Privacy Policy

Introduction

Welcome to Keldura. We respect your privacy and are committed to protecting your personal data. This privacy policy explains what information we collect, how we use it, and how Keldura handles content that you upload, import, process, or connect to the service.

It covers people with a Keldura account, visitors to our public pages, and people who talk to a Bot that a Keldura user has put on a website or in Telegram.

Data We Collect

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Identity Data includes first name, last name, username or similar identifier.
• Contact Data includes email address.
• Email Delivery Data includes, for the address of an email we sent or tried to send, a record of the reports our email provider passes on that an email bounced, was not sent because the provider blocks the address, or was reported as spam (the report's identifier, the address, the kind of report and when we handled it), the day the last bounce was reported, whether, when and why we paused emails to the address, and when this information last changed.
• Authentication Data includes password hashes, verification tokens, reset tokens, a record of each browser sign-in, and the account identifier and email address we receive from Google or GitHub when you sign in with them. The record of a browser sign-in (a "session") holds a random session identifier, the account it belongs to, when the sign-in started, when it was last extended, when it expires, the latest date it can be extended to, and when it was ended, if it was. It holds no IP address and nothing about your device.
• How You Heard About Keldura includes, when we ask after a new account is created, the answer you pick from a fixed list, a note if you write one, and when you answered. If you skip, we store that you skipped and when, and we do not store a choice or a note. We ask once. We do not ask accounts that already existed.
• Terms Agreement Data includes when you agreed to our Terms of Service and the effective date of the version you agreed to. We record it when you create an account, or, for an account created before we kept this record, when you agree before your first purchase.
• Content Data includes URLs, uploaded files, files you pick from Google Drive, audio, video, PDF or text content, transcripts, translations, summaries, prompts, folder contents, chat messages, generated answers, citations, exports, and related metadata you create or import.
• Briefings Data includes the topics, channels, feeds and websites you ask Keldura to follow, the items found there, the digests written from them, and your email digest settings.
• Telegram Bot Data includes bot names, Telegram bot identifiers and usernames, encrypted BotFather tokens, token suffixes, webhook secrets, selected folders and prompts, allowed Telegram user IDs, group-chat settings, owner verification state, Telegram chat and user identifiers, usernames, display names, update IDs, message text needed to answer a request, generated replies, delivery status, and operational error metadata.
• Website Widget Data includes, for people who chat with a Bot on a Keldura user's website, the messages they send, the answers they receive, the page they were on, a visitor token kept in their browser, and an email address or message if they choose to leave one for the site owner.
• Developer Access Data includes API keys you create (stored so they cannot be read back), their names and when they were used, and a log of the tool calls made with them.
• Sharing and Publishing Data includes folder or prompt share links, permissions, published-folder site settings, analytics settings, and access metadata for shared or published content.
• Usage and Analytics Data includes information about feature usage, transcription and document-conversion counts, import runs, chat activity, file sizes, credit and quota usage, admin analytics, errors, and service health signals.
• Technical Data includes internet protocol (IP) address, browser type and version, device and operating-system information, time zone setting, request logs, WebSocket connection metadata, and security or abuse-prevention signals.

How We Use Data

We use the data we collect to provide, secure, maintain, and improve Keldura. This includes authenticating users, processing transcription and document-conversion requests, importing content, indexing folders, answering chat and Telegram bot questions, showing citations and sources, enforcing plan limits, supporting public feature access settings, detecting errors or abuse, and helping operators troubleshoot service issues.

Where the law asks for a legal basis, we rely on these: providing the service you signed up for (your account, your content and the features you use); our legitimate interest in keeping Keldura secure, preventing abuse, fixing faults, limiting the emails we send to addresses that bounce or report them as spam, and counting anonymous usage; your consent for the optional analytics identifier described below; and legal obligations where they apply.

