Privacy notice

1. Controller

2. Visiting this website

When you visit the website, our web server processes connection data required for technical delivery. This includes the IP address, time, requested resource, amount of data transferred, referrer and browser or operating-system details where supplied. We use this data for secure delivery, error diagnosis and attack prevention. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is secure and reliable operation.

Content-free access and error logs are normally deleted after seven days. Data isolated in connection with a documented security incident may be retained until the incident and any resulting claims are resolved.

3. Infrastructure and recipients

HostBrr

The website and Kaldur product platform run on a rented virtual machine in Frankfurt, Germany. Connection data and, after launch, account, content and operational data may be processed there. S3-compatible storage is used for product files and backups.

Cloudflare

Cloudflare is used for DNS and S3-compatible storage of publicly available installation files. DNS and download connection data may be processed. Conversation content, account data, privacy exports and backups are not intended for the installer storage.

4. Contact

If you contact us by email or telephone, we process the information you provide to handle the request. Depending on the context, the legal basis is Article 6(1)(b) or (f) GDPR. We delete enquiries once resolved unless contractual or statutory retention duties apply.

5. Intended processing in the Kaldur service

After launch, the data processed will depend on the functions used and may include account and organisation data, session and security data, conversations and prompts, uploaded and generated files, project knowledge, tool calls and results, settings, and usage and billing data.

Processing serves to provide the selected subscription, authenticate users, execute model and tool requests, enable collaboration, maintain security, bill usage and resolve errors. Relevant legal bases include Article 6(1)(b) GDPR, Article 6(1)(f) GDPR for necessary security measures, and Article 6(1)(a) GDPR where consent is specifically requested. Billing records subject to legal retention are processed under Article 6(1)(c) GDPR.

6. AI models, search and integrations

Depending on the model or tool selected, required prompts, relevant conversation excerpts, attachments, tool data and generated outputs may be sent to:

• Microsoft Azure AI / Azure OpenAI for model inference and optional provider file or vector functions,
• OpenAI for model inference and associated functions,
• OpenRouter to route requests to the selected model; the resolved downstream model provider is an additional recipient,
• Brave Search for searches requested explicitly or required by the selected function,
• plugins and remote systems configured by the user or organisation for the chosen action.

Kaldur is intended to send only the content required for each function. Available providers and models may depend on the plan and organisation. Processing outside the European Economic Area cannot be ruled out for every selected provider; the required data protection agreements and transfer mechanisms will be documented before activation.

7. Intended retention periods

Product content generally remains until a user deletes it, the account or contract ends, or an organisation policy applies. The initial baseline intended for the hosted service is:

• deleted content: a seven-day recovery period, followed by removal from live systems; a verified erasure request may shorten this period,
• consumer accounts: access and sessions disabled immediately; affected live data normally deleted within 30 days unless a duty or other legal basis applies,
• expired or revoked session records: no later than 30 days afterwards,
• technical replay detail for model runs: compacted after 90 days of inactivity unless needed for display, security, billing or a dispute,
• usage and non-statutory billing events: up to 24 months,
• privacy export packages: seven days after creation or 24 hours after first download, whichever is later, with an absolute maximum of 14 days,
• recovery backups: daily generations for 14 days and weekly generations for eight weeks; routine personal-data backups are not restorable beyond 60 days.

Statutory retention, security incidents, legal claims or a lawful instruction from a business customer may require different periods. Restored backups are checked against erasure suppressions so that previously deleted data does not persistently return.

8. Cookies and local storage

This public website currently sets no cookies and uses no analytics or advertising tracking. The Kaldur application will use technically necessary session information. Details will be added before the application is made available; non-essential access will occur only with any consent required.

9. Your rights

Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction, portability and objection. You can withdraw consent with future effect. You may also lodge a complaint with a data protection supervisory authority. Email [email protected] to exercise your rights.

10. Changes

We update this notice when functions, recipients or legal requirements change. A final review against the production configuration will take place before sales and public account registration begin.