Privacy Policy
Last updated
Klu is one company and one account you sign in with across its products, the Sales Simulator, the Klu Meet Extension and the Klu Meet archive. This policy explains how Klu Technologies Oy handles your personal data when you use them and our website. We collect what we need to run them, and we don't sell your data.
Who we are
Klu Technologies Oy ("Klu", "we") is a company incorporated in Finland. We are the controller of the personal data described here. Our service is aimed at people in the European Union and the United States.
For anything about your data, email support@klu.so. Our lead supervisory authority is the Finnish Data Protection Ombudsman.
What we collect
- Account data. Your email address, your Full Name, your password (stored only as a hash), and, if you sign in with Google or Microsoft, the name and email address they share with us.
- About You. Your role, experience, industry, and what you sell, from onboarding and your settings.
- Practice data. The Lessons you create, your Practice Sessions, their Reviews, and your Starred sessions.
- Voice and Call Recordings. The audio of each Practice Session, with your voice and the AI buyer's, and its transcript.
- Billing data. Your Practice Plan, payments, and invoices. Card details go to Dodo Payments, never to us.
- Usage and technical data. The product events of your use, keyed by your user id, errors, and the requests your browser makes, including your IP address.
- Klu Meet archive. If you used Klu Meet, your meeting notes, transcripts, and meeting audio.
Why we use it, and our lawful basis
- To run the service you signed up for: your account, Practice Sessions, Reviews, Call Recordings, the Klu Meet archive, your Practice Plan and billing. Basis: performing our contract with you.
- To keep invoices and billing records. Basis: our legal obligation under tax and accounting law.
- To measure and improve the product with server-side analytics keyed by your user id, to monitor errors, and to keep the service secure. Basis: our legitimate interest in a working, secure and improving product. You can object at any time.
- To run analytics and session replays in your browser, and to record your screen when an error happens. Basis: your consent, which you give or refuse in the cookie banner.
- To send you emails about your account, such as a Data Export being ready or a warning before an inactive account is deleted. Basis: performing our contract with you.
We never send your email address to our analytics or error monitoring tools. They know you only by your user id.
Your voice and Call Recordings
Every Practice Session is a voice call with an AI buyer, and it is recorded. ElevenLabs runs the call and keeps its Call Recording and transcript for as long as your account exists. When you delete your account, we delete them at ElevenLabs too.
We use your voice only to run the call and to analyze what was said. We don't use it to identify you, so it is not biometric data. ElevenLabs' terms let it use customer conversations to improve its models unless the customer opts out, and we opt out where our plan allows it.
AI analysis
OpenAI analyzes the transcript of each Practice Session to write its Review, and generates Lessons and Warm-up Quizzes from what you give it. We tell OpenAI not to store these completions. Under its API terms, OpenAI doesn't train its models on our data, and may keep it for up to 30 days to detect abuse before deleting it.
A Review is generated automatically and can be wrong. It has no legal or similarly significant effect on you.
Klu Meet Extension
The Klu Meet Extension is our Chrome extension. It records your calls and saves them as files on your own device, and your recordings never leave it. This section covers the little the extension does send, and why.
When you start a recording in a meeting tab on Google Meet, Microsoft Teams or Zoom, the extension captures the sound of the tab and your microphone, and the picture of the tab too if you record video. While the recording runs, it is written to the extension's own storage in your browser. When it ends, it is saved as a file in your Downloads folder, or in the folder you chose in Settings.
We never receive your recordings, their audio or video, the names or links of your meetings, or who was in them. The extension makes no transcripts or summaries. Once a recording is saved as a file, it is yours to keep, move, share or delete, and we hold no copy.
The extension stores on your device:
- Recordings in progress, and any recording that could not be saved as a file yet, in the extension's private storage.
- Your sign-in: the session and account details that keep you signed in to your Klu account.
- Your settings, such as the folder recordings go to, whether you record video or sound only, and where the recorder button sits.
- Your open meeting tabs, so the extension can take you to one when you want to record.
All of it stays in your browser, and none of it is sent to us. Uninstalling the extension deletes it, recordings not yet saved as a file included.
The extension sends us only:
- Your sign-in. You sign in with your Klu account on our website, which hands the extension a sign-in session. Signing in and staying signed in go through our authentication provider, which tells us which Klu account uses the extension. Basis: performing our contract with you.
- Error reports. When something goes wrong, the extension sends an error report to Sentry. It carries your user id, the domain of your email address (like
example.com, never the address itself), when your account was created, how you sign in, your browser and extension versions, the meeting platform, and the error itself. Before it is sent, every web address in it is replaced by the meeting platform and every file path is removed, so it never carries anything that identifies a meeting or your files. Basis: our legitimate interest in a recorder that works. You can object at any time.
The extension runs no analytics, shows no ads, and doesn't track the pages you visit. It can see the pages you open only to show its recorder button and to notice when a meeting ends.
