Privacy notice

Your data, plainly.

Last updated: (set on publication)

Who is responsible

Umbolement UG (haftungsbeschränkt), Ulmenweg 10, 85221 Dachau, Germany, privacy@kesru.com. As a German company we follow the EU General Data Protection Regulation (GDPR) for everything we process, wherever our customers are.

Visiting this website

Our server necessarily processes your IP address, the time, the requested page and your browser's identifier to deliver the site. We do not keep access logs for this website. We use no third-party analytics, advertising cookies, tracking pixels or visitor profiles. Login and setup use the security cookies described below. The optional website chat has its own data handling, described separately below.

Your browser remembers the interface language and the identifier used to sign in, to fill it in next time. This feature does not save your password. These local entries remain until replaced or cleared in your browser. The current tab also keeps setup references and short technical error references so you can resume a setup or report a failed action.

Security cookies protect your login, form submissions and your own setup attempts. They are sent only over HTTPS and cannot be read by page scripts.

The sign-up form and the demo-call form use Google reCAPTCHA v3 to block automated requests. When the check loads, Google receives your IP address; it evaluates your interactions with the site and sets a necessary cookie (_GRECAPTCHA) for its risk analysis. We receive only a score. Legal basis: our legitimate interest in protecting the service against abuse (GDPR Art. 6(1)(f)).

Login session: account access lasts at most 24 hours and ends after two hours of inactivity. Logging out, changing a password or revoking access can end it sooner. A business URL alone does not provide access.

Form preparation: a preparation proof is valid for 30 minutes. It connects an explicit form submission to this browser and does not create an account login.

Setup recovery: a separate browser proof is valid for 24 hours so an interrupted signup can find its own setup instead of creating a duplicate. A setup receipt does not create a login. Reopening a new, unclaimed preparation cannot extend its access beyond 24 hours after creation.

On the server, session records contain protected identifiers, their permitted businesses and timestamps. Access expiry and physical deletion are separate: routine cleanup removes expired session records. A setup receipt contains protected browser and content bindings, business and import references, and its creation time. Expiry of the browser proof does not delete the business account or its saved knowledge.

Password and email confirmation links

A first-password link is valid for 24 hours; a password-recovery link for verified businesses is valid for one hour. A main-email confirmation link is valid for 24 hours. Opening a link only checks it. The password or address changes only after explicit confirmation, and a password link does not sign you in.

The associated records include the email address, business binding, a protected code identifier, status and delivery references. Current proof of a confirmed main address remains while that address is in use. Links in queued emails also follow the email-queue periods below. To limit abuse, protected representations of addresses and IP addresses, with request times, are removed by routine cleanup after 24 hours. These access limits are separate from the lifetime of a link.

Text and voice previews

The public website preview uses the website you enter. The preview in your account uses your saved business facts and reception settings. Your messages and the information needed for a reply are processed by the language and speech providers listed below. A preview does not place a phone call, book an appointment or send a service email.

To prepare a public preview, we read publicly available pages of the website you enter. What we read is kept in server memory and reused for up to 24 hours, so another preview of the same website starts faster. After that, it is no longer used and is removed during routine cleanup.

Preview conversations are held temporarily in server memory. A preview can be accessed for up to two hours from its start; an account preview also requires the original, still-valid login. Expiry blocks further use and does not mean every memory copy is physically removed at that exact moment. A conversation and draft already displayed in your browser remain on the page after access ends. Starting another preview is a separate, explicit action.

Anonymous service totals

To understand which parts of the service work, we keep daily totals for fixed service outcomes, such as a completed preview, a newly created business account or a created checkout session. Each row contains only a UTC date, an outcome name, a count and, where measured, a total duration and duration count. These totals contain no IP address, business or visitor ID, contact details, website address, message text, account link or payment identifier. They do not identify unique visitors or connect a person's steps into a profile. Only the protected administration can read the report. Totals are kept for 180 UTC calendar days and removed by periodic cleanup. No browser tracking request, cookie or external analytics service is used for this measurement.

Businesses that use Kesru

When you start a receptionist, we process your business name, website, email address, phone numbers and the settings and documents you add, to provide the service (GDPR Art. 6(1)(b)). We read your public website to prepare your receptionist. If you choose a paid plan, we also process your billing details and the number of call minutes used, to bill you (Art. 6(1)(b)) and to meet tax record-keeping duties (Art. 6(1)(c)).

We determine retention periods for account content, also after an account has ended, based on the nature of the data, the purposes for which it is processed, and legal requirements. Payment references are kept to meet tax record-keeping duties.

