Kelem.ai
Privacy Policy
Last updated: April 26, 2026 · GDPR — Regulation (EU) 2016/679
1. Data controller
Lifeora SRL (CBE 0843.008.489) — Rue Lieutenant Liedel 44, 1070 Anderlecht, Belgium.
DPO contact: our contact page
Kelem.ai acts as data controller for the data needed to manage the customer account (identification, billing, security). For data processed as part of the service (calls received on behalf of the business customer), Kelem.ai acts as data processor; the corresponding terms are described in the Data Processing Agreement (DPA).
2. Data collected
In providing the service, we collect the following categories of data:
| Category | Data concerned |
|---|---|
| Identification | First name, last name, email, phone number, profession, agency or company name. |
| Configuration | Agent settings, hours, FAQ, services offered, custom instructions, trade scripts. |
| Call data | Audio recording, AI-generated text transcript, structured summaries, duration, caller number, date and time. |
| Payment | Handled exclusively by Stripe — we store no banking data; only a Stripe customer ID and billing history. |
| Technical | IP address, connection logs, browser type, session data. |
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Provision and operation of the service | Performance of the contract (art. 6.1.b GDPR) |
| Account and subscription management | Performance of the contract |
| Sending call notifications and summaries | Performance of the contract |
| Billing and payment management | Performance of the contract / Legal obligation |
| Improvement of service quality | Legitimate interest (art. 6.1.f GDPR) |
| Commercial communications | Legitimate interest / Consent if required |
| Legal and accounting obligations | Legal obligation (art. 6.1.c GDPR) |
4. Retention periods
- Account data : subscription duration, then deletion within 30 days of account closure.
- Call transcripts and summaries : automatically deleted after 12 months. An automatic purge runs daily.
- Contacts and caller data : kept for the duration of the active subscription, deleted with the account.
- Audio recordings : automatically deleted after 90 days.
- Billing data : 7 years from the invoice (Belgian accounting obligation).
- Technical data (logs) : maximum 12 months.
5. Hosting and security
Account data, transcripts and summaries produced by Kelem.ai are hosted on servers located in Europe (Vercel — Frankfurt, Railway — EU). We implement appropriate technical and organisational measures to protect your data from unauthorised access, loss or destruction.
These measures include in particular: encryption of sensitive data at rest (AES-256-GCM), encrypted connections (TLS 1.2+), role-based access restrictions, access logging, tenant isolation, encrypted backups, and regular security testing.
6. Sub-processors and GDPR safeguards
Kelem.ai uses technical providers (processors under the GDPR) to deliver the service. A data processing agreement (DPA) is signed with each of them, binding them to process data only on Kelem.ai’s instructions and to implement appropriate security measures.
| Sub-processor | Role | Location |
|---|---|---|
| Vercel Inc. | Frontend hosting | EU (Frankfurt) |
| Railway Corp. | Backend hosting & database | EU |
| Twilio Inc. | Telephony | EU & US (SCC) |
| ElevenLabs Inc. | Voice synthesis and transcription — Zero Retention | US (SCC + Zero Retention) |
| Anthropic PBC | Large language model (LLM) | US (SCC) |
| Stripe Inc. | Payment | EU & US (SCC) |
| Resend Inc. | Transactional email | US (SCC) |
An up-to-date list of our key sub-processors is available on request via our contact page.
7. Transfers outside the EU
Certain sub-processors involved in the service — notably for real-time voice processing and the LLM — are established outside the European Union. These transfers are governed by the standard contractual clauses (SCC) adopted by the European Commission, in accordance with article 46 GDPR.
8. Your rights
Under the GDPR, you have the following rights regarding your personal data:
- Right of access : obtain a copy of your processed data.
- Right of rectification : correct inaccurate or incomplete data.
- Right to erasure : obtain deletion of your data (subject to legal obligations).
- Right to restriction : restrict processing in certain cases.
- Right to portability : receive your data in a structured format.
- Right to object : object to certain processing based on legitimate interest.
To exercise your rights, contact us via our contact page. We commit to respond within a maximum of one month.
You also have the right to lodge a complaint with the Belgian Data Protection Authority (DPA) — Rue de la Presse 35, 1000 Brussels (online form).
9. Cookies
The Platform uses only strictly necessary cookies for its operation (authentication, preferences, session security). No advertising or third-party tracking cookies are used. Our Plausible analytics is anonymous and cookieless. Details: Cookie Policy.
10. Changes
Any substantial change to this policy is communicated by email and/or via an information banner on the Platform. The version in force is the one published on kelem.ai.