How long it is kept:
- Recordings not yet saved as a file stay in the extension's storage for up to 7 days, or until they take up 10 GB together. You are warned first, with a way to try saving again, and nothing goes sooner than 24 hours after that warning. A recording still in progress is never removed.
- Your sign-in stays on your device until you sign out or uninstall the extension.
- Error reports expire at Sentry within 90 days.
Our use of the data the extension handles complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. We use it only to provide and improve the extension's recording features. We don't sell it, use it for advertising or to decide credit, or let anyone read it except to fix a problem you report, for security, or where the law requires it.
Your sign-in goes through Supabase and error reports go to Sentry, both listed with the rest of our Subprocessors. Your rights below cover this data too, and you use them as described there or reach us as in Contact.
Cookies and similar technologies
We store what the site needs to work on your device, like your sign-in session and your cookie banner choice. Everything else in your browser waits for your consent: the OpenPanel analytics with its session replays, Ahrefs analytics, and Sentry's replay of an error. Accepting and rejecting are equally easy, and you can change your choice at any time with "Cookie settings" in the footer.
Who processes your data
We use these processors, under data processing agreements, to run Klu. The Subprocessors page lists the data each one processes.
- ElevenLabs: Runs the AI buyer of each Practice Session: voice, speech recognition and the conversation. Stores the Call Recordings and transcripts. (United States)
- OpenAI: Analyzes each Practice Session for its Review, and generates Lessons and Warm-up Quizzes. (United States)
- Supabase: Hosts our database, sign-in and file storage. (European Union)
- Cloudflare: Hosts and serves the website and the app. (Worldwide edge network, with servers in the United States)
- Bueno: Hosts our blog, and counts page views of the website, telling people from search and AI crawlers. (Worldwide edge network, with servers in the United States)
- Trigger.dev: Runs our background jobs, such as preparing a Data Export or deleting an account. (United States)
- Dodo Payments: Our merchant of record: takes payments for Pro and Extra Sessions, collects sales tax or VAT, and issues invoices and refunds. (United States and India)
- Plunk: Sends our emails, such as a Data Export being ready. (European Union)
- OpenPanel: Product analytics. Our server sends it product events. With your consent, it also runs in your browser and records session replays. (European Union)
- Sentry: Error monitoring. With your consent, it also records a replay of your screen when an error happens. (European Union (Germany))
- Ahrefs: Website analytics, only with your consent. (Singapore and the United States)
- Mux: Stores and streams the meeting audio of the Klu Meet archive. (United States)
- Google Cloud: Stores files of the Klu Meet archive. (United States)
- Autumn and Stripe: Bill and cancel any remaining Klu Meet Plan. (United States)
Google and Microsoft handle your sign-in if you choose them, under their own privacy policies. Dodo Payments, as merchant of record, is also a controller of the payment data it needs for tax and fraud prevention.
We share data with authorities only when the law requires it. If Klu is sold or merged, your data moves with it under this policy.
Transfers outside the EU
Some processors handle data outside the European Union and the European Economic Area, mostly in the United States. Each transfer is covered by the EU-US Data Privacy Framework, for processors certified under it, or by the European Commission's Standard Contractual Clauses. The Subprocessors page says which applies to each. Email us for a copy of the safeguards.
How long we keep it
- Your account and practice data, Call Recordings and transcripts included, for as long as your account exists. Deleting your account deletes them, at ElevenLabs and in our analytics too.
- Inactive accounts are deleted after 3 years without a sign-in. We email you 30 days before, and signing in keeps your account. An account with Pro still active is never deleted this way.
- Invoices and billing records for as long as tax and accounting law requires, which in Finland is up to 10 years. Dodo Payments keeps its own, for the same reason.
- Error events expire at Sentry within 90 days, and database backups within 30 days, even after your account is deleted.
- A Data Export is deleted once its download link expires.
Your rights
Under the GDPR, you have the right to:
- access your data and get a copy of it,
- take it with you in a machine-readable format,
- correct it: you can edit your Full Name and About You in your settings,
- erase it: you can delete your account from Security in your settings,
- restrict how we use it,
- object to what we do based on our legitimate interest,
- withdraw your consent at any time with "Cookie settings", without affecting what we did before, and
- complain to the Data Protection Ombudsman or the authority of your own EU country.
To use any of them, email support@klu.so from the address on your account. We answer within one month.
Minimum age
Klu is for people aged 16 or older. We don't knowingly collect data from anyone younger. If you think a child has given us their data, email us and we will delete it.
Security
Your data is encrypted in transit and at rest with our processors, and access to it is limited to the people who need it to run Klu. If a breach puts your rights at risk, we tell you and the Data Protection Ombudsman as the GDPR requires.
Changes
When this policy changes, we update the date at the top. If a change affects how we use data you already gave us, we tell you by email or in the app before it applies.
Contact
Klu Technologies Oy, Finland: support@klu.so. See also our Terms of Use and Subprocessors.