How we handle your data.

KleioBase is operated by Itamar Denkberg (“we,” “us,” or “our”), a sole proprietor based in Israel.

KleioBase is a genealogy platform that helps users digitize, organize, and explore historical family records using artificial intelligence.

Contact for privacy matters

Email: [email protected]
Website: https://kleiobase.com

EU representative (GDPR Article 27)

To be appointed. Details will be added here once an EU representative service is designated.

UK representative (UK GDPR Article 27)

To be appointed. Details will be added here once a UK representative service is designated.

This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use KleioBase, including our website at kleiobase.com and all related services (collectively, the “Service”).

This policy applies to users worldwide and includes jurisdiction-specific sections for the European Economic Area (EEA), the United Kingdom, California (USA), Australia, Canada, Israel, and New Zealand.

3.1 Data you provide directly

3.2 Data we collect automatically

3.3 Data generated through AI processing

When you upload documents for processing, our AI system extracts structured data including:

• Names of individuals mentioned in the document
• Dates (birth, death, marriage, immigration, and similar)
• Places and locations (which may be geocoded to coordinates via Mapbox)
• Family relationships
• Other factual details present in the record

Important: Uploaded documents, particularly historical records, frequently contain personal data of third parties (people other than you). This may include living individuals. See Section 6 for how we handle third-party data in genealogy records.

We process your personal data for the following purposes and on the following legal bases:

4.1 Legitimate interest assessments

Where we rely on legitimate interest as a legal basis, we have conducted balancing tests to ensure our interests do not override your fundamental rights and freedoms. You may request details of these assessments by contacting us at [email protected].

5.1 How AI processing works

When you upload a document, it is sent to Google’s Gemini API for text extraction and analysis. The AI identifies and structures information such as names, dates, places, and relationships contained in the document.

The Research Companion also uses the Google Gemini API to answer questions about your knowledge base and assist with research. With your explicit confirmation, the Research Companion can modify your knowledge base on your behalf - for example, creating or updating person profiles, linking records to profiles, adding family relationships, merging duplicate profiles, or resolving and dismissing research findings. The AI reads current data before proposing any change, and every modification requires your explicit approval before it is applied.

You can also attach your own image or PDF files directly to a Research Companion conversation, separately from your knowledge base, to ask about a document you have not uploaded through the normal record-processing flow. The file is sent to Google’s Gemini API as soon as you send the message you attached it to, and again later if the assistant needs to look at it again, and is stored in private file storage for the life of the conversation, deleted when the conversation is deleted. Attaching a file this way does not use an upload credit; it counts against your Research Companion usage budget instead.

At your request, the Research Companion can also generate a written biography for a person in your knowledge base. To do this, the existing data you have already saved for that person (linked records, facts, family relationships, and timeline) is sent to Google’s Gemini API, which returns a prose life story. No new category of data is collected; the biography is derived from data you already provided. You can view the result in the app and download it as a PDF.

When it helps answer your question, the Research Companion can also search the public web and read public web pages. In production, web searches are sent primarily to the Brave Search API (operated by Brave Software, Inc.), which receives the search query text. Once our monthly Brave request budget is nearly exhausted, or if Brave returns an error, searches overflow to a self-hosted search service we operate on our own infrastructure, which queries public search engines on your behalf. When the assistant opens a public web page to read it, our server fetches that page; the third-party website sees our server's request (our IP address and a KleioBaseBot/1.0 identifier), not your identity. We do not send your account details, uploaded documents, or other personal data to these third-party websites beyond the search query and the page address the assistant chooses to open.

On the Archivist and Professional plans, our AI also runs a periodic background analysis (batched once daily) that looks for possible relationships between people named across the records you have already uploaded - for example, suggesting that two of your separate family branches may connect. This uses the Google Gemini API and operates only on the genealogical data you have already provided; it does not collect any new category of data and does not share your data with any new third party. Any suggested connection is presented for your review and is never applied to your knowledge base automatically.

