Privacy Policy

01Who This Policy Covers

This Privacy Policy applies to Kalmari ("Kalmari," "we," "us") and the Kalmari Service, including the Telegram bot, the Mini App, the website at kalmari.app, and any other interface we provide. It does not apply to Kalshi, Telegram, or any other third-party service you connect to — please read their respective privacy policies.

02Information We Collect

Information you give us

• Telegram account information — your Telegram user ID, username, first name, and language code, as provided by Telegram when you start the bot or log in via the Telegram Login Widget.
• Account preferences and settings — model preferences, schedules, roles, mode (paper / live), and similar choices.
• Chat content — messages, prompts, voice notes, images, and files you send to the bot or the Mini App, and our AI-generated responses.
• Kalshi API Credentials — when you choose to use BYOK, the Kalshi-issued private key and key ID you upload. See §03 and §10.
• Billing information — if you subscribe to a paid plan, our payment processor (Stripe) collects and processes your payment-card information. We receive a transaction reference, the last four digits of your card, your billing country, and your subscription status — not the full card number.
• Support correspondence — anything you send when you contact us.

Information we generate from your use of the Service

• Trade and portfolio data — orders, positions, settlement history, and P&L derived from your activity on Kalshi (and from simulated activity in paper mode).
• Usage and diagnostic data — feature use, error logs, AI model used per request, approximate token counts and costs, and similar operational telemetry.
• Device and network data — IP address, approximate location (state-level), browser user-agent, and timestamps. We use these for security, abuse prevention, and geographic eligibility checks.
• Cookies and local storage — we use strictly necessary cookies for authentication (the signed session cookie set when you log in via the Telegram Login Widget) and may use functional cookies for preferences. We do not run third-party advertising or cross-site tracking pixels.

03Sensitive Personal Information

Your Kalshi API Credentials (key ID + RSA private key) are Sensitive Personal Information ("SPI") under California Civil Code §1798.140(ae) because they grant access to your financial account.

We use SPI only for the purposes you authorized in our BYOK terms — to read your Kalshi account state and place/amend/cancel orders on your behalf. We do not use SPI for advertising, profiling, cross-context behavioral marketing, or to train any AI model.

Where required by California, Colorado, Connecticut, Texas, or Virginia law, you have the right to limit our use of SPI to the purposes described above. We already operate at that limit by default; you may verify this at any time and revoke your credentials in the Service's settings. See §08.

04How We Use Information

We use the information described in §02 for the following business purposes:

• to authenticate you and to keep your account secure;
• to provide the Service — including AI-assisted analysis, signal feeds, paper and live order routing to Kalshi, scheduling, and portfolio tracking;
• to bill paid subscriptions and prevent fraudulent charges;
• to enforce geographic eligibility and the age gate;
• to detect and prevent abuse, fraud, market manipulation, and security incidents;
• to debug, improve, and operate the Service (aggregate usage analysis, error monitoring);
• to communicate with you about the Service, including security alerts, billing notices, and material changes to these terms;
• to comply with law, lawful requests from regulators or law enforcement, and our own legal obligations.

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined under California law.

05Who We Share With

We disclose personal information only as described here:

• Subprocessors — service providers that process personal information on our behalf under contract. See §06.
• Kalshi — when you place orders, your API requests (signed with your Kalshi key) go to Kalshi. We do not "share" your Telegram or chat data with Kalshi; only the order data necessary to fulfill your request.
• Payment processors — Stripe processes your payment card. We receive non-card billing metadata back.
• Legal, safety, and regulatory — we may disclose personal information to comply with subpoenas, court orders, or other lawful process; to protect the rights, property, or safety of Kalmari, our users, or the public; or in connection with a regulator's investigation.
• Business transfers — if Kalmari is acquired, merged, or its assets are sold, personal information may transfer to the successor entity, subject to this policy or a comparable successor policy.

06Subprocessors

We work with the following categories of subprocessors. Each is bound by a written data-protection agreement (where the vendor signs one) and processes personal information only to provide its service to Kalmari.

We will publish a more detailed and continuously updated list at kalmari.app/subprocessors as additional vendors are added.

07Retention

When a retention period ends or a deletion right is exercised, we delete or de-identify the information so that it can no longer be linked to you.

08Your Rights

Depending on the state you live in, you may have the following rights:

• Right to know what personal information we have collected, used, disclosed, or sold/shared.
• Right to access a copy of the personal information we hold about you, in a portable format.
• Right to delete your personal information, subject to legal exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of any sale or "share" of personal information. (We do not sell or share — see §04.)
• Right to limit the use and disclosure of SPI to the purposes described in §03.
• Right to non-discrimination for exercising any of these rights.
• Right to appeal our decision on a rights request, where required by state law (Colorado, Connecticut, Virginia, and others).
• Right to designate an authorized agent to act on your behalf.

To exercise any of these rights, contact us at [email protected]. We will verify your identity (typically by confirming control of the Telegram account or the email tied to your billing) and respond within the timeframes required by your state's law (45 days under CCPA/CPRA, extendable by another 45 days where reasonably necessary).

09Global Privacy Control

We recognize and honor the Global Privacy Control (GPC) browser signal as a universal opt-out mechanism, as required by the California Privacy Protection Agency's regulations and the Colorado Attorney General's rules. If you visit our website with a browser that transmits a GPC signal, we treat it as an opt-out of sale and of cross-context behavioral advertising — even though we do not currently engage in either.

10Security

We take reasonable and appropriate technical and organizational measures to protect personal information. These include:

• Encryption in transit — TLS on all public endpoints.
• Encryption at rest for API Credentials — AES-256-GCM authenticated encryption for stored Kalshi keys.
• Least-privilege access — production access is restricted to personnel who need it and requires multi-factor authentication.
• No credentials in logs — Kalshi API keys and similar secrets are never written to application logs, error reports, or analytics systems.
• Monitoring — error tracking, anomaly detection, and abuse signals.
• Vulnerability response — we triage and patch known vulnerabilities in the libraries and platforms we depend on.

No security system is impenetrable. You can help by keeping your Telegram account secure (enable two-factor authentication), revoking your Kalshi API key on Kalshi if a device is lost, and contacting us promptly if you suspect anything is wrong.

11Breach Notification

If we confirm a security incident that has compromised your personal information, we will notify you within 72 hours of confirmation via Telegram and (where we have it) email, and we will notify regulators on the timelines required by applicable state law — including New York SHIELD Act (within 30 days of discovery), Texas Business & Commerce Code §521.053 (within 60 days for consumers and 30 days for the Attorney General when ≥250 Texas residents are affected), Colorado §6-1-716 (within 30 days), Massachusetts 201 CMR 17 / Chapter 93H, and California Civil Code §1798.82.

12Children

The Service is for adults. We do not knowingly collect personal information from anyone under 18 years of age. If you believe a child has provided us with personal information, contact us at [email protected] and we will delete it.

13No EU / UK Service

Kalmari is offered to residents of the United States only. We do not knowingly collect personal information from residents of the European Union, the United Kingdom, or any other jurisdiction outside the United States, and we have not appointed an EU or UK representative. If you are outside the United States, please do not use the Service.

14Changes

We may update this Privacy Policy from time to time. If we make a material change, we will notify you through the Service or by email and update the "Effective" date above. Your continued use of the Service after the change takes effect means you accept the updated policy.

15Contact

Questions or requests about your personal information? Reach our privacy team at [email protected]. For all other matters, see the contact section of our Terms of Service.