Last updated: October 11, 2026
This Privacy Policy explains how Kelpi, a product operated by Fluenn, Inc. ("Kelpi," "we," "us," or "our"), collects, uses, stores, and shares personal information when you use our websites, applications, AI agents, and messaging integrations (the "Services").
Bot protection with Cloudflare Turnstile
We use Cloudflare Turnstile to protect sign-in, registration, and password recovery from bots and abuse. Sign-in verification can run invisibly in the background. Cloudflare processes technical signals such as IP address, browser information, and the site being visited to provide and improve bot detection. See the Cloudflare Turnstile Privacy Addendum for details.
Google Calendar
Access and purpose
Connecting Google Calendar is optional and requires your authorization through Google. Kelpi requests calendar.events.owned to check availability in your primary calendar and create, reschedule and cancel events for appointments booked in Kelpi. Unanswered invitations and tentative events also block time. Kelpi modifies only events it created for your appointments, not unrelated events. We also request openid to identify the connected Google account and prevent syncing an appointment to a different account after reconnection.
For availability, we request event identifiers, start and end times, time zones, event status, whether time is occupied and your invitation response status. We do not request existing event titles, descriptions, locations, attachments or attendee names or email addresses. For appointment synchronization we read our own event identifiers and private Kelpi references, and send the appointment times and a generic appointment title. We receive authorization tokens, an account identifier and technical change-notification identifiers, never your Google password.
Storage, sharing, and limited use
Availability event fields are processed temporarily; Kelpi does not store a copy of your unrelated Google events. We store encrypted access and refresh tokens, granted permissions, token expiration, associated Kelpi organization and staff member, account identifier and notification metadata. We also retain the desired state and synchronization status of Kelpi appointments, including their times and cancellation state, so failed Google updates can be retried safely. Google change notifications contain no event contents.
The connected organization's scheduling features use the resulting availability. Public booking pages show available times, not Google event details. If the organization enables AI or voice scheduling, available times may be processed by the AI or voice providers supporting that feature; raw Google event fields and Google credentials are not supplied to them. Hosting and infrastructure providers process data as necessary to operate and secure the integration. Available times communicated in conversations may remain in conversation history under the retention rules below.
Kelpi's use and transfer of information received from Google APIs adhere to the Google API Services User Data Policy, including its Limited Use requirements. Google data and data derived from it are used only to provide the authorized scheduling features, not for advertising, sale, credit decisions, or training general-purpose AI models. Human access is limited to your specific consent, necessary security investigations, or legal obligations. Any other disclosure must meet Google's Limited Use requirements; a business transfer involving this data requires your prior explicit consent. These restrictions take precedence over the general sharing and use provisions of this policy for Google data.
Disconnecting and deletion
Disconnecting stops Google access and synchronization, removes connection credentials and pauses booking links. It does not delete existing Google events, Kelpi appointments or related conversations. Pending changes remain in Kelpi and can resume only when the same Google account is reconnected. You can delete events directly in Google and request deletion of retained integration records at privacy@kelpi.io. Other retention and backup provisions below continue to apply.
Information We Collect
Account and organization information
We collect information you provide when creating or managing a Kelpi account or organization, including your name, email address, phone number, organization name, role, authentication information, billing details, preferences, and support requests.
Connected messaging accounts and Meta Platform Data
When an authorized business connects Facebook, Instagram, or WhatsApp through Meta's official APIs, we may receive and process:
- Business asset identifiers, including Facebook Page IDs, Instagram professional account IDs, WhatsApp Business Account IDs, and phone-number IDs
- Profile and contact information made available by Meta for people who communicate with the connected business
- Messages, attachments, postbacks, delivery or read status, timestamps, and related conversation metadata
- Comments or other events only when the business enables a feature that requires them
- OAuth access tokens, granted permissions, token status, and webhook events required to maintain the integration
Kelpi processes this information on behalf of the business that connected the account. We do not request a person's Facebook or Instagram password. Integration tokens are encrypted at rest and are used only to provide the authorized connection.
Communications and AI processing
We process conversations, call records, transcripts, contact information, agent instructions, and knowledge supplied by the business so Kelpi can classify requests, generate suggested or automated replies, route conversations, schedule appointments, and perform other configured workflows.
