Privacy Policy

Effective 2026-10-09

Introduction

Welcome to Keldura. We respect your privacy and are committed to protecting your personal data. This privacy policy explains what information we collect, how we use it, and how Keldura handles content that you upload, import, process, or connect to the service.

It covers people with a Keldura account, visitors to our public pages, and people who talk to a Bot that a Keldura user has put on a website or in Telegram.

Data We Collect

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

Identity Data includes first name, last name, username or similar identifier.
Contact Data includes email address.
Authentication Data includes password hashes, verification tokens, reset tokens, login sessions, and the account identifier and email address we receive from Google or GitHub when you sign in with them.
Content Data includes URLs, uploaded files, files you pick from Google Drive, audio, video, PDF or text content, transcripts, translations, summaries, prompts, folder contents, chat messages, generated answers, citations, exports, and related metadata you create or import.
Briefings Data includes the topics, channels, feeds and websites you ask Keldura to follow, the items found there, the digests written from them, and your email digest settings.
Telegram Bot Data includes bot names, Telegram bot identifiers and usernames, encrypted BotFather tokens, token suffixes, webhook secrets, selected folders and prompts, allowed Telegram user IDs, group-chat settings, owner verification state, Telegram chat and user identifiers, usernames, display names, update IDs, message text needed to answer a request, generated replies, delivery status, and operational error metadata.
Website Widget Data includes, for people who chat with a Bot on a Keldura user's website, the messages they send, the answers they receive, the page they were on, a visitor token kept in their browser, and an email address or message if they choose to leave one for the site owner.
Developer Access Data includes API keys you create (stored so they cannot be read back), their names and when they were used, and a log of the tool calls made with them.
Sharing and Publishing Data includes folder or prompt share links, permissions, published-folder site settings, analytics settings, and access metadata for shared or published content.
Usage and Analytics Data includes information about feature usage, transcription and document-conversion counts, import runs, chat activity, file sizes, credit and quota usage, admin analytics, errors, and service health signals.
Technical Data includes internet protocol (IP) address, browser type and version, device and operating-system information, time zone setting, request logs, WebSocket connection metadata, and security or abuse-prevention signals.

How We Use Data

We use the data we collect to provide, secure, maintain, and improve Keldura. This includes authenticating users, processing transcription and document-conversion requests, importing content, indexing folders, answering chat and Telegram bot questions, showing citations and sources, enforcing plan limits, supporting public feature access settings, detecting errors or abuse, and helping operators troubleshoot service issues.

Where the law asks for a legal basis, we rely on these: providing the service you signed up for (your account, your content and the features you use); our legitimate interest in keeping Keldura secure, preventing abuse, fixing faults and counting anonymous usage; your consent for the optional analytics identifier described below; and legal obligations where they apply.

AI and Third-Party Processing

Keldura uses other companies to run parts of the product. Content and related metadata are sent to a provider only when a feature you use needs it. These are the companies that process content for us, and what each one does:

OpenAI: chat answers, summaries and AI-written Briefings, embeddings and file search, and cheatsheet images. Folders you index are stored in OpenAI vector stores so they can be searched.
xAI: turning speech into text, and cheatsheet images.
ElevenLabs: turning speech into text. Whether xAI or ElevenLabs transcribes a recording depends on your plan.
Mistral AI: reading the text of PDFs and images (OCR).
DeepL: translation.
Supadata: transcripts and details for links to YouTube and similar platforms.
Exa: fetching the web pages you import or ask Keldura to follow.
TypeSafe AI: working out the language or topic of short pieces of text, such as an item you follow or a question sent to a Telegram bot. Used only while we have this option switched on.
Google: sign-in with Google, video and channel details through the YouTube Data API, and the file picker when you import from Google Drive.
GitHub: sign-in with GitHub.
Telegram: delivering messages to and from the Telegram bots you connect, and Telegram imports.
Emailit: sending our emails, including account messages, Briefings digests, import summaries and messages passed on from a website widget.
Amazon Web Services: storing files. Heroku (Salesforce): hosting the application and its database. Cloudflare: domain, network and mail-routing services.

Importing or following a source also means fetching it from where it is published. Keldura's servers, or Exa on our behalf, request the page, feed, channel, handle or search you chose from that service, for example a website or podcast feed, YouTube, Bluesky, Hacker News (through Algolia's search service), arXiv or Telegram, and that service sees the request. In the app, your browser loads video thumbnails and embedded players directly from YouTube.

Keldura uses YouTube API Services to read details about videos, channels and playlists. If you use Keldura with YouTube links, the YouTube Terms of Service apply to you as well, and the Google Privacy Policy explains how Google handles data.

Telegram bot messages are received through Telegram webhook or polling APIs, stored as operational update logs, and processed against the folders and prompts selected by the bot owner. Telegram bot tokens are encrypted before storage and are not displayed after submission.

Payments

When you buy a paid plan or credit pack, payment is processed by Polar Software, Inc., our reseller and merchant of record. Polar receives the details needed to take payment and calculate tax; Keldura never receives or stores your card number.

