1. Introduction

Kalima ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our multilingual transcription and translation platform ("Service"). It complies with the EU General Data Protection Regulation (GDPR) and other applicable data protection laws.

2. Data Controller

The data controller responsible for your personal data is:

ByteHawk GmbH
Represented by its managing director Onur Can Karaduman
Fährstraße 217, 40221 Düsseldorf, Germany

For questions or requests regarding your personal data, you can reach our data protection contact at privacy@meetkalima.com. We have not appointed a separate Data Protection Officer; this address reaches the team responsible for data protection.

3. Data We Collect

3.1 Account Data

When you register, we collect your name, email address, and authentication credentials. If you sign in via Google, we receive your Google profile information (name, email, profile picture).

3.2 Usage Data

We automatically collect information about how you use the Service, including session durations, features used, and performance metrics.

3.3 Audio Data

When you record a session or upload a file, we transcribe the audio and also store the recording itself, so you can play it back and export it later. The audio stays stored until you delete the session or your account. Deleted sessions are permanently removed, including their audio, after 30 days. All audio processing takes place on servers in the EU.

3.4 Cookies and Similar Technologies

We use essential cookies for authentication and session management. Optional analytics and marketing cookies are only set with your explicit consent. See our cookie consent banner for details and controls. Until you choose, and if you decline, we still count visits without cookies or any storage on your device, and error monitoring never uses cookies (see section 6).

3.5 Abuse Prevention

New accounts receive free minutes. To stop anyone from claiming them many times over through extra accounts, we check a few technical characteristics when you sign up: your IP address, your browser, how long filling in the form took, whether the email address belongs to a disposable-mail provider, the Cloudflare Turnstile bot check, and a device ID that the FingerprintJS library calculates in your browser when you submit the sign-up. No data is sent to the maker of FingerprintJS.

As long as your free account has not been cleared, your browser also sends the names of your audio devices (microphones and speakers, never cameras) once you allow microphone access. We keep only a hash of them and delete it three years after the device was last used, even if you delete your account earlier, so that new free accounts on the same device can be recognised in the meantime.

A program calculates a risk score from these characteristics. If the score is high, or if more than two accounts share one device or connection, we pause the free minutes until a moderator has reviewed the account. Minutes you have bought keep working, and we do not suspend accounts automatically. If you think the pause is a mistake, write to support@meetkalima.com: we will then review the case by hand, and you can explain your side. The legal basis is our legitimate interest in preventing abuse of the free minutes (Art. 6(1)(f) GDPR).

3.5 Newsletter Data

If you voluntarily request our newsletter, we store your email address, interface language, the signup source, the wording version shown to you, and timestamps and technical evidence for the request and confirmation. We do not send newsletters until you use the confirmation link we email you.

4. Legal Basis for Processing

We process your personal data on the following legal bases:

Contractual necessity - to provide the Service you have signed up for.
Consent - for optional cookies, session replay, marketing communications, and browser analytics linked to your account.
Legitimate interest - for security, fraud prevention (including the abuse prevention in section 3.5), error and performance monitoring, cookieless visit statistics, and understanding how the Service is used so we can improve it.
Legal obligation - to comply with applicable laws and regulations.

5. How We Use Your Data

To provide, maintain, and improve the Service.
To authenticate your identity and manage your account.
To process payments and manage subscriptions.
To send service-related communications (e.g., billing, security alerts).
To send the newsletter if you have confirmed the optional subscription.
To monitor errors, performance, and reliability, and to analyze how the Service is used.
To detect, prevent, and address technical issues and security threats.

To operate the Service, we share personal data with providers in the following categories:

Transcription processing provider - audio data for real-time speech-to-text, processed on EU servers.
AI processing provider - text data for summarization, chat, and translation features.
Cloud infrastructure provider - hosting and data storage in the EU.
Network and security provider (Cloudflare) - delivers the website and app, encrypts connections, and protects the Service against attacks and automated sign-ups (Turnstile). Cloudflare processes your IP address and technical connection data for this.
Product analytics and session replay (PostHog) - product usage analytics, session replay, surveys, and feature flags, hosted in the EU and reached through our own reverse proxy. With your consent, PostHog sets a cookie, links your use of the Service to your internal account ID, and may record session replays; this stops when you withdraw consent. Replays hide form inputs, text in tooltips, and every text that is not a fixed label of our interface (such as buttons, menus, and headings), so session names, names, email addresses, and numbers stay hidden. They never record audio or video and show transcripts, AI chats, summaries, and moments only as empty boxes. The administration area and gift pages are never recorded. Before you make a choice in the cookie banner, and after you decline or withdraw consent, our server counts page views from the details your browser sends with every request anyway: the page address, the referring page, campaign tags in the link, browser, language, and country. After a decline, PostHog also counts clicks in the browser, without cookies and without storing anything on your device. For both, PostHog derives a visitor identifier on its servers from your IP address, browser, and a random value that changes daily, then discards the IP address and browser details; there is no replay and no link to your account. To learn how people find us, our server also keeps the referring page, campaign tags, and first page of your first visit of the day for up to 26 hours, filed under a value computed from your IP address, browser, and a random daily key, without storing the IP address itself. If you register that day, we save this with your account as the source of your registration. This counting is based on our legitimate interest (Art. 6 (1) (f) GDPR); you can object at any time with the "Anonymous statistics without cookies" switch in the cookie settings, after which none of it happens for that browser and PostHog is not loaded at all. PostHog may derive a coarse, country-level location from your IP address; it does not use your IP to identify you.
Error and performance monitoring (Sentry) - error reports, performance traces, and application logs, hosted in the EU (Germany). Sentry does not use session replay. We do not send your IP address or cookies to Sentry, and we identify you only by an internal account ID, never your name or email. Reports also note which app you use (desktop app, browser, or phone), its version, your plan, and the interface language. It runs in production only and, because it sets no cookies and stores nothing on your device, it runs independently of your cookie choice, based on our legitimate interest in a secure and working Service. A filter strips secrets and known content fields from every report before it leaves your device.
Authentication provider (Google) - only if you use Google sign-in.
Payment processor (Stripe) - for subscription and credit billing.
Push notifications (Apple, Google) - only in the Kalima app for iPhone and Android, and only if you allow notifications. So that we can tell you, even with the app closed, when the summary of a recording is ready or a recording reaches its time limit, we store an identifier that Apple (Apple Push Notification service) or Google (Firebase Cloud Messaging) assigns to your phone. The notifications are sent through that service. The summary notification contains the name of the recording; the time limit notification only the minutes left or that the recording has stopped. Neither ever contains a transcript or summary. You can turn each of them off separately in the app under Profile > Notifications. We delete the identifier when you sign out on the phone, after 90 days without use, and with your account.
Email delivery provider (Mailjet) - to deliver transactional messages and, after your double opt-in, the newsletter.

Some operational events, such as billing and subscription changes processed through Stripe, account signup, and the start or completion of a recording, are recorded on our servers using PostHog regardless of your cookie choice, because they originate from payment webhooks and background jobs that never see your browser. These events never contain transcript or AI content, are tied only to your internal account ID, and are processed as part of operating the Service and fulfilling our contract with you, not as consent-based analytics. We also use feature flags to decide which product features are enabled for your account; this is a functional decision about the product you receive, not tracking, and it may run even if you have declined analytics.

In addition, the actions in the Service that we already record in our own database, for example signing in, creating, sharing, and exporting sessions, changing settings, onboarding steps, team and billing changes, and which features you use, are forwarded from our servers to PostHog, also regardless of your cookie choice. Each event carries only your internal account ID, the kind of action, and technical details such as counts, formats, or app type; never transcript or AI content, names, email addresses, or the titles of sessions and files. So that we can see how different groups use the Service, PostHog also stores these attributes with your account ID: plan, interface language, sign-in method, whether your email address is verified, the month you signed up, whether you completed onboarding, whether you belong to an organization, and whether you joined through a referral. The legal basis is our legitimate interest in understanding and improving the Service (Art. 6 (1) (f) GDPR). You can object to this processing at any time by writing to privacy@meetkalima.com; we then stop forwarding events for your account and delete your profile in PostHog.

Your answers to the onboarding questionnaire (use cases, role, what matters most to you, audio sources, how often you plan to use Kalima, how you heard about Kalima) reach PostHog only if you have consented to analytics cookies. Your browser then adds them to your PostHog profile; without consent our servers never pass them on.

For organizations, PostHog also stores a few facts about the organization itself on the same legal basis, but never its name: its plan, the number of members, seats, and teams, and the month it was created. From time to time we ask a short question in the app, for example why you have not started a recording yet. Such surveys appear only if you have consented to analytics cookies, and answering is voluntary. PostHog stores your answer with your internal account ID. Please do not enter personal details in optional free-text fields.