On the Researcher plan and above, our AI also helps detect when your own notes record one fact - such as an occupation - under several different wordings on the same person (for example, two translations of the same job title). To do this, we ask the Google Gemini API a narrow, deliberately context-freequestion: given two recorded values and the kind of fact they are, do they mean the same underlying thing? We send only those two short values and the fact type - never a person’s name, a profile identifier, or any other information about your tree. The answer is stored in a dictionary shared across all KleioBase accounts, keyed only on the two values and the fact type, so the dictionary itself never contains your name, your profile data, or any way to identify you. We manually review each proposed pair before it is treated as confirmed, and a candidate pair that has not yet been reviewed is temporarily linked to the account that triggered it so we can see where a proposal came from during review; that link is removed once the pair is confirmed or rejected. Nothing is merged or changed on your profile automatically - you always choose which recorded wording to keep, and the others are kept as alternates rather than deleted. This feature is available on the Researcher plan and above; on the free Explorer plan, the underlying detection is available up to a lifetime total of 20 AI lookups, and upgrading removes that limit immediately.

We also offer an in-app customer support chat provided by Chativox, which uses an AI assistant to answer your product and account questions. When you open the support chat we share your account identifier, name, email address, and plan tier so the assistant can identify you, along with the messages you send. Chativox generates replies using Google’s Gemini AI and retains support conversations for up to 12 months, with deletion available on request. The support chat is separate from the Research Companion and does not have access to your uploaded documents or knowledge base. You control when to start a conversation and what you share in it.

Key facts about our AI processing:

• We use the Google Gemini API on a paid tier. Under Google’s paid API terms, your data is not used to train or improve Google’s AI models.
• Google retains prompts and contextual information for 55 days solely for abuse monitoring and policy enforcement purposes. This data is not used for model training or fine-tuning.
• All AI-extracted results are placed in a “review” state by default. You must manually confirm or correct the extracted information before it is treated as verified. The AI does not make final decisions. Human review is always required.
• Knowledge-base modifications proposed by the Research Companion also require your explicit confirmation before they are applied. No change is made to your data automatically.
• AI extraction may contain errors. We make no guarantee of the accuracy of AI-generated genealogical conclusions. You are responsible for verifying all extracted data.

5.2 Automated decision-making (GDPR Article 22)

KleioBase’s AI processing assists you in extracting information from documents and in managing your knowledge base. It does not make decisions that produce legal effects or similarly significantly affect you. The AI is a tool that presents suggestions and proposed changes for your review. It does not determine legal rights, financial outcomes, or access to services.

You always have the ability to review, correct, or reject any AI-extracted data or AI-proposed knowledge-base modification.

5.3 AI transparency (EU AI Act)

KleioBase deploys AI systems for document analysis, data extraction, and research assistance (including knowledge-base modifications initiated by the Research Companion with your confirmation). We are transparent about the use of AI throughout the platform: our use of AI is disclosed in this Privacy Policy and in our Terms of Service, which you accept when you create an account, and AI-processed results are clearly labeled in the product and placed in a “review” state for your confirmation.

Genealogy records inherently contain personal data about individuals other than the user who uploads them. Historical records may reference living individuals (for example, a birth certificate from 40 years ago names a person who is likely still alive).

Our approach:

• Deceased individuals are generally not data subjects under the GDPR (Recital 27). However, some jurisdictions may offer limited post-mortem privacy protections.
• Living individuals named in records you upload are data subjects with privacy rights. By uploading records containing third-party personal data, you represent that you have a lawful basis for doing so (such as a legitimate interest in family history research) and accept responsibility for ensuring that the upload does not violate any applicable privacy laws.
• We process third-party data contained in your uploads under legitimate interest (Art. 6(1)(f) GDPR), specifically the recognized interest in historical and genealogical research. We have conducted a balancing test weighing the genealogical research purpose against the privacy interests of individuals named in records.
• Special-category data. Genealogy records can reveal special categories of personal data within the meaning of Art. 9 GDPR, in particular racial or ethnic origin and religious belief. Where they do, our primary condition is Art. 9(2)(j) GDPR - processing necessary for archiving in the public interest or for historical research - applied with the safeguards required by Art. 89(1). Those safeguards include data minimization (we extract only what the record itself contains), strict per-user access isolation so records are not shared across accounts by default, mandatory human review before extracted data is treated as verified, and the right of any identified individual to seek access, correction, or erasure. Where a record was manifestly made public by the individual concerned (for example, a published or publicly archived record), we may additionally rely on Art. 9(2)(e). The large majority of individuals in historical records are deceased and fall outside the GDPR (Recital 27).
• Historical context matching. Some entries in our admin-curated library of historical events are further scoped to a specific religion, nationality, or caste (for example, the Holocaust is shown only for an ancestor recorded as Jewish or Romani). Where we do this, we compare that event against the religion, nationality, or caste already recorded on a person's profile in your tree. If a person has none of their own recorded, we derive one from their nearest recorded ancestor or, failing that, a spouse, so that relevant historical context can still be shown; a person's own recorded value always takes priority over one derived this way. You can switch that derivation off at any time with the Infer historical context from relatives setting in your account preferences, in which case we match historical events only against what each person has recorded of their own. This is an additional use of special-category data you or a record you uploaded has already provided under Section 4 above - we do not ask you or any user for a person's religion, nationality, or caste, and we never infer it from a name, a place, or any source outside your own tree.
• If an individual identified in a record contacts us directly to exercise their privacy rights (access, erasure, objection), what we do depends on our role. Where we act as a customer’s processor (see below), we do not answer the request substantively: we forward it to that customer without undue delay, tell the requester that we have done so and that the customer is the controller responsible for answering, and assist the customer in responding. Where KleioBase is the controller, we handle the request ourselves in accordance with applicable law.

If you use KleioBase professionally

Where you use KleioBase in the course of a business - for example, a professional genealogist researching on behalf of a client - you are the controller of the records you upload and KleioBase acts as your processor for that content, on the terms of our Data Processing Agreement. That agreement is in force automatically for every customer within its scope, from its effective date, with no signature and no request needed.

The legitimate-interest basis described above applies where KleioBase is the controller. That is the position for personal and family history research: researching your own family history for yourself falls within the household exemption in Article 2(2)(c) GDPR, so there is no controller-to-processor relationship to govern, the Data Processing Agreement does not apply, and this Privacy Policy governs our handling of your data instead.

We do not sell your personal data. We share data only with the following categories of recipients, and only to the extent necessary for the stated purposes.

7.1 Service providers (data processors)

7.2 Sharing and collaboration features

Certain paid plans offer sharing and collaboration features that allow you to invite other users to access your knowledge base. Where these features are available on your plan:

• Read-only collaborators you invite can view but not edit your shared knowledge base.
• Edit-access collaborators you invite can view and modify the shared knowledge base.
• Revoking an invitation immediately removes access.
• We do not share your data with other users unless you explicitly enable sharing.

Availability of these features depends on your subscription plan. See our pricing page for current details.

7.3 Public profile sharing

You can choose to publish a public, read-only web link to a single person profile’s AI-generated biography. This is entirely owner-initiated: no link exists unless you create one, and you can revoke any link at any time, which immediately removes public access.

What a shared link exposes.A shared page shows only a curated public subset of the profile: the person’s name, lifespan dateline, birth and death places, the AI-generated biography text (including its historical-context callouts and external historical references), and a read-only event timeline.

What is never exposed.Shared pages do not include source record images or scans, transcriptions, extracted structured data, or any other person’s profile.

• Living-person safeguard. If a profile could be a living person (no evidence of death and a birth within the last 100 years, or an unknown birth year), you must explicitly confirm that the person is deceased or that you have consent to share before a link can be created. We store this acknowledgment.
• Optional password protection. You can require a password to view a shared page. We store the password only as a salted scrypt hash, never in plain text.
• Expiry controls. A link can be set never to expire, or to expire after 7, 30, or 90 days.
• Not search-indexed. Shared pages carry a KleioBase attribution and are marked noindex so they are not added to search-engine results.

Retention of share links. We store share links in a profile_share_links record (link token, optional expiry, optional password hash, the deceased acknowledgment, the living-person consent confirmation and the date it was given, a revocation timestamp, and a view count). Active links are retained until you revoke or delete them. Once a link is revoked or has expired, the underlying record is permanently purged 30 days after revocation or expiry by a scheduled job. The consent confirmation and its date are part of that same record and are purged with it.