If a refund is still open when an account ends, we keep what we need to finish it, plus your email address so we can tell you when it's done.

Website and document imports keep a source reference, extracted facts, a proposed knowledge text, status and an acceptance receipt so an interrupted import can be checked without automatically running it again. These import records are available for 30 days. They do not contain a stored copy of the original uploaded file. Extracted text and facts saved in your document records, and knowledge you accept, follow those records' own retention and account-deletion rules; the 30-day import period does not delete those records.

Service emails are queued so temporary mail failures can be retried. Queued email content and recipient details are kept for up to seven days; delivery metadata is kept for up to 90 days and removed by periodic cleanup. Account deletion also clears this queue. SMTP acceptance does not prove delivery to your inbox. If acceptance is uncertain, we do not automatically resend the email.

If you configure a webhook, we send call records, including contact details, summaries and transcripts, and explicitly confirmed website chat requests to the HTTPS endpoint you choose. Chat request events contain the confirmed request fields, not the full chat conversation. Your automation platform may keep its own copy. You control that platform's access and retention settings. Removing the webhook stops pending Kesru requests; it does not delete copies already received by that platform. The optional n8n inbox template keeps only selected fields and omits transcripts, but does not enable automatic deletion.

Product network

Kesru, MeetYourSite and FilesPal are products of Umbolement UG (haftungsbeschränkt). So that customers of one product get 20% off the others, the products check with each other at checkout whether an active subscription exists for an email address. Only a hash of the email address is sent, and the answer is only yes or no. We store only the time, the asking product and the result. Legal basis: Art. 6(1)(b) GDPR.

People who call a Kesru receptionist

At the start of every call, callers are told that they are speaking with an AI assistant and that the call is transcribed.

We process the caller's phone number and what is said, to answer the call and email the business the caller called a summary and the full transcript of the call.

We do not keep audio recordings ourselves. Our speech providers may retain call audio under their own policies, as described under “Service providers we use” below. We keep transcripts and summaries for the business and delete them after 90 days. We keep a record of each call (the phone numbers, time, duration and outcome) for 12 months, then delete it. The copy emailed to the business is kept under the business's own policies.

For these calls, the business is responsible for its callers' data, and we process it on the business's behalf under our Data Processing Agreement. Callers who want to use their rights can contact the business or us.

Businesses we call

Where we got your number: from your business's public listing or your own website. We do not buy contact lists.

Why: to briefly tell you about Kesru and ask whether it could help your business. We call business landline numbers only. At the start of every call we say who we are, that you are speaking with an AI and that the call is transcribed. We transcribe the call to create a short summary; we keep no audio.

Legal basis: our legitimate interest in business-to-business outreach (GDPR Art. 6(1)(f)). We process your business's phone number, publicly listed contact details, what is said on the call and, if you open our demo link, public pages of your business's website.

Links in our email contain a reference number so we can see whether a call led to a sign-up.

Who receives it: only the service providers listed below that run the call, its transcription, our email and the demo, some of them in the United States (see “Transfers outside the EU” below). We do not pass your details to other companies.

Your choice: tell us on the call, or email privacy@kesru.com, that you do not want to be contacted. We then stop and put your number and email address on our do-not-call list, which we keep so that we do not contact you again. You can also object to the processing at any time (GDPR Art. 21).

We send an email only if you ask for one during the call.

If you open the demo link in that email, we read publicly available pages of your business's website, such as services, hours, service area and contact details, to show you how your receptionist would answer calls and website chats. We use what we read only for this demo and delete it within 24 hours.

How long we keep it: call transcripts and summaries, 12 months. Our record of each call (the calling and called number, the caller ID we showed, the date, time and duration, the script used and the outcome), 5 years from the call, then it is deleted. This is the period U.S. telemarketing rules set for such records, and it lets us show how we called and defend legal claims. The publicly listed business details themselves (name, website, business phone number and address) stay in our business directory for as long as we do business-to-business outreach. If you agreed to our email, we keep a record of that consent (the address, the time, our question and your answer) for 5 years as proof, then delete it. The do-not-call list is kept permanently and holds only the phone number or email address, so that we can honor your request. The details of your request (your name if you gave it, the number, the date and what we called about) are kept for 5 years. If you ask us not to email you, we keep your address on our do-not-email list permanently, so we never email you again.

People who call our own number

When you call Kesru's own number, for example from our home page or when you call us back, our AI receptionist answers. At the start of every call it says that it is an AI and that the call is transcribed. When you call us back, your words are turned into text while you speak so the AI can reply, and after the call we check that text once for an opt-out or an email request. We keep no recording, transcript or summary of a callback.

