Privacy Policy

1. Controller

Kalonis GmbH
Berliner Allee 158
13088 Berlin
Germany
Email: [datenschutz@kalonis.de]

2. Data We Collect

We collect and process the following personal data:

  • Account data: email address, name (upon registration)
  • Project data:support email address and the credentials of the connected mailbox — either an SMTP/IMAP username and password or, for Microsoft 365, an access token (see section 7). Transmission is always encrypted; storage in our database is protected by our database provider's encryption at rest.
  • Ticket data: email addresses and names of end customers, message contents, attachments
  • AI output: draft replies, categorisations and translations derived from ticket contents (see section 6)
  • Usage data: IP address, browser type, time of access (server logs)
  • Payment data: processed exclusively by our payment provider Paddle. We do not store credit card details.

3. Purposes of Processing

  • Provision and operation of the KDesk platform
  • Authentication and account management
  • Retrieval and sending of emails on behalf of the user
  • Producing draft replies, categorisations and translations with AI assistance — only for projects where these features are switched on
  • Invoicing and payment processing (via Paddle)
  • Communication regarding the Service (e.g. confirmation emails, invitations)

4. Legal Basis

Processing is based on Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in providing the Service).

5. Data Processors

We use the following service providers:

  • Supabase Inc. — database and authentication (servers in Frankfurt, EU)
  • Vercel Inc. — hosting of the web application
  • Paddle.com Market Limited — payment processing (Merchant of Record)
  • Anthropic PBC, USA — AI processing of ticket contents for draft replies, categorisation and translations. Only for projects where these features are switched on. The transfer to the USA is based on the EU Standard Contractual Clauses.

Data processing agreements pursuant to Art. 28 GDPR are in place with all service providers.

6. AI-Assisted Features

KDesk can suggest draft replies, categorise tickets, group feature requests and translate messages. These features can be switched off per project and are not included in the free plan.

When such a feature is switched on, the ticket contents needed for it are transmitted to Anthropic: the message history of that ticket, the project context you have stored, and published FAQ entries. Personal data of your end customers therefore reaches Anthropic to the extent it appears in those messages. Attachments are not transmitted.

Results are stored in our database and deleted together with the ticket. A draft reply is never sent automatically — it is presented to an agent for review.

If you do not want this processing, switch it off under Project settings → AI replies. Drafts already produced can be dismissed on the ticket.

7. Microsoft 365 Connection

When a mailbox is connected via “Sign in with Microsoft”, we receive a token from Microsoft that lets us fetch the selected mailbox and reply on its behalf. We never learn your Microsoft password.

We store that token, the address of the connected mailbox, and the sign-in name of the account used to establish the connection. Access is limited to fetching and sending email; we do not access calendars, contacts or files.

You can end the connection at any time — in KDesk by changing the sign-in method or deleting the project, and independently at Microsoft itself under myapps.microsoft.com. After that no further retrieval is possible.

8. Retention Period

Account data is stored for as long as the account exists. After account deletion, all personal data is deleted within 30 days. Invoicing data is retained for up to 10 years in accordance with commercial and tax law retention obligations.

9. Your Rights

You have the right to:

  • Access your stored data (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure of your data (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Object to processing (Art. 21 GDPR)
  • Lodge a complaint with a supervisory authority

10. Cookies

KDesk uses only technically necessary cookies for authentication (session cookies). No tracking or advertising cookies are used.

11. Contact

For privacy-related questions, please contact:
[datenschutz@kalonis.de]

Last updated: April 2026