Kalsenti Limited is the controller of the personal data described here. We’re a company registered in England and Wales, company number 17555690, with our registered office at 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE. We’re registered with the ICO under number [ICO REGISTRATION NUMBER].

For anything about your personal data, email [email protected]. We haven’t appointed a data protection officer, as the law doesn’t require one for a business like ours.

If you use Kalsenti through a business customer’s own product, that business decides how your data is used, and its privacy notice applies. [UPDATE IF A DATA PROCESSING AGREEMENT FOR BUSINESS CUSTOMERS IS INTRODUCED]

Data

Account details

What it includes

Your name, email address, a securely hashed password if you set one, the country you declare, your confirmation that you’re 18 or over, when you accepted our terms, and a referral code if you entered one.

Where it comes from

You, when you sign up

Data

Sign-in with GitHub or Google

What it includes

Your name, email address, profile picture link and account ID with that provider, and the sign-in tokens it issues.

Where it comes from

GitHub or Google, when you choose to sign in with them

Data

Security details

What it includes

Your two-factor authentication secret and backup codes, if you turn it on; your signed-in sessions, with the IP address and browser details each was started from; and records of identity confirmations made before you handle API keys.

Where it comes from

You and your device

Data

Encrypted chat data

What it includes

Your saved chats and their titles, your encrypted key and its backup copy, device links and optional passkey records. All of it is encrypted on your device, so we can’t read it.

Where it comes from

Your device

Data

Older chats

What it includes

Chats saved before encryption was introduced, which are stored readable until you move them: their titles, messages, the model used, cost, and any searches and results.

Where it comes from

Your earlier use of chat

Data

API keys

What it includes

Each key’s name, the first few characters, a fingerprint used to recognise it, an encrypted copy so you can view it again, and when it was created, last used, last viewed and revoked.

Where it comes from

You, when you create a key

Data

Billing and usage

What it includes

Your balance, every top-up, charge, refund and dispute, with the amount, the model a charge was for, the time, and a link to the receipt; your Stripe customer ID; the billing country of your payments; your consent to have credit straight away; and daily counts of how many of your requests succeeded or failed.

Where it comes from

You, Stripe and Onelink, and our systems as you use the service

Data

Usage history

What it includes

A row for each request you make through chat, private chat or the API: its request ID, when it happened and how long it took, the model, where it came from and, for an API request, which key was used and that key’s name at the time, whether it succeeded, failed, was stopped (by you or by our safety filter) or wasn’t run, an error code and response code if it didn’t finish, the five token counts, how many web searches it ran, what it cost, the per-token prices used to work that out, and whether and how it was charged. Never the words of your prompts or replies. See Your usage history.

Where it comes from

Our systems, as you use the service

Data

Safety records

What it includes

When a filter blocks a request: the category and rule that matched, the language, the time and your account. Never the words you wrote.

Where it comes from

Our systems

Data

Messages you send us

What it includes

Your emails to us and our replies.

Where it comes from

You

Data

Identity check results

What it includes

Whether you passed, when, whether you’re 18 or over, the issuing country, Stripe’s reference and reason code, any review decision, and your consent record. Never images, your name, date of birth or document number. See Identity checks.

Where it comes from

Stripe, and our team’s reviews

We don’t ask for, and you shouldn’t send us, special category data such as health information about yourself or others, unless you need to for what you’re doing. Anything you put in a prompt is handled as described in the next section.

Saved chats. When you use chat, your messages, the replies, chat titles, the searches a reply ran and any summary of a long chat are encrypted in your browser before they’re sent to us for storage. The key that opens them is protected by your key phrase and stays with you, so we can’t read your saved chats. Documents you attach are read in your browser, and their text is sent as part of your message.

Older chats. Chats saved before encryption was introduced are stored on our servers in a readable form. The chat page tells you if you have any and offers to move them. Moving a chat encrypts it and then deletes the readable copy from our servers. If you don’t move them, they stay readable until you delete them or close your account.

What happens when you send a message. To produce a reply, your message and the earlier messages in the chat, including any document text, are sent from your browser to our gateway. The gateway checks them with our safety filters and sends them to the AI model hosting provider that runs the model you chose. The reply streams back the same way. Our gateway handles your words in memory only, and our logs never contain them. The model’s host processes them to produce the reply, and keeps them for the period shown on the model’s page. If a chat gets very long, the model writes a summary of the earlier messages, which is saved inside your encrypted chat.

Web search. If the model decides to search, the search words it chooses are sent from our servers to third-party search engines through our own search service. The search engines see the words of the search and our server’s address, but not your name, email or IP address. The results are filtered and passed to the model, and the page titles and links are shown with the reply. We count how many searches you make each day to apply the daily limit, but our logs don’t record the words searched for.