AI and Third-Party Processing

Keldura uses other companies to run parts of the product. Content and related metadata are sent to a processor only when a feature you use needs it. These are the kinds of processing we use. We name a company only when the product or the law requires it:

• AI, speech-to-text, OCR, translation, fetch and classification processors: we send content through their business APIs so they can return chat answers, summaries and AI-written Briefings, embeddings and folder search, cheatsheet images, speech-to-text, the text of PDFs and images, translations, transcripts and details for links to YouTube and similar platforms, the pages you import or ask Keldura to follow, and the language or topic of short pieces of text such as an item you follow or a question sent to a Telegram bot. Classification is used only while we have that option switched on. Folders you index are stored in a vector store at our AI processor so they can be searched. Which speech-to-text processor transcribes a recording depends on your plan.
• Transactional email provider: sending our emails, including account messages, Briefings digests, import summaries and messages passed on from a website widget. While we have delivery reports switched on, it also tells us when an email bounced, was not sent because it blocks the address, or was reported as spam.
• Cloud object storage: storing files.
• Application and database host: hosting the application and its database.
• Google: sign-in with Google, video and channel details through the YouTube Data API, and the file picker when you import from Google Drive.
• GitHub: sign-in with GitHub.
• Telegram: delivering messages to and from the Telegram bots you connect, and Telegram imports.
• Cloudflare: domain, network and mail-routing services.

Importing or following a source also means fetching it from where it is published. Keldura's servers, or a fetch processor on our behalf, request the page, feed, channel, handle or search you chose from that service, for example a website or podcast feed, YouTube, Bluesky, Hacker News (through a search API for that followed source), arXiv or Telegram, and that service sees the request. In the app, your browser loads video thumbnails and embedded players directly from YouTube.

Keldura uses YouTube API Services to read details about videos, channels and playlists. If you use Keldura with YouTube links, the YouTube Terms of Service apply to you as well, and the Google Privacy Policy explains how Google handles data.

Telegram bot messages are received through Telegram webhook or polling APIs, stored as operational update logs, and processed against the folders and prompts selected by the bot owner. Telegram bot tokens are encrypted before storage and are not displayed after submission.

Payments

When you buy a paid plan or credit pack, payment is processed by Polar Software, Inc., our reseller and merchant of record. Polar receives the details needed to take payment and calculate tax; Keldura never receives or stores your card number.

Data Handling FAQ

Do uploads or imported sources train Keldura models?

No. Keldura uses your uploads, imported sources, transcripts, prompts, and chat messages to provide the features you request, troubleshoot the service, enforce limits, and keep the product reliable. We do not sell your content or use it to train Keldura models. The providers listed above receive content through their business APIs so they can return a result to us, and they handle it under their own terms.

When is content sent to AI or infrastructure providers?

Content may be sent to processors when a feature needs them, such as transcription, OCR, embeddings, folder search, summarization, translation, chat answers, Telegram bot replies, file storage, or email. We keep this processing tied to the action you requested and the operational records needed to run it.

What happens when I delete content?

Deleting an item removes it from your Keldura views straight away, with a short window to undo. A copy can stay in our database, in the search index held by our AI provider, and in backups after that. To have deleted content, or your whole account, erased for good, email hello@keldura.ai from the account's address. We complete erasure requests within 30 days.

Can I export my work?

Yes. Where export controls are available, you can export folders or generated assets in portable formats before deleting or moving work out of Keldura.

Do you count visits to public pages?

Yes, anonymously. On public pages such as the landing page, Keldura counts that the page was opened, which sections were shown, which buttons were pressed and roughly how long the page stayed open, together with the referring site, the campaign tags in the link (utm_source, utm_medium, utm_campaign, utm_term and utm_content) and whether the screen is phone, tablet or desktop sized. Advertising click ids in the link, gclid, gbraid, wbraid, msclkid and fbclid, are not included in these counts. These counts use no cookies and store nothing in your browser, and the identifier that groups them lasts only until the page is closed or reloaded. If you accept analytics in the consent banner, an identifier kept in your browser lets us link your visits. Once you reject analytics, the app stops sending these counts.