If you ask for a demo call on our website, we call the number you enter once, right away, with our AI assistant. We process your first and last name, your phone number, your consent, the IP address your request comes from and the time zone your browser reports. We use the IP address to limit how many demo calls can be requested from one address and as part of the proof of your consent, and the time zone so that we call only at permitted hours. We keep a record of your consent (your name, your number, the consent text you saw, the date and time and the IP address) and our record of the call, including the time zone, for 5 years as proof, then delete it.

We process your phone number and what is said, to answer your questions and, only if you ask for it, to email you a sign-up link. If a question stays open, our team receives a short summary so we can follow up.

Legal basis: steps you ask for before a possible contract (GDPR Art. 6(1)(b)) and our legitimate interest in answering inquiries (GDPR Art. 6(1)(f)).

Who receives it and how to stop further contact are the same as for businesses we call, described above. We keep transcripts and summaries of these calls for 90 days and our other records as described above.

Optional website chat

The business chooses whether to enable the limited AI text chat and separately approves the public facts it may use. Private phone notes and uploaded documents are not automatically published in the chat. Visitor messages and the approved facts are sent to OpenAI to prepare text answers. The chat has no audio recording, browser storage or tracking cookies. It cannot confirm bookings or place calls.

Unsubmitted chat messages are held temporarily in server memory, expire after 30 minutes of inactivity and no later than two hours after the session starts, and are cleared on server shutdown. The full chat conversation is not saved in our database. To limit abuse, we temporarily hold daily salted representations of visitor IP addresses and request times in memory; we do not save the IP addresses in a chat database or log. Daily business-level request counts are kept for up to 180 days.

A visitor must review and explicitly submit a callback request before we save it. Confirmed contact details and request fields are available to that business for up to 90 days and enter the existing email queue and, if configured, its webhook queue. These queues use the retention periods described above. Recording a request does not confirm that a person has read it or that an appointment has been booked. For the business's website chat, we process visitor data on the business's behalf. The business is responsible for the information on its own website and for responding to requests.

Service providers we use

The full list with locations is on our sub-processors page.

Amazon Web Services (AWS, servers in Northern Virginia, USA): hosting of the service and its database. Saved server-voice samples are used only for comparison, not as live customer voices.

Eleven Labs Inc. (USA): speech recognition and the assistant's spoken replies (its voice) during calls. Zero data retention is not enabled for our account, so Eleven Labs may retain caller audio, text for speech and generated speech under its own retention policy.

Cartesia AI, Inc. (USA): the assistant's spoken replies (its voice) during calls, only as a backup if the main voice provider fails. Cartesia receives the text to be spoken, not caller audio. Zero data retention is not enabled for our account, so Cartesia may retain that text and the generated speech under its own retention policy.

Anthropic Ireland, Limited (Dublin, Ireland; data processed in the USA): the language model that writes the assistant's replies during calls. It receives the conversation text and the business's receptionist instructions and knowledge. We use Anthropic's commercial API; this does not exclude all provider-side processing or retention.

Deepgram, Inc. (USA): speech recognition during calls, only as a backup if the main speech recognition fails.

OpenAI Ireland Ltd (Dublin, Ireland; data processed in the USA): language processing in the backup conversation path, if the main language model fails, and in the optional website text chat. We disable optional chat-completion storage and data sharing; this does not exclude all provider-side retention.

Telnyx LLC (USA): phone numbers and call connection.

Contabo GmbH (Munich; backup server in the USA): our backup server. Backups are encrypted before they leave our server.

Stripe Payments Europe, Limited (Dublin, Ireland): payments, subscriptions and invoices for paid plans. Card details go directly to Stripe; we never see or store them.

Google Ireland Limited (Dublin, Ireland): bot protection on the sign-up and demo-call forms (reCAPTCHA v3).

Each provider that processes data on our behalf is bound by a data processing agreement. We do not sell caller data or use it to train our own models.

Transfers outside the EU

Data is processed in the United States and in the EU (Germany, Ireland). Transfers to the United States rely on the EU-U.S. Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses. Where our contract is with a provider's European company, its U.S. affiliate may process the data. You can ask us for a copy of the safeguards.

Your rights

You can ask for access, correction, deletion, restriction, data portability, and object to processing (GDPR Art. 15–21). Just email us. You may also complain to a supervisory authority; ours is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany. California residents: we do not sell or share personal information, and you have the same rights under the CCPA; we will not treat you differently for using them. Write to privacy@kesru.com.