Privacy Policy

1. Introduction

Kelu ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI knowledge assistant platform and related services.

It covers our website (kelu.dev), the dashboard (app.kelu.dev), our APIs and SDKs, the website widget, chat bots, helpdesk integrations and browser extensions (together, the "Service").

2. Our Role

We play two different roles, depending on whose data it is:

• Controller for your account data: who you are, how you sign in, how you pay, and how you use the dashboard and our website.
• Processor for the content you connect and for the questions your readers ask. You decide what goes into your knowledge bases and where the assistant is shown. We process that data only to provide the Service to you, as set out in our Data Processing Agreement.

If you chatted with a Kelu assistant on another company's website, in their helpdesk, or in their Slack or Teams, that company controls your data. Please contact them first about it. We will help them answer your request.

3. Information We Collect

Information You Provide

• Account information (name, email, password)
• If you sign in with Google, GitHub or your company's single sign-on: your name, email address and profile picture from that provider
• Company name and the docs website you enter at signup
• Workspace details: team members you invite, their roles, and your settings
• Billing information (processed by Stripe, our payment provider)
• Support communications

Customer Content We Process on Your Behalf

• Content from knowledge sources you connect — crawled documentation pages, repositories, wikis, uploaded files, and connector content (e.g. Notion, Confluence, Google Drive, OneDrive)
• Resolved helpdesk tickets and other support content you choose to index
• Vector embeddings generated from your content, stored in our database to power search and retrieval
• Custom answers you write, and the style instructions you give the assistant
• Access tokens, API keys and passwords you give us to reach your sources, helpdesks and AI providers

End-User Interactions

• Questions asked through the widget, APIs, chat integrations, or portal
• Conversation history and AI-generated answers with citations
• Feedback on answers (e.g. thumbs up/down)
• Incoming helpdesk tickets that Kelu answers, drafts a reply for, or tags
• A random reader ID that the widget keeps in the reader's browser. Readers do not need to give a name or email to chat. You may pass in details about a signed-in reader yourself; if you do, we store what you send.

Information Collected Automatically

• Log data (IP address, browser type, pages visited)
• Device information
• Usage analytics
• Cookies and similar technologies

Answer analytics store no reader IP addresses.

4. How We Use Your Information

• Provide and maintain our services — including indexing your connected content, generating embeddings, and answering questions with AI
• Show you analytics about your assistant, such as question volume and questions it could not answer
• Process your transactions
• Send service-related communications
• Improve our platform
• Respond to your inquiries
• Detect and prevent fraud
• Keep the Service secure, for example by blocking bots and limiting how often a password reset can be requested

5. Legal Bases

Where laws such as the GDPR apply, we rely on these legal bases:

• Contract: to run your account and provide the Service you signed up for
• Legitimate interests: to secure the Service, prevent abuse and improve the product
• Consent: for non-essential cookies on our website and for marketing emails. You can withdraw consent at any time.
• Legal obligation: to keep billing records and respond to lawful requests

6. How AI Processing Works

• To index your content, we split it into sections and send them to an embedding model to create embeddings.
• To answer a question, we find the most relevant sections of your content and send them, with the question, to an AI model that writes the answer.
• If a workspace brings its own model, answers run on that workspace's own provider account instead.
• We do not use your content or conversations to train AI models, and our AI providers do not use them to train theirs.
• You can turn on PII masking for a knowledge base. It replaces emails, phone numbers, card numbers, bank account numbers, IP addresses and your own patterns with placeholders before content is stored or sent to an AI model.

7. Data Sharing

We do not sell your personal information. We may share information with:

• Service providers (subprocessors) who assist in our operations
• Legal authorities when required by law
• Business partners with your consent
• A buyer or successor, if Kelu is merged, acquired or sells its assets. This policy will keep applying to your data.

Subprocessors

To provide the Service, we share limited data with these subprocessors:

Services You Connect

When you connect a source, helpdesk or chat app (for example Google Drive, GitHub, Zendesk, Intercom or Slack), we read from it and, for helpdesks and bots, post replies to it, only as you set up. Those services handle data under their own privacy policies. You can disconnect them at any time in the dashboard or in the service itself.