Kelpi transactional SMS information
When you request a one-time verification code or transactional link from Kelpi, we collect and process your mobile number, the type of message requested, the date and time of the request, delivery status, verification result when applicable, and records needed to document consent, help requests, and opt-out preferences. We use this information to deliver the code or link you requested, authenticate or demonstrate access to Kelpi, continue the account or session workflow you selected, prevent fraud and abuse, troubleshoot delivery, and comply with messaging requirements.
The Kelpi Transactional SMS program sends only messages that a user directly requests. It does not send advertisements, coupons, discounts, or recurring promotional messages. Message frequency varies based on your requests and is generally one message for each code or link request. Message and data rates may apply.
We do not sell, rent, or share mobile numbers or SMS opt-in information with third parties or affiliates for their own marketing or promotional purposes. We disclose mobile information only to communications providers, carriers, security providers, and other service providers when necessary to deliver and protect the SMS service, or when required by law. Those providers may use the information only to perform services for Kelpi and are subject to applicable confidentiality and security obligations.
You can reply STOP to stop Kelpi transactional messages. Reply HELP for assistance or contact hello@kelpi.io. Opting out may prevent you from receiving a requested code or link until you validly enroll again.
Usage and device information
We may collect IP address, browser and device information, timestamps, pages viewed, diagnostic logs, cookies, security events, and product usage data needed to operate, protect, and improve the Services.
How We Use Information
We use information to:
- Provide and maintain the Services and connected-channel features
- Receive, display, route, and respond to communications as instructed by the connected business
- Generate AI-assisted responses and execute workflows configured by authorized users
- Authenticate users, secure integrations, prevent abuse, and troubleshoot incidents
- Send one-time SMS verification codes and transactional links that a user directly requests
- Process subscriptions and communicate about the account
- Analyze and improve reliability, usability, and performance
- Comply with applicable law and enforce our agreements
We do not sell Meta Platform Data or use it to build advertising profiles. We do not use message content from one customer to serve another customer's conversations.
How We Share Information
We may share information only as needed with:
- The organization that controls the connected account and its authorized users
- Infrastructure, hosting, communications, payment, analytics, customer-support, and AI service providers acting on our behalf
- Meta and other connected providers when necessary to send messages, maintain integrations, or comply with their platform rules
- Government authorities or other parties when required by law or necessary to protect rights, safety, and the integrity of the Services
- A successor in connection with a merger, financing, acquisition, or sale of assets, subject to appropriate safeguards
Service providers may process information only to provide contracted services to Kelpi and are subject to confidentiality and security obligations.
Data Retention
We retain account and conversation information while the relevant Kelpi account or organization remains active and for as long as reasonably necessary to provide the Services, meet legal obligations, resolve disputes, prevent abuse, and maintain security. Retention may vary based on the type of information and the organization's configuration.
When a Meta connection is removed, Kelpi stops using its access token and removes or invalidates the stored connection credentials. When an account is deleted, associated personal information is deleted or de-identified unless limited retention is required by law, security, fraud prevention, billing, or backup-recovery obligations.
Your Choices and Rights
Depending on your location, you may have rights to access, correct, delete, restrict, object to, or obtain a copy of your personal information. Authorized Kelpi users can update account information, disconnect messaging channels, and delete their account from account settings.
If you communicated with a business that uses Kelpi, contact that business first because it controls the conversation and determines how it is used. You may also contact us, and we will assist the business as required.
For instructions on removing Meta-connected data, see our Data Deletion Instructions.
Security
We use administrative, technical, and organizational safeguards designed to protect information. These include encrypted integration credentials, transport encryption, access controls, tenant separation, logging, and verification of signed webhook requests. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.
International Data Transfers
Kelpi and its service providers may process information in countries other than the country where it was collected. Where required, we use appropriate safeguards for cross-border transfers.
Children
The Services are intended for businesses and are not directed to children under 13. We do not knowingly collect personal information directly from children under 13.
Third-Party Services
Connected services such as Meta, Facebook, Instagram, and WhatsApp operate under their own terms and privacy policies. This Privacy Policy covers Kelpi's processing and does not replace those third parties' notices.
Changes to This Policy
We may update this Privacy Policy as our Services or legal obligations change. We will post the updated version here and revise the date above. We will provide additional notice when required by law.
Contact Us
For privacy questions or requests, contact:
Email: hello@kelpi.io