Privacy Policy
Klk IA reads the messages arriving at your WhatsApp Business number and sends you a daily summary. This policy explains what data is processed, who receives it, how it is protected, and how long it is kept. See also our Terms of Service. A Spanish version is available on request; the English text prevails.
Klk IA never replies to your contacts or writes to them on your behalf. The only messages it sends are the daily digest, a short nudge when it is ready, and replies to the commands you send it.
1. Who we are
Klk IA is operated by Max Francisco Medina Estrella (trading as Medina Labs), Hamburg, Germany. Contact: max@medina-labs.com. Full details are in the Impressum. We have not appointed a Data Protection Officer.
2. Our role
For your account and subscription data, we are the controller: we process it to perform our contract with you (Art. 6(1)(b) GDPR), to keep invoice records the law requires (Art. 6(1)(c)), and, for security logs, for our legitimate interest in running a secure service (Art. 6(1)(f)). Providing this data is required to use the service, and we make no decisions about you based solely on automated processing. For For the messages your contacts send you, we are a processor acting on your instructions: you decide to connect your number and why, and we process those messages only to provide the service to you. Our processor commitments are in section 6 of the Terms.
Those messages are written by your clients, suppliers and contacts. By connecting your number, you decide to run those conversations through Klk IA, and you are responsible for meeting any obligations you have toward them. We never write to them, never use their data for anything other than generating your digest, and never build profiles from it.
3. Data we process
- Incoming messages to your connected number: the message text, the sender's number, the name WhatsApp reports for them (their own profile name, or their number if they have none), the date and time, the content type (text, voice, image, video, document) and, for groups, the group identifier.
- Voice notes, images, videos and documents: we do not transcribe voice notes, download audio, or read the contents of media or documents. We only record that one arrived, from whom and when.
- Your own replies (coexistence mode): when you reply from your WhatsApp Business app, Meta notifies us. We record which number you replied to and when, so that conversation stops reappearing. We do not store the content of your replies.
- Your account: your name, email, phone number, language, timezone and digest preferences.
- Your subscription: your Stripe customer and subscription identifiers, subscription status and invoice history (amount, date, status). We never see or store your card details.
4. AI processing
The digest is generated by an OpenAI language model. To build it, we send OpenAI the message text for the period (masked as described in section 5), the sender's contact name, the time of each message, your own name and, for groups, an internal group label. The group's real name is never received by our system.
OpenAI processes this data under its terms for API customers. We use OpenAI's API, not its consumer products. We do not use your data or your contacts' data to train AI models, and by default OpenAI does not train on data sent through its API. OpenAI may keep API inputs for up to 30 days for abuse monitoring under its own terms, which is longer than our own retention in section 7.
5. Masking before AI
Before message text reaches the AI model, the following is automatically replaced with placeholders: email addresses and web links, credit card numbers, Dominican national ID numbers (cédulas), phone numbers (Dominican and international), and bank account numbers or any run of eight or more digits written together.
Names, amounts and dates are deliberately not masked, because they are exactly what the digest needs to tell you who to contact, for how much and by when. Masking is automatic and pattern-based. It works well for the usual formats, but data written in an unusual way may go undetected.
6. Encryption and logs
Message content is stored encrypted in the database with AES-256-GCM. The message body, contact name, sender's number and group identifier are all encrypted. Encryption keys are held outside the database, in the server configuration.
Your contacts' numbers are encrypted deterministically: the same number always produces the same encrypted value, so numbers can be compared without decrypting them. The tradeoff is that repeated values are recognizable as identical within the database. Your own account phone number is not yet encrypted; that is a pending improvement.
Server logs never contain message content, and phone numbers in them are masked down to the last four digits. Logs are kept by our hosting provider (Railway) for up to 7 days. No method of transmission or storage is 100% secure; we apply reasonable measures but cannot guarantee absolute security.
7. Retention
A daily job deletes messages and reply signals older than 7 days. The digest only needs recent messages, so we keep the minimum. Deleted data can remain in our database provider's backups for up to 6 more hours.
Account data is kept while the service is active for you. After you cancel, we delete it within 30 days, except invoice records we must keep under German tax law (up to 10 years). Stripe keeps its own payment and invoice records as its legal obligations require.
8. Who receives data
- Meta (WhatsApp Cloud API): the channel through which messages arrive and the digest is delivered.
- OpenAI: processes the masked text, as described above.
- Railway: hosts the server.
- Neon: hosts the database.
- Clerk: manages login to the web app.
- Stripe: processes subscription payments. We send it your name and email; you enter your card details directly on Stripe's page.
We do not sell data and do not share it with advertisers. These providers process data outside the Dominican Republic, mainly in the United States. Transfers outside the EEA rely on the safeguards each provider offers, such as the EU-US Data Privacy Framework or Standard Contractual Clauses. Ask us for details.
9. Cookies
We do not use advertising cookies and do not run analytics tools. Our consent banner (Termly, which receives visitors' IP addresses), sign-in (Clerk) and checkout (Stripe) may set strictly necessary cookies. The website stores your language choice in your browser's local storage. You can change your consent at any time with the Consent Preferences link on the home page.
10. Children
Klk IA is for businesses, not minors. We do not knowingly collect data from anyone under 18.
11. Your rights
You can ask us at any time to disconnect your number, tell you what data of yours is stored, or delete it. Write to max@medina-labs.com; we act on disconnection and deletion requests within 30 days. If you are in the European Economic Area, you also have the right to rectification, restriction, objection and data portability, and to lodge a complaint with the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI) or the authority where you live. If you are in the Dominican Republic, you can ask us to access, rectify, cancel or oppose the processing of your data.
12. Changes
If this policy changes materially, we will let you know over WhatsApp and update the effective date above.