8. Google User Data

If you sign in with Google or connect Google Drive, we use the data we receive from Google only to sign you in and to index the folders and files you pick. Drive access is read-only: we never change anything in your Drive. Kelu's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for ads, and we do not use it to train AI models.

9. Cookies and Browser Storage

• Our website shows a cookie banner. Non-essential cookies are set only after you agree, and you can change your choice at any time from the banner.
• The dashboard uses cookies and browser storage to keep you signed in and to protect sign-in and connect flows from forgery. These are required for the dashboard to work.
• The widget stores a random reader ID and recent answers in the reader's browser, so it can count distinct readers and avoid asking the same question twice. It sets no advertising cookies.
• reCAPTCHA may set Google cookies to tell people from bots.

10. Emails

We send service emails, such as invitations, password resets, usage alerts and failed sync notices. Owners and admins can turn usage alerts off in their settings. We cap how many emails any one person can receive from us in a day. If you join our newsletter, you can unsubscribe at any time.

11. Data Security

We implement industry-standard security measures to protect your data, including encryption in transit and at rest, regular security audits, and access controls. However, no method of transmission over the internet is 100% secure.

• Passwords are stored as bcrypt hashes, never in plain text.
• Credentials for your sources, helpdesks and AI providers are encrypted with AES-256-GCM and are never shown again after you save them.
• Client secrets and API keys are shown once. We store only a hash.
• You can turn on two-factor authentication, and Enterprise workspaces can require single sign-on.
• Kelu staff access to a workspace, for example to help with a support request, is recorded in an internal audit log.

If a breach affects your data, we will tell you without undue delay, and within 72 hours of learning about it. See our Security page for more.

12. Data Retention

We retain your data for as long as your account is active or as needed to provide services. Workspaces can configure data retention policies, including rolling retention windows for conversation data and a zero-data-retention mode. The platform also supports PII masking (e.g. emails, phone numbers, card numbers), off by default and turned on per knowledge base. It masks indexed content, and questions from the widget, the SDKs, the public chat API and Ask, before they are stored or sent to an LLM provider. Questions from chat bots, the form deflector, helpdesk automation, MCP and the search API are not masked. Deleting a source or knowledge base removes its indexed documents and embeddings. You can request deletion of your data at any time by contacting support.

• Keep forever (the default): conversations are kept until you delete them.
• 30, 90 or 365 days: once a day we delete conversations, messages, feedback and traces older than the window.
• Zero data retention: questions are answered but not stored. We keep only a daily count of questions, with no text, to measure your monthly allowance.

When a subscription ends, the workspace moves to the Free plan and nothing is deleted. When an account is closed, we delete or return its data within 30 days, unless the law requires us to keep it. Billing records are kept as long as tax law requires.

13. Your Rights

Depending on your location, you may have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Object to processing
• Data portability
• Withdraw consent

To use any of these rights, email [email protected]. We may ask you to confirm your identity first, and we reply within 30 days. You can also complain to your local data protection authority. We do not sell or share personal information for advertising, and we treat everyone who uses a privacy right the same way.

14. International Transfers

Your data may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place for such transfers in compliance with applicable laws. Your data is stored in the United States. For data from the European Economic Area, the UK and Switzerland, we use the European Commission's Standard Contractual Clauses.

15. Automated Answers

Kelu writes answers automatically, and a customer can set it to reply to support tickets without a person checking first. These answers do not make decisions with legal or similarly significant effects about you. You can always ask the company you are talking to for a person.

16. Children's Privacy

Our services are not intended for individuals under 16 years of age. We do not knowingly collect personal information from children.

17. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date. If a change is significant, we will also email workspace owners before it takes effect.

18. Contact Us

If you have questions about this Privacy Policy, please contact us at:

Email: [email protected]
Address: Atatus, Inc., 131 Continental Dr, Suite 305, Newark, Delaware 19713, United States