Data Handling FAQ

Do uploads or imported sources train Keldura models?: No. Keldura uses your uploads, imported sources, transcripts, prompts, and chat messages to provide the features you request, troubleshoot the service, enforce limits, and keep the product reliable. We do not sell your content or use it to train Keldura models. The providers listed above receive content through their business APIs so they can return a result to us, and they handle it under their own terms.
When is content sent to AI or infrastructure providers?: Content may be sent to processors when a feature needs them, such as transcription, OCR, embeddings, folder search, summarization, translation, chat answers, Telegram bot replies, file storage, or email. We keep this processing tied to the action you requested and the operational records needed to run it.
What happens when I delete content?: Deleting an item removes it from your Keldura views straight away, with a short window to undo. A copy can stay in our database, in the search index held by our AI provider, and in backups after that. To have deleted content, or your whole account, erased for good, email hello@keldura.ai from the account's address. We complete erasure requests within 30 days.
Can I export my work?: Yes. Where export controls are available, you can export folders or generated assets in portable formats before deleting or moving work out of Keldura.
Do you count visits to public pages?: Yes, anonymously. On public pages such as the landing page, Keldura counts that the page was opened, which sections were shown, which buttons were pressed and roughly how long the page stayed open, together with the referring site, any campaign tags in the link and whether the screen is phone, tablet or desktop sized. These counts use no cookies and store nothing in your browser, and the identifier that groups them lasts only until the page is closed or reloaded. If you accept analytics in the consent banner, an identifier kept in your browser lets us link your visits. Once you reject analytics, the app stops sending these counts.
Are Keldura Daily pages counted the same way?: No. Keldura Daily pages have no consent banner. Our server counts a visit to a Daily edition at most once per visitor, using a hash of the visitor's IP address, the section and the edition's date, so that reloads and further pages of the same edition are not counted again. It stores no cookie for this. If you follow a sign-up link from a Daily page, a cookie that lasts 30 minutes remembers which link you used, and that is recorded with your new account.
Which emails does Keldura send?: Account messages such as address verification and password reset; a digest of your Briefings, if Briefings are on for your account; a summary when a larger import finishes; and, only if you turn them on, daily statistics for a Telegram bot and messages passed on from your website widget. Digest and summary emails carry an unsubscribe link that works without signing in. In a digest, the button that opens your Briefings and the story images link through Keldura so that we can count clicks; links to original sources go straight to the source.
Who handles privacy questions?: Keldura is operated by Yuri Zelikov (sole proprietor), trading as WavelyLabs. For privacy, deletion, export, or processor questions, contact hello@keldura.ai and include the account email and source type involved so we can route the request.

Cookies and Browser Storage

Keldura sets only its own cookies, and none for advertising:

short-lived cookies that keep a Google or GitHub sign-in safe while it completes;
a cookie that carries your sign-in to the Keldura API, removed when you close the browser;
a cookie that remembers a link you asked Keldura to try before signing up, for up to two hours;
a cookie that remembers how you first reached Keldura (the page you landed on, the site that linked you there and when), kept for 30 days so that, if you later create an account, we can record which source brought you;
the 30-minute Keldura Daily sign-up cookie described above.

The app also keeps data in your browser's local storage: your sign-in token, your theme and layout choices, hints and prompts you have dismissed or answered, your getting-started progress, your answer to the consent banner, and work in progress such as upload queues. If you allow functional storage, it also keeps a count of your visits and a note that the shortcuts tip was shown, so that tips appear at the right time, and the help chat on our landing page is loaded. If you allow analytics, it keeps the identifier that links your visits and notes of which one-time events it has already sent. A website widget keeps a visitor token in the browser of the person chatting, so that their conversation continues from page to page.

You can change or withdraw your answer at any time: . Withdrawing removes from this browser the visit count and the tip note, or the analytics identifier and its notes. We ask for your answer again after twelve months.

Public, Shared, and Connected Content

Some Keldura features can be used while logged out when public access is enabled, and some content can be shared or published by users. If you create a public or shared link, publish a folder site, add a Telegram bot to a chat, or enable group-chat access for a Telegram bot, people outside your Keldura account may be able to view or interact with the content you selected.

Storage, Security, and Retention

We use technical and organizational safeguards designed to protect account data, uploaded content, and connected service credentials. Keldura runs on servers in the United States and is operated from Israel; the providers listed above may process data in other countries.

We keep your account data and content for as long as your account exists. Some operational logs are removed automatically after a set period; Telegram bot chat sessions, for example, are removed after about three months without activity. Other records, including items you have deleted, usage counts and website-widget conversations, are kept until we are asked to erase them. Backups and copies held by our providers can remain for a limited period after erasure.

If You Talk to Someone Else's Bot

When you chat with a Bot on another person's website or in Telegram, that person chose what the Bot knows, and they may be able to read the conversation and any contact details you leave. Keldura stores these on their behalf. To have them removed, ask the Bot's owner or email hello@keldura.ai.

Your Rights

You can ask us for a copy of the personal data we hold about you, to correct it, to erase it, to stop or limit a particular use of it, or to send you your content in a portable form. Email hello@keldura.ai from the address on your account. We answer within 30 days and do not charge for it. If you are unhappy with our answer, you can complain to the data protection authority where you live.

Children

Keldura is not for children under 13. If you are under 18, you need a parent's or guardian's permission to use it. We do not knowingly collect personal data from children under 13; if you believe a child has given us data, tell us and we will delete it.

Changes to This Policy

When we change this policy we publish the new version here with a new effective date. We announce significant changes in the app's What's New page.

Your Choices

You can choose what content to upload, import, share, publish, or connect to Telegram bots. You can delete or update content through available product controls, rotate Telegram bot tokens or webhook secrets, stop or delete Telegram bots, remove shared links, and contact us to request help with account or data questions.

Operator

Keldura is operated by Yuri Zelikov (sole proprietor), trading as WavelyLabs, Tel Aviv, Israel.

Contact Us

If you have any questions about this privacy policy or our privacy practices, please contact us at hello@keldura.ai.