Privacy policy

Last updated 28 October 2026

keletto checks whether AI assistants recommend a company to its buyers, writes fixes, and helps with outreach. This page explains what data it uses, why, and how to remove it.

Without signing in

Your results, websites and settings stay in your own browser (local storage). keletto's server doesn't keep them.
When you run a scan, the website address is sent to our server. We read the public pages of that website and ask AI services buyer-style questions about its market.
The server keeps the buyer questions written for each website, so later scans ask the same ones and results compare fairly. It also keeps anonymous patterns across scans to write better questions. None of this is tied to you.
Scan progress files are deleted within 24 hours. If you make a share link, that snapshot is stored until you remove it.
If you add your own AI API keys, they are sent only with your own requests and are never stored on our server.

When you sign in with Google

We receive your name, email address and profile picture from Google, and use them only to identify your account.
Your websites, results, outreach history and settings are stored in your account, encrypted (AES-256-GCM), so the daily tracking, competitor checks, autopilot and weekly digest can run when you're away.
If you connect a CRM or a posting webhook, its key or address is stored encrypted and used only to send the contacts, replies or posts you asked for.

Gmail

Connecting Gmail is optional and separate from signing in. If you connect it, keletto asks for these permissions and uses them only as described:

Send email (gmail.send): to send the pitches and follow-ups you send, or that you turned on autopilot to send.
Create drafts (gmail.compose): to save pitches to your Gmail drafts when you choose "Save to Gmail drafts".
Read email (gmail.readonly): to read the replies in the threads of emails keletto sent for you, so it can sort them (interested, question, not interested and so on). It does not read the rest of your inbox.

We store the Gmail access token encrypted, and the sender, date and a short snippet of each reply to those threads. Reply snippets are sent to Anthropic's Claude API only to sort them. Gmail data is never used for advertising, never sold, and never used to train AI models. No person reads it unless you ask us to, it's needed for security, or the law requires it.

keletto's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Services we use

Vercel: hosting and encrypted storage.
OpenAI, Anthropic and Google Gemini: answering buyer questions, writing questions, fixes and drafts. They receive the public facts about the website being scanned, and Anthropic also receives reply snippets as described above.
Apify: Google search results for the buyer questions.
Resend: may send the weekly digest when Gmail isn't connected.

We don't sell personal data, and we don't use advertising trackers.

Removing your data

Remove a website from the website menu, and it's deleted.
Disconnect Gmail in Settings. This deletes the token and revokes keletto's access. You can also revoke it at myaccount.google.com/permissions.
Delete your whole account in Settings ("Delete my account"). This deletes your account, every saved website, your outreach history and your connections.
Without an account, clear your browser's site data for keletto.

Changes and contact

If this policy changes, the date at the top changes too. For privacy questions or deletion requests, email the developer contact address shown on keletto's Google sign-in screen.