The API. Requests you send with an API key go through the same gateway, safety filters and model hosts, and are subject to the hosts’ retention periods. We don’t store the content of API requests or replies. We record what each request cost and which model it used, in your usage history.

Encryption protects your saved chats, not messages while they’re being answered. Our gateway can read your prompts while it’s handling them, the model’s host can read them to produce a reply and, for searches, search engines see the search words. Please bear that in mind when deciding what to send.

We don’t use your chats or API requests to train AI models. [CONFIRM THAT EVERY MODEL HOST’S TERMS ALSO PROHIBIT TRAINING ON PROMPTS AND REPLIES]

For each request you make, through chat, private chat or the API, we keep one row so you can see on the Usage page what it cost and where your credit went. Each row holds the request’s ID, when it happened and how long it took; the model; whether the request came from chat, private chat or an API key and, for a key, which one and its name at the time, which stays in the row even if you later rename or delete the key; whether it succeeded, failed, was stopped (by you or by our safety filter) or wasn’t run, with an error code and response code if it didn’t finish (for example, that your balance ran out, that Kalsenti isn’t available in your country, or that the model needs ID verification); the input, output, cache read, cache write and reasoning token counts; how many web searches it ran; and what it cost, the per-token prices used to work that out, and whether and how it was charged. It never contains the words of your prompts or the replies.

You choose how long it’s kept. In Settings you can keep it for 7, 30, 90 or 365 days, or until you delete it. Unless you change it, it’s kept for 30 days. Rows older than your choice are deleted automatically, and shortening the period deletes older rows straight away.

You can clear it or take a copy. You can delete your whole usage history at any time in Settings, and export it as a CSV file from the Usage page.

Your usage history is deleted when you close your account. It’s separate from your billing records of top-ups and charges, which we keep as described under How long we keep it.

Every request, on every model, is checked automatically for content in a small number of serious categories: sexual content, sexual content involving children, terrorism and violent crime. That covers the messages sent and any tool definitions, and text from attached documents is checked under its own rules. Replies are checked only in private chat, not in chat or on the API. When a filter matches, the request is stopped or, in private chat, the reply is replaced with a notice.

When that happens, we record the category, the rule that matched, the language and the time against your account, and delete these records after 30 days. We don’t record what you wrote. If several requests are blocked in a short time, chat and the API are paused for your account for one hour, automatically. If a message suggests someone may be at risk of self-harm, it isn’t sent to the model, you’re shown where to find support instead, and nothing is recorded against your account.

These checks are automated. A one-hour pause isn’t a decision with legal or similarly significant effects, but if you think a filter got it wrong, email us and a person will look at it. Where we restrict an account for longer, a person makes that decision.

Where we find content that suggests a child is at risk, or information about terrorism, we may report it to the National Crime Agency, the Internet Watch Foundation or the police, as the law requires or allows.

Purpose

Creating and running your account, signing you in, and providing chat, the API and web search

Lawful basis

Contract: we need it to provide the service you asked for

Purpose

Taking payment, adding credit, charging for usage and showing your usage

Lawful basis

Contract

Purpose

Keeping your usage history, so you can see, filter and export what each request cost

Lawful basis

Contract

Purpose

Checking you’re 18 or over and not in the EU or EEA, and recording your consent to have credit straight away

Lawful basis

Legal obligation, and legitimate interests in only serving people we can lawfully serve

Purpose

Keeping your account and our systems secure: two-factor authentication, session records, identity confirmation for API keys, rate limits

Lawful basis

Legitimate interests in security, and contract

Purpose

Safety filtering, automatic pauses and investigating misuse

Lawful basis

Legitimate interests in preventing harm and enforcing our terms; and, for crime prevention and safeguarding, recognised legitimate interests

Purpose

Reporting to law enforcement or regulators

Lawful basis

Legal obligation, or recognised legitimate interests in preventing crime and safeguarding vulnerable people

Purpose

Sending you emails about your account, payments, security and changes to our terms

Lawful basis

Contract and legitimate interests

Purpose

Keeping financial records

Lawful basis

Legal obligation, under tax and company law

Purpose

Handling complaints, disputes and legal claims

Lawful basis

Legitimate interests, and legal obligation

Purpose

Counting how many requests succeed or fail, to keep the service reliable

Lawful basis

Legitimate interests in running a reliable service

Purpose

Checking your identity and age before you use certain models

Lawful basis

Explicit consent for the biometric check; contract and legitimate interests for keeping and using the result

Where we rely on legitimate interests, we’ve weighed them against your rights, and you can ask us for details. We don’t send marketing emails unless you’ve agreed to them.

