the agent’s authorization and your identity before fulfilling the request.

7.10 Verification

To protect your privacy and security, we will take reasonable steps to verify your identity before fulfilling a privacy rights request. The verification measures we apply will depend on the nature and sensitivity of the request.

8. Notice of Financial Incentives and “Do Not Sell or Share” Disclosure

8.1 Categories of Personal Information Sold or Shared

In the preceding twelve (12) months, we may have “sold” or “shared” (as those terms are defined under the CCPA/CPRA) the following categories of personal information: identifiers (such as online identifiers and IP addresses), internet or electronic network activity information (such as browsing history and interactions with our Services), and inferences drawn from the foregoing (such as product preferences and purchase intent). These disclosures were made to analytics providers, advertising networks, and Business Clients.

8.2 How to Opt Out

You may opt out of the sale or sharing of your personal information by clicking the “Do Not Sell or Share My Personal Information” link available on our website, enabling a Global Privacy Control signal in your browser, or contacting us as described in Section 9.

9. Contact Information and How to Exercise Your Rights

If you wish to exercise any of the privacy rights described in this Policy, or if you have questions or concerns about our privacy practices, you may contact us using the following methods:

By email: privacy@karley.ai

By mail: Karley AI, Inc., c/o Expedition Community, Inc., 4275 Executive Square, Suite 200, La Jolla, CA 92037

Through our website: [Insert link to privacy rights request webform]

We will respond to verifiable consumer requests within forty-five (45) calendar days of receipt. If we require additional time, we will notify you of the extension and the reason for it, and we will respond within ninety (90) calendar days of the original request.

10. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect information about your browsing activity and to improve your experience with our Services. The types of cookies we use include:

Strictly necessary cookies, which are essential for the operation of our website and Services and cannot be disabled.
Performance and analytics cookies, which help us understand how visitors interact with our website and Services, allowing us to improve functionality and user experience.
Functional cookies, which enable enhanced features and personalization, such as remembering your preferences.
Advertising and targeting cookies, which may be set by our advertising partners to build a profile of your interests and show you relevant advertisements on other websites.

You can manage your cookie preferences through your browser settings or through any cookie preference tool we make available on our website. Please note that disabling certain cookies may affect the functionality of our Services.

11. Data Security

We implement reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, use, disclosure, alteration, or destruction. Our security measures include, but are not limited to:

Encryption of personal information in transit using Transport Layer Security (TLS) and at rest using industry-standard encryption protocols.
Access controls that restrict access to personal information to authorized personnel who require such access to perform their job functions.
Regular security assessments and testing of our AI systems and infrastructure.
Contractual security requirements imposed on third-party service providers, including AI model providers and cloud infrastructure providers.
Incident response procedures designed to detect, investigate, and respond to security incidents in a timely manner.
AI-specific security measures, including monitoring of AI model inputs and outputs for anomalous activity, safeguards against prompt injection and adversarial attacks, and controls to prevent unauthorized extraction of training data from AI models.

While we take reasonable steps to protect your personal information, no method of transmission over the Internet or method of electronic storage is completely secure. We cannot guarantee the absolute security of your information.

12. Children’s Privacy

Our Services are not directed to, and we do not knowingly collect personal information from, children under the age of thirteen (13). We do not knowingly allow children under thirteen (13) to use the Karley AI shopping assistant. In accordance with the Children’s Online Privacy Protection Act (“COPPA”), if we become aware that we have collected personal information from a child under thirteen (13) without verified parental consent, we will take steps to delete such information promptly.

We also do not knowingly collect personal information from individuals under the age of sixteen (16) for the purpose of selling or sharing such information. If we learn that we have sold or shared the personal information of a consumer under sixteen (16), we will take prompt corrective action as required by law.

If you are a parent or guardian and believe your child has provided personal information through our Services, please contact us at privacy@karley.ai so that we can take appropriate action.

Our Business Clients are responsible for ensuring that their use of the Karley AI shopping assistant on their own websites complies with COPPA and any other applicable laws governing children’s privacy, including by implementing appropriate age gates or restrictions where necessary.

13. Third-Party Links and Services

Our Services may contain links to third-party websites, products, or services that are not owned or controlled by Karley AI. This Policy does not apply to the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party websites or services you visit or use.

14. U.S. State-Specific Disclosures

14.1 California (CCPA/CPRA)

The following disclosures are provided pursuant to the California Consumer Privacy Act, as amended by the California Privacy Rights Act.

Categories of personal information collected in the preceding twelve (12) months: identifiers; commercial information; internet or other electronic network activity information; geolocation data (general, not precise); inferences; and professional or employment-related information (for Business Client contacts).

Categories of sources: directly from you; automatically through your use of the Services; from Business Clients; and from third-party analytics providers.

Business or commercial purposes for collection: providing and improving the Services; AI model training and optimization; analytics and performance measurement; communications; and safety, security, and legal compliance.

Categories of third parties to whom personal information is disclosed: third-party AI model providers; Business Clients; cloud infrastructure providers; analytics and advertising partners; and service providers.

We do not use or disclose sensitive personal information for purposes other than those permitted under the CCPA/CPRA without providing consumers the right to limit such use.

14.2 Virginia, Colorado, Connecticut, Texas, and Other States

Residents of Virginia, Colorado, Connecticut, Texas, and other states with comprehensive consumer privacy laws may have rights to access, correct, and delete personal information; opt out of the sale of personal information, targeted advertising, and certain profiling activities; and appeal a denial of a privacy rights request. Please contact us as described in Section 9 to exercise these rights. We will process your request in accordance with applicable state law.

15. Changes to This Privacy Policy

We may update this Policy from time to time to reflect changes in our privacy practices, legal requirements, or business operations. When we make material changes to this Policy, we will notify you by posting the updated Policy on our website and updating the “Last Updated” date at the top of this page. For material changes, we may also provide notice through email or a prominent notice on our website. We encourage you to review this Policy periodically to stay informed about how we are protecting your information.

16. Additional Information About AI-Specific Practices

16.1 Transparency About AI Use

When you interact with the Karley AI shopping assistant, you are communicating with an artificial intelligence system, not a human being. Our AI assistant is designed to simulate natural conversation to help you with product discovery and purchasing decisions. We are committed to ensuring that users understand they are interacting with AI technology, and we provide clear disclosures to this effect within the conversational interface.

16.2 AI Model Governance

We maintain internal policies and procedures governing the development, deployment, and monitoring of our AI systems. These include regular evaluation of AI model performance for accuracy and relevance; monitoring for harmful, biased, or misleading outputs; documentation of AI system capabilities and limitations; and human oversight of AI system deployment and material updates.

16.3 No High-Risk Automated Decisions

Our AI shopping assistant is designed to provide product recommendations and answer shopping-related questions. It is not designed or intended to make decisions that produce legal effects or similarly significant effects on consumers, such as decisions related to employment, credit, housing, healthcare, or education. If our use of AI technology changes in a way that implicates high-risk automated decision-making, we will update this Policy accordingly and provide any notices or opt-out mechanisms required by applicable law.

16.4 AI Accuracy and Hallucination Risk

AI-generated responses may occasionally contain inaccuracies, outdated information, or fabricated details (sometimes referred to as “hallucinations”). We implement quality controls and monitoring to minimize such occurrences, but we cannot guarantee that all AI-generated outputs will be error-free. Users should exercise independent judgment and verify important information before relying on it.

17. Contact Us

For any questions about this Privacy Policy, to exercise your data rights, or to report a privacy concern, contact us at:

Expedition Community, Inc.

Email: support@karley.ai

Website: https://karley.ai