Sharing a profile of a living person.Where a person is marked as living in your knowledge base, we ask you to confirm that you hold their consent, or their guardian’s if they are a minor, before a public link can be created, and we require the link to be password-protected. We record that confirmation and the date you gave it as evidence of the lawful basis you asserted. If a person is marked as living after a link was shared, the shared page stops loading unless that confirmation was recorded.

7.4 On This Day share cards

From the dashboard’s On This Day widget, you can share a single anniversary highlight as an image card. This is entirely user-initiated: nothing is shared unless you click the share button on that specific highlight.

What a share card exposes.Only the subject’s first name, the type of event (born or died), how many years ago it happened, and their relationship to you (for example “Great-Aunt”).

What is never exposed.A share card never includes a person or profile identifier, source records, your full tree, or any other person’s data.

How the link works. The link is a signed token that is not stored in our database, so there is nothing to revoke or that expires on a timer. It stops reflecting current data if the underlying fact in your account changes.

7.5 Legal requirements

We may disclose personal data if required by law, legal process, or government request, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of KleioBase, its users, or the public.

KleioBase is operated from Israel. Your data may be transferred to and processed in countries outside your country of residence, including the United States and Israel.

8.1 Transfer safeguards

We use the following mechanisms to ensure adequate protection for international transfers:

Israel: Israel has an adequacy decision from the European Commission (and a separate UK adequacy decision), meaning transfers of personal data from the EU/EEA and UK to Israel are permitted without additional safeguards.

United Kingdom: The United Kingdom has an adequacy decision from the European Commission, so transfers of personal data from the EU/EEA to the UK (for example, to incident.io, our UK-based incident-management provider) are permitted without additional safeguards.

United States: For each US-based service provider, we rely on one or more of the following:

• EU-US Data Privacy Framework (DPF): Google, Mapbox, PostHog, Resend, Sentry, and Cloudflare are certified under the EU-US DPF, providing an adequate level of protection for transatlantic transfers. Meta is certified under the EU-US DPF for its onward transfers and acts as an independent (and, for the initial collection, joint) controller of advertising-measurement data rather than as our processor.
• Standard Contractual Clauses (SCCs): For providers not certified under the DPF (Supabase, Freemius, Railway, Linear, and Brave Search), we rely on the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914, controller-to-processor module), supplemented by additional technical and organizational measures (encryption in transit and at rest, data minimization, and per-user access isolation). We have assessed these transfers in an internal Transfer Impact Assessment and concluded they provide an adequate level of protection. Brave Search relies on a Data Processing Addendum incorporating these Standard Contractual Clauses, and only minimal search query text is shared with that search provider.
• Data Processing Agreements (DPAs): Each service provider is bound by a DPA that includes commitments on data security, confidentiality, and breach notification. Most DPAs are incorporated automatically into the provider’s terms or accepted electronically; the remainder are executed by signature.

8.2 United Kingdom transfers

For personal data of UK users transferred to the United States, we rely on the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”) for providers that have separately certified to the UK Extension (Google, Mapbox, Cloudflare, PostHog, Resend, and Sentry). UK certification is a separate step from EU-US certification, so for other US providers we rely on the UK International Data Transfer Addendum to the SCCs, supported by a transfer risk assessment. Transfers from the UK to Israel are permitted under the UK’s adequacy decision for Israel without additional safeguards.

8.3 Australian users: cross-border disclosure (APP 8)

If you are located in Australia, your personal information will be disclosed to overseas recipients in the United States (all providers listed above) and Israel (KleioBase’s place of operation). As our reasonable steps under APP 8.1, we bind each overseas recipient by an enforceable Data Processing Agreement requiring it to handle your personal information in a way consistent with the Australian Privacy Principles. We do not ask you to consent to a waiver of APP 8 protections.

Under section 16C of the Privacy Act, we remain accountable for the handling of your personal information by these overseas recipients as if we had handled it ourselves. If an overseas recipient mishandles your information, you retain your rights and remedies under the Privacy Act against us.

