Privacy policy
Updated July 30, 2026
This policy explains how personal data is handled on kvelo.dev and in the limited Kvelo product infrastructure used to deliver access and encrypted backups.
1. General
1.1. The Operator is Kvelo, developer and owner of the product of the same name. All enquiries: info@kvelo.dev.
1.2. Processing is carried out under the personal data law applicable to the Operator. Where a User is located in the European Economic Area or the United Kingdom, the Operator additionally applies the principles of the General Data Protection Regulation (GDPR).
1.3. By using the Site or Product and submitting data through the form, the User confirms they have read this policy. A User who does not accept it should stop using the relevant service.
1.4. The Operator does not control third-party sites and services the User connects to the Product or reaches through links. Their own privacy terms govern their processing.
2. What personal data is processed
2.1. Data the User provides through the request form:
- name (required);
- email address (required);
- phone number (optional);
- Telegram username (optional).
2.2. Data transmitted automatically while using the Site:
- IP address and the approximate region derived from it;
- browser and operating system type and version, device type, screen resolution, interface language;
- referral source including UTM parameters, and the previous page address;
- behaviour on the Site: pages viewed, scroll depth, clicks, session duration;
- cookie identifiers and similar technologies.
2.3. The Site form is not intended for special-category or biometric data. The User controls the contents of working files in the Product; that content may enter an encrypted backup without the Operator analysing it.
2.4. The workspace, memory, and files live on the User’s computer and personal server. While backup is active, the Product periodically sends encrypted backups to Kvelo infrastructure. No more than the seven latest copies are retained. The recovery key is derived from the access key recorded by the Operator, so the Operator has a technical route to decrypt a backup for an agreed recovery or a binding legal requirement.
2.5. To complete tasks, required data is sent to the Model and services selected by the User. For some connections, authorization data may be processed by an external connection broker. Processing is limited by the access the User approves and can revoke.
3. Purposes of processing
| Purpose | Data used |
|---|---|
| Handling the request and granting access to the Product | name, email, phone, Telegram |
| Replying to enquiries | name, email, phone, Telegram |
| Informing about the Product and changes to it | name, email |
| Analysing and improving the Site | technical and behavioural data |
| Site security and protection from automated requests | IP address, technical data |
| Product backup and recovery | encrypted workspace bundle, subscriber identifier, technical operation logs |
3.2. The Operator does not make decisions producing legal effects for the User based solely on automated processing.
3.3. The Operator does not sell personal data and does not share it with third parties for advertising purposes.
4. Lawful basis
4.1. The User’s consent, given by completing and submitting the form on the Site. The wording of that consent is set out in Data processing consent.
4.2. Performance of a contract to which the User is a party, or steps taken at the User’s request before entering into a contract.
4.3. The Operator’s legitimate interest in keeping the Site working and secure, where this does not override the User’s rights and freedoms.
5. Who processes the data
5.1. The following parties may process data to operate the Site and Product. Infrastructure providers process data on the Operator’s instructions; the provider of the selected Model, services connected by the User, and a connection broker also act under their own terms accepted by the User when connecting them:
| Party | Purpose |
|---|---|
| Attio (Attio Ltd) | customer relationship management, where requests are recorded |
| Telegram Messenger | notifying the Operator that a request arrived |
| Google Analytics (Google LLC) | anonymised visit statistics |
| PostHog (PostHog Inc.) | product analytics, including session recording on the Site |
| Yandex Metrica (Yandex LLC) | visit statistics and click maps |
| Cloudflare (Cloudflare Inc.), including R2 | site hosting, form protection, and encrypted-backup storage |
| Provider of the Model selected by the User | processing data required to complete an assigned task |
| Services connected by the User | reading or changing data within permissions approved by the User |
| Composio or another connection broker selected during setup | authorization and actions in services connected by the User |
5.2. Session recording. PostHog records pointer movement, scrolling, clicks and navigation between pages. Form field contents are masked and are not visible to the Operator.
5.3. International transfers. Some processors listed above operate outside the Operator’s country, so data may be processed abroad. The User consents to the applicable transfer by submitting the form or connecting the relevant service.
6. Retention
6.1. Form data is kept until the purposes of processing are met, the User withdraws consent, or the Operator ceases to operate, whichever comes first.
6.2. Analytics data is kept for the periods set by each service, typically between a few months and two years.
6.3. Once the purposes are met, or on withdrawal of consent or a User request, data is erased or anonymised within 30 days.
6.4. Kvelo infrastructure retains no more than the seven latest encrypted backups. An older copy is removed automatically when a new one is added. Remaining copies are deleted on a verified User request within the period in clause 6.3 unless the law requires retention.
7. Cookies
7.1. The Site uses cookies that are technically necessary for it to work and remember the User’s choices, and analytics cookies set by the processors listed in section 5.
7.2. Cookies can be blocked or deleted in browser settings. Blocking technically necessary cookies may affect some Site functions.
7.3. Continuing to use the Site without changing browser settings constitutes consent to the use of cookies.
8. Your rights
8.1. The User has the right to:
- obtain information about the processing of their personal data, including the categories of data, purposes, methods, retention periods and who has access;
- have data corrected, restricted or erased where it is incomplete, outdated, inaccurate, unlawfully obtained or no longer necessary;
- withdraw consent to processing;
- receive their data in a structured, commonly used format, and have it transmitted to another controller where technically feasible;
- lodge a complaint with the competent supervisory authority or bring court proceedings.
8.2. To exercise any of these rights, write to info@kvelo.dev. The Operator responds within 30 days.
8.3. The Operator may ask the User to confirm that the request comes from the data subject, for example by writing from the address given in the form.
8.4. Withdrawing consent stops further processing and leads to erasure, except where processing is required by law. It does not affect the lawfulness of processing carried out beforehand.
9. Security measures
9.1. The Operator applies organisational and technical measures to protect personal data against unauthorised access, destruction, alteration, blocking, copying and disclosure.
9.2. These include transmission over HTTPS, encryption of backups before upload, limiting the number of people with access to data, origin checks and bot protection on the form, and a strict content security policy.
9.3. No transmission over the internet can be guaranteed to be completely secure. The Operator is not liable for the acts of third parties who obtain access through circumstances outside the Operator’s control.
10. Changes
10.1. The Operator may amend this policy. The current version is published on this page with the date of the last change at the top.
10.2. Continuing to use the Site after a change constitutes acceptance of the new version.
11. Contact
For any question about personal data, or to submit a request: info@kvelo.dev.