Are Keldura Daily pages counted the same way?

No. Keldura Daily pages have no consent banner. Our server counts a visit to a Daily edition at most once per visitor, using a hash of the visitor's IP address, the section and the edition's date, so that reloads and further pages of the same edition are not counted again. The hash is keyed with a secret held on our server, so the stored value cannot be turned back into an address without it. It stores no cookie for this. If you follow a sign-up link from a Daily page, the link itself carries which Daily page you came from, the sign-up page passes that on with your sign-up, and it is recorded with your new account. No cookie is set for this either.

Which emails does Keldura send?

Account messages such as address verification and password reset; a digest of your Briefings, if Briefings are on for your account; a summary when a larger import finishes; a reminder when items of an import that were waiting for credits can be finished; and, only if you turn them on, daily statistics for a Telegram bot and messages passed on from your website widget. Digest and import emails carry an unsubscribe link that works without signing in. In a digest, the button that opens your Briefings and the story images link through Keldura so that we can count clicks; links to original sources go straight to the source.

What happens when an email to me bounces or is reported as spam?

When our email provider reports that an email we sent bounced, that it did not send one because it blocks the address, or that one was reported as spam, we keep a record of the report. If bounces are reported for an address on two different days within 30 days, or the provider reports that it blocks the address, we pause Briefings digests and import emails to that address; account messages such as a password reset are still sent. If it is the address on your account, Account settings says that these emails are paused and why, and lets you resume them. A spam report that reaches us turns the same emails off for the account with that address, and you can turn them back on in Account settings. A spam report reaches us only when your mailbox provider passes it on, so to be sure of stopping these emails, use the unsubscribe link in one of them or Account settings.

Who handles privacy questions?

Keldura is operated by Yuri Zelikov (sole proprietor), trading as WavelyLabs. For privacy, deletion, export, or processor questions, contact hello@keldura.ai and include the account email and source type involved so we can route the request.

Cookies and Browser Storage

Keldura sets its own cookies, Google Ads cookies when advertising is allowed, and Microsoft Clarity cookies when analytics is allowed:

• short-lived cookies that keep a Google or GitHub sign-in safe while it completes;
• a cookie that keeps you signed in. Pages and scripts in your browser cannot read it (it is HttpOnly), and the browser sends it only to Keldura. It lasts up to seven days and is extended while you keep using Keldura, but never beyond 30 days after you signed in. Signing out removes it, and "Sign out of all devices" in Settings ends every browser sign-in on your account;
• a cookie that remembers a link you asked Keldura to try before signing up, for up to two hours;
• a cookie that remembers how you first reached Keldura (the page you landed on, the site that linked you there and when), kept for 30 days so that, if you later create an account, we can record which source brought you, including utm_source, utm_medium, utm_campaign, utm_term and utm_content when the link carried them. Advertising click ids in that link (gclid, gbraid, wbraid, msclkid and fbclid) are not kept in this cookie or in the account record of how you arrived.
• when advertising is allowed, Google Ads cookies whose names start with _gcl_. Those cookies are for a conversion event and the click id. When advertising is allowed, a hashed email may be sent to Google so it can match an ad click to a signup. No phone number, name or address is sent. In the European Economic Area, the United Kingdom and Switzerland, and when we cannot tell the region, advertising stays off until you allow it. Where we can tell that you are somewhere else, it is on until you turn it off. A browser that sends Global Privacy Control turns it off. You can turn it off in one click from the banner, or under Cookie settings.
• when analytics is allowed, Microsoft Clarity cookies named _clck and _clsk. Clarity records masked page interaction on public marketing pages only, such as the home page, pricing, features and other public pages. It does not run on the pages you use after you sign in. Text on those pages is masked. In the European Economic Area, the United Kingdom and Switzerland, and when we cannot tell the region, this stays off until you allow analytics. Where we can tell that you are somewhere else, it is on until you turn analytics off. A browser that sends Global Privacy Control turns it off. You can turn it off in one click from the banner, or under Cookie settings.

