Skip to content
Keelra

Language: ENPL

Privacy Policy

Last updated 2026-10-27

1. Who we are

The controller of your personal data is MFPM Intelligence Sp. z o.o., Nowy Świat 60/22, 00-357 Warsaw, Poland; KRS 0001236093, NIP (VAT ID) PL5253086543, REGON 544536268 ("Keelra", "we"). For any data matter, contact us at hello@keelra.com.

2. Who this policy covers

This policy covers two groups of people, and the sections below state where the two differ:

  • Prospects: people we contact with B2B outreach about Keelra services, whose data we did not collect from them directly (Art. 14 GDPR applies).
  • Platform users and clients: people who sign up for or use the Keelra platform, book an audit call, submit the contact form, or email us (Art. 13 GDPR applies).

Data that clients process inside their Keelra workflows (for example their own customers' documents) is processed by Keelra as a processor under a Data Processing Agreement, not under this policy. The client remains the controller of that data.

3. Where prospect data comes from

We obtain prospect data from publicly available business sources (company websites, professional profiles, business registries) and from B2B data providers such as Apollo. We process only business contact details obtained in a business context, never private addresses collected outside one.

4. What data we process

  • Prospects: name, business email address, job title, company name, company details (industry, size, website), and the history of our correspondence with you.
  • Platform users and clients: account data (name, email, company), billing data, service configuration, and usage and audit logs generated by the platform.
  • Contact form enquiries: name, business email address, phone number, optionally company name or website, the content of your message, and a record of the consent you gave with its date and time. If you reached us through a partner referral, we also store the campaign parameters that came with that visit.
  • Website visitors: aggregated, cookie-free analytics about page visits and, only once you have consented, identifiers stored in cookies for measurement, for advertising and for settling partner referrals (section 9). Until you consent we store nothing on your device beyond what is strictly necessary to run the site, and we do not build individual visitor profiles.

5. Purposes and legal bases

  • B2B outreach and marketing to prospects: our legitimate interest in promoting our services to businesses (Art. 6(1)(f) GDPR). You can object at any time and we stop immediately.
  • Providing the platform and delivering services to clients: performance of a contract (Art. 6(1)(b) GDPR).
  • Invoicing, accounting, and tax obligations: legal obligation (Art. 6(1)(c) GDPR).
  • Handling contact form enquiries: your consent, given by ticking the box when you submit the form (Art. 6(1)(a) GDPR). You may withdraw it at any time; withdrawal does not affect the lawfulness of processing carried out before it.
  • Analytics, marketing and affiliate cookies: your consent (Art. 6(1)(a) GDPR together with Art. 173 of the Polish Electronic Communications Law). How to give, change and withdraw it is set out in section 9.
  • Security, abuse prevention, and audit logging: our legitimate interest in keeping the service safe (Art. 6(1)(f) GDPR).

6. How long we keep data

  • Prospects: if you object or opt out, we delete your data from our outreach lists immediately and keep only the minimum needed to honor the opt-out. If you never respond, we delete your data no later than 12 months after our last contact attempt.
  • Clients: for the duration of the contract, and afterwards for the statutory retention periods that apply to accounting and tax records and for the limitation periods of legal claims.
  • Contact form enquiries: 24 months from our last contact about the matter. If you withdraw consent we delete the enquiry immediately, keeping only a record that consent was withdrawn and when.
  • Cookies: for the lifetime each provider sets for the cookie, and never beyond the point where you withdraw consent. The record of your consent decision itself is kept for 12 months, after which we ask again.

7. Recipients and subprocessors

We share personal data only with service providers that host or support our infrastructure, under data processing terms. The current list, including what each provider processes and where, is published at keelra.com/subprocessors.