We use the following kinds of organisation to run the service. Those marked as processors act only on our instructions, under contracts that require them to protect your data. The others are independent controllers with their own privacy notices.

Who

AI model hosting providers (processors)

What they do

Run the AI models and produce replies

Data they receive

Your prompts, chat history, document text and replies while a request is being handled. Not your name, email or payment details.

Where

[AI MODEL HOSTING REGIONS]. Each model’s page shows its region and retention.

Who

Web search engines, through our own search service

What they do

Return search results when a model searches

Data they receive

The search words the model chose and our server’s address. Not your identity.

Where

Mainly the United States [CONFIRM ONCE THE SEARCH ENGINE LIST IS FIXED]

Who

Cloud hosting provider (processor)

What they do

Hosts our website, servers and databases

Data they receive

All the data in this policy, stored and handled on our behalf

Where

[HOSTING PROVIDER], [HOSTING REGION]

Who

Email delivery provider (processor)

What they do

Sends account and payment emails

Data they receive

Your email address and the content of those emails

Where

European Union (Netherlands)

Who

Stripe and Onelink (independent controllers)

What they do

Process your payment. Onelink (Sold Through Link, LLC) is the merchant of record, handles tax and sends receipts

Data they receive

Your name and email from us; your card details, billing address and payment information directly from you

Where

United States, United Kingdom and EU

Who

GitHub and Google (independent controllers)

What they do

Sign you in, if you choose to use them

Data they receive

That you’re signing in to Kalsenti

Where

United States

Who

Stripe (Stripe Identity), as an independent controller

What they do

Checks your ID document and selfie, and tells us the result

Data they receive

The document photo, selfie and the details read from them, which you give to Stripe directly on its page

Where

United States and others, under Stripe’s transfer safeguards [CONFIRM]

Who

Professional advisers, law enforcement and regulators

What they do

Legal, accounting and compliance; responding to lawful requests

Data they receive

What’s needed for the purpose

Where

United Kingdom

If we sell or reorganise our business, personal data may pass to the new owner, who must keep protecting it as this policy describes.

Some of the organisations above are outside the UK. When we send personal data abroad, we make sure it stays protected to a standard not materially lower than in the UK. We do this by:

• sending it to countries the UK has found to have adequate protection, such as countries in the European Economic Area;
• for US organisations certified to it, relying on the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”); or
• otherwise, using the ICO’s International Data Transfer Agreement, or its Addendum to the EU standard contractual clauses, together with a transfer risk assessment.

You can ask us for a copy of the safeguards we use at [email protected].

Data

Account details and security settings

How long

While your account is open. Deleted when you close it.

Data

Signed-in sessions, with IP address and browser details

How long

Each session expires 7 days after it was last used, and when you sign out. All are deleted when you close your account.

Data

Encrypted saved chats

How long

Until you delete them or close your account. A record that a chat was deleted is kept for 180 days, so your other devices know it was deleted on purpose.

Data

Older chats not yet moved

How long

Until you move or delete them, or close your account.

Data

API keys

How long

While your account is open. When you revoke a key, its encrypted copy is deleted straight away; its name, first characters and dates stay in your key list. Everything is deleted when you close your account.

Data

Safety records

How long

30 days.

Data

Prompts and replies handled by our gateway

How long

Not kept. Held in memory only while a request is running.

Data

Prompts and replies at model hosts

How long

As shown on each model’s page.

Data

Daily search counts

How long

2 days.

Data

Gateway and server logs (no prompt text)

How long

[LOG RETENTION PERIOD]

Data

Billing records, receipts and usage charges

How long

While your account is open, then 6 years after you close it, with your name and contact details removed, as tax and company law require.

Data

Daily counts of successful and failed requests

How long

While your account is open.

Data

Usage history (a row for each request, with no prompt or reply text)

How long

For the period you choose in Settings: 7, 30, 90 or 365 days, or until you delete it. 30 days unless you change it. You can clear it at any time, and it’s deleted when you close your account.

Data

Emails with us

How long

Up to 2 years after the matter is closed, or longer if needed for a legal claim. [CONFIRM]

Data

Data needed for a legal claim, investigation or report to the authorities

How long

As long as the claim, investigation or legal duty requires.

When you close your account, we delete your chats (both encrypted and older readable ones), sessions, API keys, usage history and account details. We keep your billing records of top-ups and charges for 6 years with your identity removed. Stripe and Onelink keep their own payment records under their privacy notices.

Saved chats are encrypted on your device, and encrypted again where we store them. Passwords are stored as one-way hashes, and API keys are found by a fingerprint, with only an encrypted copy kept. Connections to the service are encrypted in transit. We offer two-factor authentication and ask you to confirm who you are before you view or create API keys. Access to our systems is limited to the people who need it.

