Privacy Policy

Celindor AB (“Celindor”, “we”, “us”) builds a personal AI agent with a private memory. This policy explains what data we handle, why, who can see it and where it goes. Privacy is the core of the product: the tools the people who run the service use do not show your conversations, and much of Celindor can be self-hosted so that your data never leaves your own infrastructure.

Who we are

The data controller is Celindor AB (org.nr 559595-3992), Tomegapsgatan 24, 223 50 Lund, Sweden. You can reach us at info@celindor.ai.

Data we process

• Account data — your email address and sign-in credentials, used to create and secure your account, and the devices you have signed in from so we can deliver notifications.
• Conversations and memory — the messages you exchange with the agent, and the memory Celindor builds from them: the people, places, facts and preferences it has learned about you.
• Documents and recordings — files, photos and voice recordings you choose to add, together with their transcripts, summaries and what the agent extracts from them.
• Connected accounts — if you connect a mailbox, a calendar, Google Drive or your iCloud contacts, the mail, events, documents and contacts Celindor reads from them. See “Connected accounts” below.
• Operational data — logs and diagnostics needed to run the service securely and reliably. Our logs record identifiers, sizes, timings and errors. They are written to leave out what you write, say and store (your messages, the agent’s replies, what its tools read and write, your files and their names, transcripts and memory), and secrets that turn up in them are masked. An error reported by an outside service, such as a model provider, is logged as that service words it.

How we use it

• To provide the agent, its memory and the features you use.
• To secure, maintain and improve the service.
• To respond to you when you contact us.

We do not sell your personal data, and we do not use it for advertising.

Legal basis

• Providing the service (your account, the agent, its memory, connected accounts, notifications and sign-in emails): the contract between you and us (GDPR Art. 6(1)(b)).
• Security, operations and the operator log (redacted logs, diagnostics, the record of what operators did to your account): our legitimate interest in running the service securely and being accountable for it (Art. 6(1)(f)).
• Anonymous usage statistics: your consent, which the app asks for when you first open it (Art. 6(1)(a)). You can withdraw it at any time by turning them off, see “Usage statistics”.
• Answering you when you contact us: our legitimate interest in helping you (Art. 6(1)(f)).
• Legal obligations, such as bookkeeping: Art. 6(1)(c).

Who can see your conversations

The content of your conversations, documents, recordings and memory is yours. The people who operate the hosted service work from metadata about them: when a chat happened, how large it is, which role sent a message, chat identifiers, error reports. The tools operators use do not show the text of your conversations, documents, recordings or memory, and never show incognito chats.

There are things an operator can do to your account today, and you should know about them:

• Your agent’s settings. An operator can read and change your profile (what the agent calls you, what you care about, your preferences and active projects) and your agent’s identity, Soul and Rules, the standing instructions it follows.
• Your password. An operator can set a new password on your account, for example when you are locked out. Whoever sets a password could use it to sign in as you.
• Other changes, such as deleting a memory entry when you ask us to, or changing your account’s settings.

Every one of these is recorded, and you can see the record in the app under Your data: what was done to your account and when. Reading your conversations, documents or recordings is not among them.

We plan to add support access that you grant yourself, for a limited time, before anyone can read conversation content to help you. Until then, if we need to look into a problem, we work from metadata and our redacted logs. If that is not enough, we ask you.

Connected accounts

You can connect a Google account (Gmail and Google Calendar), a Microsoft account, an IMAP mailbox or a CalDAV calendar so that the agent can read your mail and your calendar and, if you ask it to, add or change calendar events. You can also connect Google Drive, so that Celindor fetches the folders and files you choose into your documents (it never changes anything in Drive), and your iCloud contacts, so that the agent can look people up when you ask (it cannot change them, and keeps no copy of your address book: it fetches contacts from iCloud when needed). Connecting is always your choice, and you can disconnect at any time from the app.

Data that Celindor receives from Google APIs is used only to provide these features to you. We do not use it for advertising, we do not sell it, and we do not share it with anyone except as needed to provide the feature you asked for (for example, the model provider you have chosen, see below). Celindor’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. When you disconnect an account, its sign-in tokens are deleted.

Models and processing

Celindor is model-agnostic. When you connect a model provider, or point Celindor at your own endpoint, the content you send to the agent is processed by the model you have chosen, under that provider’s terms. If you self-host the model, that processing stays on your own infrastructure. We do not train models on your data without your agreement.

The one exception is Celindor’s own small models that make quick routing decisions, such as whether a message holds something worth remembering. We train them on what you wrote only if you have told us that you agree. You can withdraw at any time: from then on nothing of yours is used, and the text we kept for training is deleted. It is also deleted when you delete your account, and what was kept from a recording is deleted with the recording.

On our test and development instances, if you have not chosen a model provider, the agent uses Anthropic’s models through our own key, so your messages are processed by Anthropic (United States).

