Privacy policy

This policy describes the personal data Kedrel actually processes, and the limits of that processing, as of 18 October 2026. It does not describe a feature that is not built. Questions and requests: [email protected].

The account

The account record holds your email, your name, your language, the dates of sign-up and of the last sign-in, and whether you asked for product news. News is off unless you opt in. The choice is dated. Kedrel sends no news without it. You can withdraw it in Settings.

The password, the session and the authenticator secret are held by WorkOS. Kedrel does not store them. Creating an account accepts this policy. A separate box, left unticked, accepts the terms of use and the terms of sale.

Each sign-in composes an email with the time in your time zone, the IP address, the city and country when Cloudflare saw them, a browser and a system taken from a fixed list, and the method. Kedrel does not write those values into its database or its logs. The email is sent through Resend, which keeps it as described below.

Data from Google

If you connect Google, you grant gmail.modify, calendar, drive and contacts, plus openid and email to recognise the account. Kedrel uses them to show Gmail, Google Calendar, Drive and Contacts in the console, and to do there what you do yourself or what an AI you allowed is permitted to do.

Kedrel does not copy the mailbox, the calendar or the contacts. It does keep an encrypted copy of mail it has listed: for a message, the sender, the subject and the date; for a conversation, the participants, the subject, the latest date, the number of messages and the labels. Those copies let the inbox open without asking Gmail again for what has not changed. They are deleted when you revoke Google, when you connect a different Google account, and when you close the account. They are not in the export.

A file you explicitly keep in Kedrel, from Drive or from a Gmail attachment, is stored as a Kedrel file. Drive files you only open are not copied.

Kedrel does not sell Google user data and does not use it for advertising. Kedrel does not give its staff a screen to browse that data. A person reads it only if you send it in a support request, for a security investigation, or when the law requires it.

Kedrel's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Files stored in Kedrel

A file you upload, and a file you keep from Gmail or Drive, is encrypted before it is stored with Amazon Web Services in Paris, in the European Union. The name and the record of where it came from are encrypted as well. Your password does not encrypt them. Kedrel is not end-to-end encrypted and not zero-knowledge: the program reads a file on the server to show it to you, to extract its text, and to answer an AI you allowed.

PDF and images are sent, decrypted, to Google Document AI in the European Union, to extract the text. The text, and the words of a search by meaning, are sent to Voyage AI. A search by meaning stores a numeric summary of the beginning of the text. That summary is not encryption. Someone who stole it could guess themes. It would not reconstruct the file.

AIs you connect

An AI receives only what you allowed it to read. A write waits for your click unless you set Write without approval on that action. The request is deleted when it expires after twenty-four hours, or shortly after you decide. Kedrel does not control what the AI does afterwards with the text, on the AI’s own side.

Emails Kedrel sends

Service emails, from [email protected], go through Resend. Resend sees the address and the message and keeps them for thirty days in the United States. They are the verification code, the password reset, the sign-in notice, and product news if you opted in. A reply to those is not accepted. The bounce names [email protected], which a person reads. A request for a connector Kedrel does not offer yet is sent to [email protected] with your name, email, account identifier, language and Google connection. Kedrel does not store that text. A reply goes to the email on the account. A message from the public contact page is sent to [email protected] with the name, email and text you entered. Kedrel does not store that text. A reply goes to the email you entered.

The edge

Connections to kedrel.com, the console and the MCP pass through Cloudflare. Cloudflare decrypts them on its global network, then connects to Kedrel over HTTPS. The sign-in email can name the city and country Cloudflare saw. Kedrel does not store that place, and this plan does not give Kedrel the request logs.

Cookies

The public site stores kedrel_lang, so the console can open in the language of the page you read. It holds en or fr.

The console stores a sealed session cookie, a cookie that protects forms against forgery, and, during sign-in only, a cookie that lives for ten minutes. It stores your time zone name for one year, used for the sign-in email and for pages. Mail can store how many conversations you show per page, for one year. Calendar can store the time zone you picked, for one year. Kedrel does not store a city or a country.

Who is responsible

The publisher named in the legal notice decides why this data is processed. To use your rights, write to [email protected].

Why Kedrel may process it

The account, sign-in, files you store and a Google connection you choose are processed to perform the contract. Product news is processed only with your consent. That box is off unless you opt in, the choice is dated, and you can withdraw it in Settings. Kedrel sends no news without it.

The sign-in email, which can name the IP address and, when Cloudflare saw them, the city and country, is processed for the legitimate interest of securing the account. Kedrel does not write those values into its database or its logs.

Who can receive it

Kedrel, to run the service. Amazon Web Services, in Paris, for hosting and storage. Cloudflare, to carry the connection. WorkOS, for the password, the session and the authenticator secret. Google, if you connect it, for mail, calendar, contacts and files. Google Document AI, in the European Union, to extract text from a PDF or an image. Voyage AI, for a search by meaning. Resend, to send service email. Stripe Payments Europe, Ltd., in Ireland, to take the card and the monthly charge. Kedrel stores the customer identifier, the subscription identifier and the status. It does not see the card number, and it does not send file contents to Stripe. None of them is allowed to use this data for its own advertising.

Outside the European Union

Amazon Web Services stores files in Paris. Google Document AI stays in the European Union. Cloudflare carries traffic on a global network. WorkOS, Resend and Voyage AI are in the United States. Stripe Payments Europe, Ltd. is in Ireland. Those transfers rest on each provider’s standard contractual clauses, or on a data-privacy framework where that provider is certified. Kedrel does not yet hold written commitments from Google Document AI or Voyage AI on confidentiality, retention and training. Until it does, a file is sent to them only for an account of the person who operates Kedrel.

How long data stays

The account, the journal, the Google connection, AI rights and files stored in Kedrel last as long as the account. You can delete a Kedrel file yourself. Closing the account deletes the rows. A stored file can remain in a backup for up to seven days after deletion or closure, then expires.

Revoking Google deletes the encrypted mail copies and the stored Google token. The access token itself is only in memory, and leaves it after fifteen minutes without use, or at once when you disconnect or revoke.

Limits

Kedrel does not yet hold written commitments from Google Document AI or Voyage AI on confidentiality, retention and training. Until it does, a file is sent to them only for an account of the person who operates Kedrel. No one else’s is.

Staff have no ordinary access to content. That does not make the running server unable to read what it shows you. Your password opens the account. It does not decrypt the data. You do not hold a key.

What a connected AI does with text it was allowed to read is outside Kedrel. Content you read is untrusted: it cannot raise an AI’s rights. Kedrel does not rely on detecting malicious instructions.

Your requests

You can ask for access, rectification, erasure, restriction, portability, and, where the basis is legitimate interest or direct marketing, objection. Settings exports the files stored in Kedrel and the account record. Closing the account deletes what Kedrel holds, except a backup that can last seven days. You can revoke Google and any AI without closing. You withdraw consent for product news in Settings. For anything else, write to [email protected]. You can also complain to the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris CEDEX 07, www.cnil.fr.