8. Processing location and international transfers

Processing location differs by layer of the service. We set them out separately because not all of the service runs in the same place:

  • Application layer: the application, the database and the automation engine run in Warsaw, on OVH infrastructure inside the European Union. This applies to every client.
  • Backups: encrypted and held in EU-jurisdiction object storage whose provider has a United States parent company.
  • Language-model calls: performed by Anthropic PBC through its first-party API, which offers global or US routing only. Prompt content is therefore processed outside the EEA, whatever the client's place of establishment; the transfer is made on the basis of the EU Standard Contractual Clauses. Identifiers are tokenised before each call, and the provider is bound by no-training terms. Our own usage records hold token counts, cost and model, never the content of a prompt or a response.
  • Clients established outside the European Economic Area: the application layer may be run for them on infrastructure located in the United States. As at the date of this policy we serve no such clients.

At a client's request, model calls can be routed to AWS Bedrock in an EU region (Frankfurt). This requires a separate contractual arrangement and is not the default configuration.

Every transfer outside the European Economic Area is made on the basis of the EU Standard Contractual Clauses, supplemented by additional measures where needed. The full subprocessor list, stating each provider's processing location, is published and forms part of the data-processing agreement.

9. Cookies and tracking technologies

Until you consent, we store nothing on your device and read nothing from it beyond what is strictly necessary to deliver the site – including the record of your own cookie decision. Every third-party script loads through a single Google Tag Manager container, and the container itself loads only after you decide in the cookie banner. Without marketing consent it runs with every tag from a provider other than Google blocked; Google's tags follow your choice through Google Consent Mode v2.

  • Strictly necessary: remembering your cookie decision and keeping the site secure. No consent is required for these (Art. 173(3) of the Polish Electronic Communications Law) and they are not used for tracking.
  • Analytics: aggregated measurement of how pages are used. Only with your consent.
  • Marketing and affiliate: the Meta and LinkedIn pixels and Google's advertising features, which measure our ads and help choose who sees them, and cookies from the TradeTracker affiliate network, used to attribute a referral to the partner who sent you to us and to settle their commission. Only with your consent.

You can change or withdraw your consent at any time – the "Cookie settings" button sits in the footer of every page. Withdrawing is as easy as giving consent and does not affect the lawfulness of processing carried out beforehand. We honour a stored decision for 12 months and then ask again. When you withdraw consent, the page reloads and deletes the Google Analytics, Google Ads and Meta cookies stored on the keelra.com domain; cookies that Meta and LinkedIn keep on their own domains can be removed in your browser settings.

The recipients of data collected through consented cookies are Google Ireland Limited (Google Tag Manager, Google Analytics and Google's advertising features), TradeTracker, the affiliate network operator, Meta Platforms Ireland Limited (the Meta pixel) and LinkedIn Ireland Unlimited Company (the LinkedIn Insight Tag). The pixels send Meta and LinkedIn the address of the page you visit, an identifier from a cookie and browser data. We are joint controllers with Meta and with LinkedIn for collecting that data and passing it on; what each of them does with it afterwards is governed by its own privacy policy. Google, Meta and LinkedIn may transfer the data to the United States on the basis of standard contractual clauses. What Google and TradeTracker process and where is set out in the subprocessor register referenced in section 7.

10. Your rights

Under Articles 15 to 21 GDPR you have the right to:

  • access your data and receive a copy,
  • rectify inaccurate data,
  • have your data erased,
  • restrict processing,
  • receive your data in a portable format,
  • withdraw consent at any time where processing rests on it (the contact form, and analytics, marketing and affiliate cookies). Withdrawal does not affect the lawfulness of processing carried out beforehand,
  • object to processing based on legitimate interest. For direct marketing the objection is absolute: one email to hello@keelra.com or one click on the opt-out link in any message ends all outreach, unconditionally.

To exercise any of these rights, email hello@keelra.com. We respond within one month.

11. Complaints

You can lodge a complaint with the President of the Personal Data Protection Office in Poland (PUODO, uodo.gov.pl) or with the supervisory authority in your own EU member state.

12. Contact

All privacy matters: hello@keelra.com.