Privacy policy
Last updated: [date]
Kevlo runs on your Mac. Your companies, employees, chats and files stay there. This policy explains the little personal data we do handle, why, how long we keep it and what you can ask of us.
Draft. Items in [square brackets] are filled in before launch, and the whole text is reviewed by a lawyer before Kevlo is sold. Nothing on this page limits rights you have under mandatory law.
Who we are
Kevlo is offered by [company name], [address], registered with the Netherlands Chamber of Commerce (KvK) under number [KvK number]. We are the controller for the personal data described here. Contact: [privacy email].
The Kevlo app
Kevlo is software that runs on your own Mac. Everything you create in it, such as your companies, employees, instructions, chats, schedules and the files your employees work on, is stored on your Mac. We do not receive it, cannot see it and cannot recover it.
When an employee works on a task, the app sends what that task needs directly from your Mac to the Claude provider you chose: Anthropic, Amazon Bedrock, Google Vertex AI, Microsoft Foundry, Claude Platform on AWS or your own gateway. That provider processes it as your provider, under its own terms and privacy policy. The same goes for services you connect, such as Microsoft 365. We are not part of those exchanges.
Your Claude API key or cloud login is kept in your Mac's Keychain and is never sent to us.
If the app sends us an error report, it only does so after you choose to send it, and you can see what it contains first. [Remove this paragraph if error reporting is not added.]
What we process, why, and on which basis
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Account: email address, password (stored only in scrambled form), the plan you picked, and whether you want an email when Kevlo can be bought | Run your account and keep your plan choice, and email you when Kevlo can be bought if you asked for it | Contract, art. 6(1)(b); the launch email: consent, art. 6(1)(a) |
| Name, email address, account details | Set up and manage your trial and subscription, send service messages | Contract, art. 6(1)(b) |
| Billing details: country, VAT number, invoices, payment status | Charge for your plan, keep tax records | Contract and legal obligation, art. 6(1)(b) and (c) |
| Licence key, plan, number of Macs, app version | Check that your plan is active and within its limits | Contract, art. 6(1)(b) |
| Support messages and email address | Answer your questions | Legitimate interest, art. 6(1)(f) |
| Website visits (only if you allow analytics) | Learn which parts of the site help | Consent, art. 6(1)(a) |
We never see your full card details; [payment provider] handles them. We do not sell your data, and we do not use it for advertising.
Cookies
The website uses only strictly necessary cookies unless you agree to analytics. Details and how to change your choice are in the cookie policy.
Who else handles your data
- [payment provider], for payments, invoices and VAT;
- [email provider], for email and support;
- Supabase, for accounts and the licence check, on servers in Frankfurt, Germany;
- Cloudflare, for hosting this website.
They act on our instructions under data processing agreements, or, where a payment provider acts as merchant of record, as an independent controller under its own privacy policy. Where data is processed outside the European Economic Area, this happens under an adequacy decision or the European Commission's standard contractual clauses.
How long we keep it
- Account and licence data: while your subscription runs and [period] after it ends; without a subscription, until you ask us to delete your account.
- Invoices and payment records: seven years, as Dutch tax law requires.
- Support conversations: [period] after they end.
- Your cookie choice: 12 months, in your own browser.
Security
We protect the data we hold with appropriate technical and organisational measures, such as encryption in transit, access limited to people who need it, and providers that meet recognised security standards. No system is perfectly secure; if a breach affects you, we tell you and the authorities as the law requires.
Automated decisions
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
Your rights
You can ask us to access, correct or delete your personal data, to restrict or object to its use, or to receive it in a common format. Where we rely on consent, you can withdraw it at any time, without affecting what happened before. Write to [privacy email]; we answer within one month, and may ask you to confirm who you are.
If you are unhappy with how we handle your data, you can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or the authority where you live.
Children
Kevlo is meant for adults and businesses. We do not knowingly collect data from children under 16.
Changes
When we change this policy, we update the date at the top. If a change matters for you, we tell you by email before it applies.