8.4 Canadian users: international transfers

If you are located in Canada, your personal information is transferred to and processed in the United States and Israel. Under PIPEDA, this transfer to our service providers for processing is a “use” of your information for the purposes you originally agreed to, not a separate disclosure requiring fresh consent. We remain accountable for your information and bind each processor by contract to a comparable level of protection.

Foreign access: while your information is stored or processed outside Canada, it may be accessible to the courts, law enforcement, and national security authorities of those jurisdictions under their laws.

Meaningful consent: so that your consent is meaningful, we highlight throughout this policy (1) what personal information we collect, (2) the parties we share it with, including the service providers listed in Section 7, (3) the purposes for which we use it, and (4) the residual risks involved, including the foreign-access risk described above.

8.5 Quebec residents (Law 25)

If you are a resident of Quebec, Quebec’s Act respecting the protection of personal information in the private sector (as amended by Law 25) applies to our handling of your personal information, regardless of where KleioBase is located.

• Person in charge of privacy. Our designated privacy officer is Itamar Denkberg, reachable at [email protected].
• Transfers outside Quebec. Before transferring your personal information outside Quebec (to our US and Israel-based infrastructure and service providers), we conduct a privacy impact assessment of the transfer, confirm the information will receive adequate protection, and bind the recipient by contract.
• Sensitive information. Genealogy records can constitute sensitive personal information. We collect and process it only with your consent, which you provide when you upload documents for processing, and use it solely to provide the Service.
• Your rights. You have the rights of access, rectification, and, where applicable, de-indexing and data portability. To exercise them, or to complain, contact our privacy officer above. You may also lodge a complaint with the Commission d’accès à l’information du Québec (CAI).

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law.

When you delete your account via the self-service flow (Settings - Account), deletion is processed immediately and covers: all data in our database (records, profiles, families, conversations, and your account row), your uploaded files in our file storage, your contact record in Resend (email delivery), your analytics profile in PostHog, and your active Freemius subscription (if any). A durable audit log entry is retained without personally identifiable information for fraud-prevention and legal-compliance purposes. Payment records held by Freemius as Merchant of Record are subject to their own retention obligations (typically 7 years for tax purposes).

Backups. Deleting data removes it from the live Service immediately, but a copy may remain in routine encrypted infrastructure backups until those backups expire on their normal rotation. Our database provider currently retains daily backups on a rolling 7-day window, after which they are overwritten. Backups are encrypted at rest, are not accessible from the running Service, and are used only for disaster recovery. If a backup is ever restored, we re-apply any deletion that the restore reversed. The same position is set out in the deletion and return section of our Data Processing Agreement.

Data sharing with Meta via the Meta Pixel is governed by the CCPA opt-out described in Section 11.3. Account deletion removes the identifiers we share with Meta going forward; historical attribution data already processed by Meta is subject to Meta's own retention policies.

Mail you send to our role addresses (privacy@, contact@, support@, abuse@, security@, legal@, marketing@) is stored in our own systems and retained until manually deleted. Quarantined spam is automatically deleted after 30 days. You may request deletion of your message at any time by writing to [email protected].

We use cookies and similar technologies on our website. We categorize them as follows.

Essential cookies (always active)

• Supabase authentication session cookies (managed by @supabase/ssr)
• kb-low-contrast - accessibility preference (stores your display contrast setting)
• kb-theme - interface preference (stores your light or dark theme choice)
• kb-date-format - interface preference (stores how dates are displayed: day, month, or year first)
• kb-cookie-consent - records your analytics and marketing cookie choices, the detected region, any Global Privacy Control signal, the timestamp, and whether you have answered the banner yet. It is written as soon as you arrive, before you choose, so that the settings that apply to your region by default (see below) are applied consistently by both your browser and our servers. Answering the banner overwrites it with your actual choice

Local storage (browser storage, not cookies)

