Privacy Policy
Last updated: 20 August 2026
Keplica is designed to hold your thinking. This policy explains what we collect, how we process it, and the controls you have over your data.
1. What we collect
We collect the content you intentionally create or upload: voice recordings, photos, documents, typed notes and any edits you make to extracted information. We also collect your email address and profile information through our authentication provider to create and secure your account.
2. How we use your data
Your content is used to generate transcripts, extract people, projects, decisions, risks, predictions and action items, build searchable indexes, and surface relevant memories when you ask questions. We do not use your data to train third-party AI models, sell advertising profiles, or share with unrelated services.
3. Audio and transcription
Voice recordings are uploaded for transcription and then stored so you can replay them. Transcripts and AI extractions are stored alongside the original audio. You can delete a memory at any time, which removes the recording, transcript and extracted data from your account.
4. AI processing, who sees what
Transcription, extraction, embeddings and answers are produced by third-party AI models reached through the Lovable AI Gateway, which currently routes to Google Gemini and OpenAI models. What is sent: the audio you record (for transcription) and the transcript, notes and relevant memory excerpts (for extraction, search and answers). Processing happens on those providers' cloud infrastructure, which may be outside your country. Requests are sent through encrypted channels on a per-request basis; under the gateway's enterprise terms your content is not used to train their models and is not retained beyond short-term abuse-prevention windows held by the provider. Because these are stateless API calls, deleting a memory in Keplica removes it from our systems; there is no separate copy at the provider to delete.
5. Storage, security and backups
Your data is stored in encrypted cloud databases and object storage. Every table is protected by row-level security so queries can only return rows belonging to the signed-in account, and audio and attachments are served through short-lived signed links rather than public URLs. Encrypted database backups are retained for up to 30 days for disaster recovery, so deleted content may persist in a backup for that window before ageing out. Routine staff access to memory content is not part of how Keplica is operated; a small number of engineers hold infrastructure credentials that could technically reach stored data, and we use them only where required to fix a fault or comply with law.
6. Recording other people
You are responsible for the recordings and files you bring into Keplica. Laws on recording conversations differ by country and state, in many places every participant must consent. Please make sure you have permission before recording, uploading or transcribing a conversation involving other people, and before storing notes about them.
7. Your rights
You can view, edit, export and delete your memories and profile at any time from within the app. If you delete your account, all associated content is permanently removed within a reasonable technical window.
8. Cookies and analytics
We use essential authentication cookies to keep you signed in. We do not use tracking cookies or third-party advertising pixels. Any analytics we collect is aggregated and does not identify individual memories.
9. Changes to this policy
We may update this Privacy Policy as the product evolves. Material changes will be communicated by email or through a prominent notice in the app before they take effect.
10. Children
Keplica is for adults aged 18 and over. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.
11. Contact
Keplica is operated by [Legal name of operator], [Registered address]. For privacy questions, access, correction or deletion requests, email [privacy@keplica.com]. We aim to respond within 30 days.