Data Policy

This Data Policy explains what Keldo, Inc. ("Keldo," "we," "us") collects when you use keldo.ai and our portfolio-analysis service (the "Service"), how we use it, and the choices you have. By using the Service, you agree to this policy.

1. What we collect

• Statements and financial data you upload. The brokerage statements, exports, or screenshots you provide, and the holdings, balances, account types, and transaction details they contain.
• Account and contact details. Your email address and any information you give us to create an account or receive your report.
• Payment information. Handled by our payment processor, Stripe. Keldo receives a confirmation and limited billing details (such as the last four digits and a transaction ID) but never receives or stores your full card number.
• Technical and usage data. Standard information your browser sends — IP address, device and browser type, and basic analytics about how you use the Service — plus cookies as described in Section 8.

2. How we use it

• To generate, display, and let you download your portfolio analysis.
• To process your payment and issue refunds through Stripe.
• To operate, secure, debug, and improve the Service (using technical and aggregated data — not your holdings).
• To communicate with you about your report, your account, or support requests.
• To comply with legal, tax, and accounting obligations.

We do not use the contents of your statements or holdings to train, fine-tune, or improve any AI or machine-learning model, and we do not sell or rent your personal information.

3. Zero retention of personal information

This is the core of how we handle your portfolio data, and it's a two-step process:

• Redaction happens first. Before anything else, your statement is processed to remove personal information — name, account numbers, address, phone, and other contact details.
• The original is then permanently deleted. Once the redacted version exists, the original file — the one that contained your personal information — is permanently deleted from our systems. It is not backed up, archived, or retained anywhere. We retain zero personal information from your statements.
• The redacted copy is deleted once your report is generated. The redacted version — your holdings, quantities, and values, with direct identifiers (name, account numbers, address, contact details) removed — exists only long enough to let you preview it and to run your one analysis. As soon as your report is generated, this copy is permanently deleted from our systems. While it briefly exists it is encrypted, access-controlled, never sold or shared, and never used to train AI models. We do not retain your statement data.
• Encrypted in transit and at rest. Everything you upload travels over an encrypted (TLS) connection, and stored copies are encrypted at rest.
• Your report. Your finished report — including the downloadable PDF and trade plan — is retained in encrypted storage for up to five years so you can reach it from your report link.
• What else we keep. To run a lawful business we retain a limited set of records that are not your portfolio data — for example your account email and billing/transaction records — for as long as needed and as required by law. See the table in Section 6.

4. Who processes your data (sub-processors)

We rely on a small number of vetted providers to deliver the Service. They may process your data only to perform services for us, under contract, and are not permitted to use it for their own purposes or to train their models:

• Stripe — payment processing.
• Cloudflare — site hosting (Pages) and encrypted object storage (R2).
• DigitalOcean — secure compute for the analysis service.
• Anthropic (Claude API) — used to analyze your holdings under a no-training, no-retention agreement.
• Transactional email — used to send you your report link and account or support messages. We do not use third-party advertising or behavioral-analytics providers.

A current list of sub-processors is available on request at privacy@keldo.ai.

5. How we protect your data

We use technical and organizational safeguards including encryption in transit, access controls, encryption at rest, least-privilege access to stored data, single-use per-report access tokens, immediate deletion of original uploads after redaction, audit logging, and periodic review of our providers. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security, but we work to protect your information and minimize what we hold.

6. How long we keep things

Data	Retention
Original statement (contains personal information)	Deleted permanently, immediately after redaction
Redacted copy (holdings & values, direct identifiers removed)	Deleted as soon as your report is generated
Your report, PDF & trade plan	Retained for five years, then permanently deleted
Account & contact details	Until you close your account, then deleted within 30 days
Billing & transaction records	As required by tax/accounting law (typically 7 years)
Technical logs & analytics	90 days, then deleted or aggregated

7. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to opt out of certain processing, and to not be discriminated against for exercising these rights. To make a request, contact privacy@keldo.ai; we will respond as required by applicable law. Because we delete your statements after analysis, we may not hold much of your data by the time you ask.

California residents. Under the CCPA/CPRA you have the rights described above, including the right to know the categories of personal information we collect (identifiers, financial/portfolio information, and internet or usage data), to request access or deletion, and to correct inaccurate information. We do not sell or share your personal information as those terms are defined under California law, and we do not discriminate against you for exercising your rights. Because Keldo handles financial account information, we also maintain safeguards consistent with applicable financial-privacy laws. To exercise any right, contact privacy@keldo.ai.

8. Cookies

We use essential cookies only — to keep you signed in and operate the Service. We do not use non-essential advertising or tracking cookies. You can control cookies through your browser settings.

9. Children

The Service is intended for adults and is not directed to anyone under 18. We do not knowingly collect personal information from children.

10. International transfers

We process and store data in the United States. If you access the Service from outside the United States, you understand that your information will be processed in the United States, where data-protection laws may differ from those in your location.

11. Changes to this policy

We may update this policy from time to time. We'll post the new version here with a revised "Last updated" date and, for material changes, notify you by email.

12. Contact

Questions or requests: privacy@keldo.ai. A mailing address is available on request.

Reminder: Keldo provides informational portfolio analysis for educational purposes only — not investment, tax, or legal advice.