For revenue analysis, we also transfer billing data from Stripe to PostHog in the EU. The legal basis is our legitimate interest (Art. 6 (1) (f) GDPR). You can object at any time by writing to privacy@meetkalima.com.

AI assistants you connect to Kalima

You can connect an AI assistant such as Claude or ChatGPT to your Kalima account through the Kalima connector (MCP). You set up the connection in the AI tool and approve read access on a Kalima page. When you ask the assistant about your recordings, it can request titles, start times and durations, names of projects, workspaces, teams and organizations, speaker names, and transcript text or excerpts. Kalima sends only data you can access in the app. Audio is not sent. If you separately allow access to saved AI summaries, the assistant can also request compact excerpts from your own summaries. If you allow organizing recordings, it can change their project and workspace assignments after you confirm a preview. Moving a recording into or out of a shared project changes access for project members. We provide this data at your request to perform our contract with you (Art. 6(1)(b) GDPR). The provider's terms and privacy policy govern what it does with the data afterwards.

For each connection, we store the AI tool's registration details, such as its name and return address, your approval, and hashed refresh tokens. For tool calls, we record the function used, the result, the duration, and the connected app's ID. For a successful call about one recording, we also record that recording's ID. These records do not contain search terms or the content sent to the tool. Expired sign-in codes are deleted after one day, expired refresh tokens after 30 days, revoked approvals after 90 days, and registrations nobody approved after seven days. Tool-call records are deleted after one year.

You can revoke a connection at any time under Connected apps in your Kalima account. The AI tool loses access with its next request. Revocation does not erase data already sent to the provider; its retention and deletion rules apply to that data. Deleting your Kalima account ends every connection.

We do not sell your personal data to third parties, and we do not use your conversations to train AI models.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. Deleted sessions and associated data are permanently purged within 30 days. You may request account deletion at any time; the erasure is carried out 14 days after the request, and you can withdraw the request at any point in that window.

Two categories outlive your account. Invoices and the accounting records behind them are retained for the periods German law prescribes, currently 8 years under section 147 (1) no. 4 and (3) of the Fiscal Code (AO) and section 257 of the Commercial Code (HGB), and 10 years for the underlying revenue records; this is permitted by Art. 17 (3) (b) GDPR, and the data is used for nothing but that purpose. Separately, we keep usage records: how long each recording ran, how many words it produced, and which features were used when. These hold no transcripts, no audio and no contact details, but they stay attached to your account record, which we anonymize rather than delete, so we do not describe them as anonymous data.

Unconfirmed newsletter requests are deleted after 30 days. If you unsubscribe, we retain your email address and the withdrawal timestamp as a suppression record so we do not contact you again by mistake. Technical signup details are removed within 30 days after the unsubscribe.

8. Your Rights (GDPR)

As a data subject under the GDPR, you have the right to:

Access - request a copy of your personal data.
Rectification - correct inaccurate or incomplete data.
Erasure - request deletion of your personal data ("right to be forgotten").
Restriction - restrict processing of your data.
Data portability - receive your data in a structured, machine-readable format.
Objection - object to processing based on legitimate interest.
Withdraw consent - withdraw previously given consent at any time.

To exercise any of these rights, contact us at privacy@meetkalima.com. We will respond within 30 days. You also have the right to lodge a complaint with a data protection supervisory authority.

9. International Data Transfers

We store your data in the European Union. Some of our service providers are based in the USA or may process data there: Cloudflare, Stripe, Google, Apple, the provider behind our AI features (OpenRouter), our speech recognition provider, and our analytics and error monitoring providers (PostHog, Sentry). For the last three, the data is hosted in the EU, but the companies are based in the USA. Transfers to them rely on the EU-US Data Privacy Framework adequacy decision (Art. 45 GDPR) where the provider is certified under it, and otherwise on the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR). You can request a copy of these safeguards at privacy@meetkalima.com.

10. Data Security

We implement appropriate technical and organizational measures to protect your data, including encryption in transit (TLS), strict access controls, encrypted storage of share-link passwords (AES-256-GCM), and regular security assessments.

11. Children's Privacy

The Service is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected such data, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-app notification. The "Effective" date at the top indicates the latest revision.

13. Contact

For privacy-related questions, concerns, or requests, contact our data protection contact at privacy@meetkalima.com.

Privacy Policy