• Essential functional preferences.We store small interface and draft-state values in your browser’s local storage (under the kb- prefix) so the app remembers things like your view and sidebar settings, in-progress upload tabs, export options, and recent searches. These are not used for tracking, are not shared with anyone, and require no consent.
• PostHog analytics identifiers. Only after you consent to analytics, PostHog uses browser localStorage (not cookies) to maintain a session identifier for product analytics that can be linked to your account.
• PDF pages, while you pick them.When you drop a PDF into the upload workspace, we hold it temporarily in your browser’s IndexedDB storage (not on our servers) so you can open the page picker and choose which pages to bring in. It stays there until you close that page picker tab, which removes it immediately, or until you clear your browser’s storage. If a picker tab is ever lost without being closed (a browser crash, for example), the next time you open the upload workspace clears any PDF left without a tab. Like the preferences above, this is first-party, is not used for tracking, is never shared with anyone, and requires no consent. Only the individual pages you choose to add are ever uploaded to us.

Session replay (requires your consent to analytics)

Only after you consent to analytics, our error-monitoring provider (Sentry) records masked session replays for a small sample of sessions and for sessions where an error occurs. A session replay is a reconstruction of how a page behaved - clicks, navigation, and page changes - so we can diagnose bugs. All text and form inputs are masked(their contents are not captured), and the replay is buffered in your browser’s session storage. If you do not consent to analytics, or before you make a choice, no session replay is recorded. Withdrawing analytics consent stops any further recording immediately.

Cookieless, anonymized analytics (no consent required)

If you reject analytics, or before you make a choice, we still measure overall product usage (such as page views and aggregate traffic) in a cookieless, anonymized mode. In this mode PostHog stores nothing on your device - no cookies, no local or session storage. Visitor identity is derived by PostHog on its servers as a privacy-preserving hash of your IP address and browser user-agent combined with a secret salt that rotates daily and is then deleted, so the result cannot be traced back to you and is not used to identify or track you across days. Because nothing is stored on your device and the data is anonymized, this does not require your consent; we rely on our legitimate interest in understanding whether the product is being used (see Section 4). If you consent to analytics, we switch to full, identifiable analytics as described above.

Analytics cookies (requires your consent)

• kb_attr - remembers which channel brought you to the site (for example, a search engine, a social network, or an advertisement) so we can measure our marketing. It stores the campaign parameters and referring page from your first visit, and lasts up to 90 days. We write it only once you have consented to analytics cookies, and it is never written before then. If you sign up, the value is copied once to your account so we can report which channel brought us your signup; it is not overwritten on later visits, so it always reflects your original first visit.

Marketing cookies (requires your consent)

• Meta Pixel: sets cookies to measure advertising effectiveness and deliver relevant advertisements. The two it uses are _fbp (a browser identifier) and _fbc (a record of the advertising click that brought you here). Both last up to 90 days.
• _fbc, written by us: if you arrive from a Meta advertisement (your link carries an fbclid parameter) and the Meta Pixel has not written this cookie itself, our own code writes it, using the same format and the same 90-day lifetime, so the click can still be attributed. We do this only once you have consented to marketing cookies, and we never overwrite a value the Pixel has already set.
• Account-side copy: while you are signed in with marketing consent given, we copy these cookie values, along with your IP address and browser user-agent, to your account so our server can send the matching sign-up, checkout, subscription and purchase confirmations to Meta. This account-side copy is deleted along with the rest of your account data if you delete your account.

Bot protection

• Cloudflare Turnstile: may set cookies transiently during bot verification challenges on forms.

You can manage your tracking preferences at any time through our consent banner or by visiting your tracking settings. Rejecting non-essential tracking does not affect your ability to use KleioBase.

For more information about how to control cookies and local storage in your browser, visit your browser’s help documentation.

11.1 Rights for all users

Regardless of where you are located, you can:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Export your data (including GEDCOM export of family tree data)
• Withdraw consent for optional processing (analytics, marketing)
• Object to processing based on legitimate interest

Many of these rights are available as self-service actions inside the platform, without needing to contact us:

• Download my data - a full ZIP export of all personal data we hold (account, records, people, families, matches, Research Companion history, and original file uploads) is available at Settings - Import / Export. We email you a download link when the archive is ready. The link expires after 7 days and can be regenerated.
• Delete account - permanently erases your account and all associated data. Available at Settings - Account. The flow requires you to type your account email, click a single-use confirmation link sent to that address, and then re-authenticate (re-enter your password, or re-sign-in with your identity provider). See Section 9 for what deletion covers.
• Clear KB data - deletes all knowledge-base content (records, profiles, families, matches, Research Companion conversations) while keeping your account active. Available at Settings - Account. Like account deletion, it requires confirming via a single-use link emailed to you and then re-authenticating.