The app also keeps data in your browser's local storage: a note of who is signed in (your username, email address and account roles, never a password), a sign-in token only if your browser does not keep the session cookie, your theme and layout choices, hints and prompts you have dismissed or answered, your getting-started progress, your answer to the consent banner, and work in progress such as upload queues. If you allow functional storage, it also keeps a count of your visits and a note that the shortcuts tip was shown, so that tips appear at the right time, and the help chat on our public pages is loaded. If you allow analytics, it keeps the identifier that links your visits and notes of which one-time events it has already sent. A website widget keeps a visitor token in the browser of the person chatting, so that their conversation continues from page to page.

You can change or withdraw your answer at any time: open Cookie settings. Withdrawing functional storage removes from this browser the visit count, the tip note, and any chat visitor token kept on our site with its notes of what you dismissed, so that allowing it again does not reconnect an earlier help-chat conversation. Withdrawing analytics removes the analytics identifier and its notes. It also removes the Microsoft Clarity cookies named _clck and _clsk from this browser. Withdrawing advertising removes the Google Ads cookies whose names start with _gcl_ from this browser. We ask for your answer again after twelve months.

Public, Shared, and Connected Content

Some Keldura features can be used while logged out when public access is enabled, and some content can be shared or published by users. If you create a public or shared link, publish a folder site, add a Telegram bot to a chat, or enable group-chat access for a Telegram bot, people outside your Keldura account may be able to view or interact with the content you selected.

Storage, Security, and Retention

We use technical and organizational safeguards designed to protect account data, uploaded content, and connected service credentials. Keldura runs on servers in the United States and is operated from Israel; the providers listed above may process data in other countries.

We keep your account data and content for as long as your account exists. That includes your answer to how you heard about Keldura, or the record that you skipped the question. Some operational logs are removed automatically after a set period; Telegram bot chat sessions, for example, are removed after about three months without activity. We delete the record of a browser sign-in 30 days after that sign-in ended, whether it expired, reached its 30-day limit or was ended in some other way. A scheduled job does this every hour and tries again at its next run if it fails, so a record can stay longer than 30 days. We keep the record of a bounce, blocked email or spam report for 30 days, so that one report is not counted twice, and delete older records as later reports from our email provider arrive; a record can therefore stay longer than 30 days. Other records, including items you have deleted, usage counts, website-widget conversations and the list of addresses our emails could not reach, are kept until we are asked to erase them. Backups and copies held by our providers can remain for a limited period after erasure.

If You Talk to Someone Else's Bot

When you chat with a Bot on another person's website or in Telegram, that person chose what the Bot knows, and they may be able to read the conversation and any contact details you leave. Keldura stores these on their behalf. To have them removed, ask the Bot's owner or email hello@keldura.ai.

Your Rights

You can ask us for a copy of the personal data we hold about you, to correct it, to erase it, to stop or limit a particular use of it, or to send you your content in a portable form. Email hello@keldura.ai from the address on your account. We answer within 30 days and do not charge for it. If you are unhappy with our answer, you can complain to the data protection authority where you live.

Children

Keldura is not for children under 13. If you are under 18, you need a parent's or guardian's permission to use it. We do not knowingly collect personal data from children under 13; if you believe a child has given us data, tell us and we will delete it.

Changes to This Policy

When we change this policy we publish the new version here with a new effective date. We announce significant changes in the app's What's New page.

Your Choices

You can choose what content to upload, import, share, publish, or connect to Telegram bots. You can delete or update content through available product controls, rotate Telegram bot tokens or webhook secrets, stop or delete Telegram bots, remove shared links, and contact us to request help with account or data questions.

Operator

Keldura is operated by Yuri Zelikov (sole proprietor), trading as WavelyLabs, Tel Aviv, Israel.

Contact Us

If you have any questions about this privacy policy or our privacy practices, please contact us at hello@keldura.ai.