No system is perfectly secure. If a breach puts your rights at risk, we’ll tell you and the ICO as the law requires.

You have the right to:

• access the personal data we hold about you and get a copy of it;
• have inaccurate data corrected;
• have your data erased, in some circumstances;
• restrict how we use your data, in some circumstances;
• object to us using your data where we rely on legitimate interests;
• data portability: receive data you gave us in a machine-readable format, or have it sent to another organisation;
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you, and to challenge such a decision, have a person look at it and give your view; and
• withdraw any consent you’ve given, at any time.

We can’t give you a copy of your encrypted saved chats in readable form, because we can’t read them. You can open and copy them yourself in the chat page. You can export your usage history yourself as a CSV file from the Usage page.

To use any of these rights, email [email protected] from the address on your account. We may need to confirm who you are. We’ll respond within one month, which can be extended by up to two more months for complex requests, and we’ll tell you if it is. There’s usually no charge.

If you’re unhappy with how we’ve handled your personal data, please complain to us first at [email protected]. We’ll acknowledge your complaint within 30 days, look into it without undue delay and tell you the outcome.

You also have the right to complain to the Information Commission, the UK’s data protection regulator, known as the ICO, at ico.org.uk/make-a-complaint or on 0303 123 1113.

Kalsenti is only for people aged 18 or over, and we ask you to confirm your age when you sign up. If we learn that someone under 18 has an account, we’ll close it and delete their data, except records the law requires us to keep. If you think a child is using Kalsenti, please tell us at [email protected].

Some models, including uncensored models, are only available once you’ve verified your identity. You only need to do this for those models, and you can only start a check after you’ve added credit at least once.

What the check involves. Stripe runs the check on its own secure page, not ours. Stripe asks for a photo of a government-issued photo ID (a passport, driving licence or national identity card) and a live selfie. It checks that the document is genuine, reads the details on it, and compares your selfie with the photo on the document to confirm the document is yours. Comparing faces this way uses biometric data, which is special category data under UK data protection law. We use the result only to confirm who you are and that you’re 18 or over.

What we keep. We never receive or keep your images, and we don’t keep your name, date of birth or document number from the check. We read your date of birth from Stripe once, to work out whether you’re 18 or over, and then discard it. We keep whether the check passed and when, whether you’re 18 or over (yes or no), the country that issued your document, Stripe’s reference for the check and, if it didn’t pass, Stripe’s reason code. If our team reviews a check, we also keep their decision, a short internal note, who made the decision and when. We also keep a record of your consent: when you gave it and the version of the wording you agreed to.

Stripe’s role. Stripe acts as an independent data controller for the check. It decides how it handles the images and information it collects, under the Stripe Privacy Policy, and it asks for your consent on its own page as well. Stripe says it keeps biometric data for no longer than one year, or until you withdraw your consent, and it may use images to improve its verification systems if you agree to that on its page.

Our lawful basis. For the biometric check we rely on your explicit consent (UK GDPR Articles 6(1)(a) and 9(2)(a)), which you give by ticking the box on our consent screen before you go to Stripe. For keeping the result and using it to decide which models you can use, we rely on our contract with you (Article 6(1)(b)) and our legitimate interest in preventing misuse of uncensored models (Article 6(1)(f)). You can withdraw your consent at any time. Withdrawing doesn’t undo a check that’s already finished. If you’d like us to remove the verification from your account, email [email protected], and those models will stop being available to you.

How long we keep it. As soon as a check passes, we ask Stripe to delete (redact) your images and the personal details read from them. If a check doesn’t pass, a member of our team reviews it first, and we ask Stripe to redact it once they’ve decided. Stripe says redaction can take up to 4 days. Afterwards, Stripe keeps a record that the check happened, with its outcome, the type of document and the issuing country, but not your name, date of birth, address, document number or images. We keep our record of the result while your account is open, and delete it when you close your account.

Decisions and reviews. Stripe’s check is automated, but a check that doesn’t pass is always reviewed by a person at Kalsenti before a final decision, and you can ask us to look again at any decision. You can try up to 3 times in 30 days.

If you can’t or don’t want to do a selfie check. Email [email protected] and ask for a manual review instead. Not verifying never affects anything else on your account: your other models, chats and credit work as before.

We use only the cookies needed to sign you in and keep your account secure: kalsenti.session_token keeps you signed in, kalsenti.state protects sign-in with GitHub or Google, and kalsenti.two_factor is used while you enter a two-factor code. Your browser also stores your theme and language choices, and the key that opens your saved chats on that device. See our Cookie Policy for details.

We’ll update this policy when the way we handle personal data changes, and change the date at the top. If a change is significant, we’ll email you before it takes effect.

This policy is written in English, and the English version applies even if you view the site in another language.