Skip to content
Keelra

Language: ENPL

Book a call

Privacy Policy

Last updated 2026-08-19

1. Who we are

The controller of your personal data is MFPM Intelligence Sp. z o.o. (company name change from Splot Store Sp. z o.o. pending registration in the National Court Register), Nowy Świat 60/22, 00-357 Warsaw, Poland; KRS 0001236093, NIP (VAT ID) PL5253086543, REGON 544536268 ("Keelra", "we"). For any data matter, contact us at hello@keelra.com.

2. Who this policy covers

This policy covers two groups of people, and the sections below state where the two differ:

  • Prospects: people we contact with B2B outreach about Keelra services, whose data we did not collect from them directly (Art. 14 GDPR applies).
  • Platform users and clients: people who sign up for or use the Keelra platform, book an audit call, submit the contact form, or email us (Art. 13 GDPR applies).

Data that clients process inside their Keelra workflows (for example their own customers' documents) is processed by Keelra as a processor under a Data Processing Agreement, not under this policy. The client remains the controller of that data.

3. Where prospect data comes from

We obtain prospect data from publicly available business sources (company websites, professional profiles, business registries) and from B2B data providers such as Apollo. We process only business contact details obtained in a business context, never private addresses collected outside one.

4. What data we process

  • Prospects: name, business email address, job title, company name, company details (industry, size, website), and the history of our correspondence with you.
  • Platform users and clients: account data (name, email, company), billing data, service configuration, and usage and audit logs generated by the platform.
  • Contact form enquiries: name, business email address, phone number, optionally company name or website, the content of your message, and a record of the consent you gave with its date and time. If you reached us through a partner referral, we also store the campaign parameters that came with that visit.
  • Website visitors: aggregated, cookie-free analytics about page visits and, only once you have consented, identifiers stored in cookies for measurement and for settling partner referrals (section 9). Until you consent we store nothing on your device beyond what is strictly necessary to run the site, and we do not build individual visitor profiles.

5. Purposes and legal bases

  • B2B outreach and marketing to prospects: our legitimate interest in promoting our services to businesses (Art. 6(1)(f) GDPR). You can object at any time and we stop immediately.
  • Providing the platform and delivering services to clients: performance of a contract (Art. 6(1)(b) GDPR).
  • Invoicing, accounting, and tax obligations: legal obligation (Art. 6(1)(c) GDPR).
  • Handling contact form enquiries: your consent, given by ticking the box when you submit the form (Art. 6(1)(a) GDPR). You may withdraw it at any time; withdrawal does not affect the lawfulness of processing carried out before it.
  • Analytics and affiliate cookies: your consent (Art. 6(1)(a) GDPR together with Art. 173 of the Polish Electronic Communications Law). How to give, change and withdraw it is set out in section 9.
  • Security, abuse prevention, and audit logging: our legitimate interest in keeping the service safe (Art. 6(1)(f) GDPR).

6. How long we keep data

  • Prospects: if you object or opt out, we delete your data from our outreach lists immediately and keep only the minimum needed to honor the opt-out. If you never respond, we delete your data no later than 12 months after our last contact attempt.
  • Clients: for the duration of the contract, and afterwards for the statutory retention periods that apply to accounting and tax records and for the limitation periods of legal claims.
  • Contact form enquiries: 24 months from our last contact about the matter. If you withdraw consent we delete the enquiry immediately, keeping only a record that consent was withdrawn and when.
  • Cookies: for the lifetime each provider sets for the cookie, and never beyond the point where you withdraw consent. The record of your consent decision itself is kept for 12 months, after which we ask again.

7. Recipients and subprocessors

We share personal data only with service providers that host or support our infrastructure, under data processing terms. The current list, including what each provider processes and where, is published at keelra.com/subprocessors.

8. Processing location and international transfers

Processing location differs by layer of the service. We set them out separately because not all of the service runs in the same place:

  • Application layer: the application, the database and the automation engine run in Warsaw, on OVH infrastructure inside the European Union. This applies to every client.
  • Backups: encrypted and held in EU-jurisdiction object storage whose provider has a United States parent company.
  • Language-model calls: for clients established in the EEA, performed by AWS Bedrock in an EU region (Frankfurt). Prompt content is not processed outside the EEA. The provider has a United States parent company; the transfer is made on the basis of the EU Standard Contractual Clauses. Identifiers are tokenised before each call, and the provider is bound by zero-retention and no-training terms.
  • Clients established outside the European Economic Area: the application layer may be run for them on infrastructure located in the United States. As at the date of this policy we serve no such clients.

For clients outside the EEA, model calls may be performed by Anthropic PBC (first-party API, global or US routing). This requires a separate contractual arrangement and is not the default configuration for EEA clients.

Every transfer outside the European Economic Area is made on the basis of the EU Standard Contractual Clauses, supplemented by additional measures where needed. The full subprocessor list, stating each provider's processing location, is published and forms part of the data-processing agreement.

9. Cookies and tracking technologies

Until you consent, we store nothing on your device and read nothing from it beyond what is strictly necessary to deliver the site — including the record of your own cookie decision. Every third-party script loads through a single Google Tag Manager container, which stays in a denied state until consent is given (Google Consent Mode v2, defaulting to "denied" for advertising, personalisation and analytics storage).

  • Strictly necessary: remembering your cookie decision and keeping the site secure. No consent is required for these (Art. 173(3) of the Polish Electronic Communications Law) and they are not used for tracking.
  • Analytics: aggregated measurement of how pages are used. Only with your consent.
  • Affiliate and marketing: cookies from the TradeTracker affiliate network, used to attribute a referral to the partner who sent you to us and to settle their commission. Only with your consent.

You can change or withdraw your consent at any time — the "Cookie settings" button sits in the footer of every page. Withdrawing is as easy as giving consent and does not affect the lawfulness of processing carried out beforehand. We honour a stored decision for 12 months and then ask again.

The recipients of data collected through consented cookies are Google Ireland Limited (Google Tag Manager) and TradeTracker, the affiliate network operator. What each of them processes and where is set out in the subprocessor register referenced in section 7.

10. Your rights

Under Articles 15 to 21 GDPR you have the right to:

  • access your data and receive a copy,
  • rectify inaccurate data,
  • have your data erased,
  • restrict processing,
  • receive your data in a portable format,
  • withdraw consent at any time where processing rests on it (the contact form, and analytics and affiliate cookies). Withdrawal does not affect the lawfulness of processing carried out beforehand,
  • object to processing based on legitimate interest. For direct marketing the objection is absolute: one email to hello@keelra.com or one click on the opt-out link in any message ends all outreach, unconditionally.

To exercise any of these rights, email hello@keelra.com. We respond within one month.

11. Complaints

You can lodge a complaint with the President of the Personal Data Protection Office in Poland (PUODO, uodo.gov.pl) or with the supervisory authority in your own EU member state.

12. Contact

All privacy matters: hello@keelra.com.