Recordings and voice messages are the exception to your choice: whichever model provider answers your messages, they are transcribed and summarised by Google’s Gemini. Depending on how the service is set up, that happens on our own Google Cloud project (Vertex AI) in the region we chose, or through the Gemini API with your Gemini key, or on test and development instances with ours. Without any of these, recordings are not transcribed. The app shows which applies to you under Your data.

Where it is stored

The hosted service runs on servers operated by Hostinger in Germany. Documents and recordings are stored with Hetzner, also in Germany. Your data is stored inside the EU/EEA and is protected by EU data-protection law. Some features send parts of it outside the EU/EEA; they are listed under “Who we share it with”.

Model-provider keys and the sign-in tokens for connected accounts are encrypted at rest with AES-256-GCM, using keys that never leave the server. Your conversations, memory, documents and recordings are not encrypted separately by the application. They are protected by access controls on our servers in the EU.

Usage statistics

The app sends anonymous usage counts to TelemetryDeck GmbH (Germany), which processes them on servers in the EU, so we can see which features are used and what to improve. A count says that something happened, such as a message being sent, a screen being opened or a recording being started, together with the app version, the kind of device and operating system, and the device language. It never contains what you write, say, store or search for, never your account, and nothing is sent from an incognito chat. The counts are grouped under a random id for the device, which is hashed before it is sent and is not linked to your account.

The app asks you about usage statistics when you first open it, and sends nothing, and stores no device id, until you allow it. If you don’t allow it, it never asks again. You can change your answer at any time under Your data in the app. Turning them off stops them and forgets the device’s id.

Who we share it with

These parties receive personal data so that the service works. We share it with no one else, unless the law requires it.

• Hosting: Hostinger and Hetzner (Germany), see “Where it is stored”.
• Model providers: the one you choose to connect, see “Models and processing”.
• Recordings and voice messages: Google (Gemini) transcribes and summarises them, whatever model provider you chose, see “Models and processing”.
• Web search: when you or the agent search the web, the search query is sent to the search provider the service uses (Brave, Tavily or DuckDuckGo). The agent writes its queries from your conversation, so a query can contain what you talked about.
• Push notifications: Apple (for iPhone, iPad and Mac) and Google (for Android) deliver notifications to your devices. A notification carries up to the first 100 characters of the message it announces, so that text passes through Apple’s or Google’s servers. In the web app, notifications are delivered by your browser’s push service (for example Google for Chrome, Mozilla for Firefox, Apple for Safari or Microsoft for Edge). There the text is encrypted so that only your browser can read it; the push service sees your IP address and when a notification is sent.
• Telegram: if you link a Telegram account to your agent, your messages to the bot and the agent’s replies pass through Telegram and are stored there under Telegram’s own terms. Nothing goes to Telegram unless you link it.
• Email delivery: our email provider sends your sign-in links and invitations, so it receives your email address and the content of those emails.
• Web app resources: the web app loads its rendering engine and fonts from Google’s servers (gstatic.com) when it opens, which gives Google your IP address.
• Problem reports: on our development instance, a problem you report from the app, with any screenshot you attach, is filed as an issue in our repository at GitHub (United States).
• Usage statistics: TelemetryDeck (Germany), anonymous counts only, see “Usage statistics”.

Transfers outside the EU/EEA

Some of the parties above are based in, or process data in, the United States: the model provider you choose may be, as are Anthropic (on test and development instances), the web search providers, Apple, Google, Mozilla, Microsoft and GitHub. For these transfers we rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the standard contractual clauses in the provider’s data-processing terms. Telegram, if you link it, processes your chats with the bot outside the EU/EEA under its own terms. You can ask us for a copy of the safeguards at info@celindor.ai.

Your rights

Under the EU General Data Protection Regulation (GDPR) you have the right to access, correct, export and delete your personal data, and to object to or restrict certain processing. You can export your data from the app, under Your data, and delete individual chats, documents, recordings and memories there too. To delete your account, contact info@celindor.ai. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY).

Retention

We keep personal data only as long as needed to provide the service or as required by law. When you delete a document or a recording it moves to the Trash, where you can restore it for 30 days. After that, or when you delete it for good, it is removed together with what Celindor learned from it alone.

Our file storage keeps earlier versions of stored files for 30 days as a safeguard against mistakes and failures. A file you delete can therefore remain in that storage for up to 30 more days before it is gone.

When you ask us to delete your account, we delete your account, your conversations, your memory, your documents and your recordings. Two exceptions remain today, and we are working on them:

• Data exports you made and archives you imported can remain in storage after the account is deleted.
• If your account is a sub-account of another account, that account’s memory keeps a note that your account was deleted, with your name.

The record of what operators did to your account is kept after the account is deleted, so that we stay accountable for it. It holds your account’s id, what kind of action was taken and when, and none of your content.

Cookies

This website sets no cookies and uses no analytics. The app uses a session cookie or token only to keep you signed in.

Changes

We may update this policy as the product evolves. Material changes are reflected here with a new “last updated” date.