For any right not covered by a self-service flow, contact us at [email protected].

11.2 EEA and UK residents (GDPR / UK GDPR)

If you are in the European Economic Area or the United Kingdom, you have the following additional rights under the GDPR (or UK GDPR):

• Right of access (Art. 15): obtain a copy of all personal data we process about you.
• Right to rectification (Art. 16): correct inaccurate or incomplete personal data.
• Right to erasure (Art. 17): request deletion of your personal data (“right to be forgotten”).
• Right to restriction of processing (Art. 18): request that we limit how we use your data in certain circumstances.
• Right to data portability (Art. 20): receive your data in a structured, commonly used, machine-readable format. We support GEDCOM export for genealogy data and JSON export for other data.
• Right to object (Art. 21): object to processing based on legitimate interest, including profiling.
• Right to withdraw consent (Art. 7(3)): withdraw consent at any time for processing based on consent, without affecting the lawfulness of processing before withdrawal.
• Right to lodge a complaint: you may file a complaint with your local supervisory authority. A list of EEA data protection authorities is available at edpb.europa.eu. For UK residents, contact the Information Commissioner’s Office (ICO) at ico.org.uk.

11.3 California residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides you with specific rights regarding your personal information.

Categories of personal information collected

Using CCPA-defined categories, we collect the following:

Sale and sharing of personal information

We do not sell your personal information as defined by the CCPA.

We may “share” personal information (as defined by the CCPA/CPRA) with Meta for cross-context behavioral advertising purposes when you have consented to marketing cookies. The categories shared are A. Identifiers (email address, account identifier, IP address, and the Meta browser cookies), B. Personal information categories (first and last name), D. Commercial information (that you started a checkout or subscribed, and the amount, currency and transaction reference of a purchase), F. Internet or similar network activity (page views, your browser user-agent, and the fact that you confirmed your first record), and G. Geolocation data (the billing country and postal code of a purchase). We do not share uploaded documents or any genealogy data with Meta. You can opt out of this sharing at any time by:

• Adjusting your cookie preferences to reject marketing cookies
• Using the “Do Not Sell or Share My Personal Information” link in our website footer
• Enabling the Global Privacy Control (GPC) signal in your browser. We honor GPC signals as a valid opt-out request.

Sensitive personal information

Genealogical data may be considered sensitive personal information under the CPRA, particularly where it reveals racial or ethnic origin. We use sensitive personal information only as necessary to provide the Service (document processing and genealogy research) and do not use it for purposes beyond what is permitted under the CCPA/CPRA.

Your CCPA/CPRA rights

• Right to know: request disclosure of (a) the categories of personal information we have collected about you, (b) the categories of sources, (c) the business or commercial purpose for collecting, and (d) the specific pieces of personal information we have collected about you (CCPA § 1798.110).
• Right to delete: request deletion of your personal information.
• Right to correct: request correction of inaccurate personal information.
• Right to opt out of sale/sharing: opt out of the sharing of your personal information for cross-context behavioral advertising.
• Right to limit use of sensitive personal information: direct us to limit the use of your sensitive personal information to what is necessary for the Service.
• Right to non-discrimination: we will not discriminate against you for exercising any of your CCPA/CPRA rights.

We do not use or disclose sensitive personal information for purposes other than those permitted under CCPA § 1798.121.

Authorized agents

You may designate an authorized agent to make requests on your behalf. We may require the agent to provide proof of your written authorization and verify your identity directly.

Financial incentive programs

We do not offer any financial incentive programs tied to the collection of personal information.

11.4 Australian residents

Under the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs), you have the right to:

• Access your personal information (APP 12)
• Request correction of inaccurate, out-of-date, incomplete, or misleading personal information (APP 13)
• Complain about a breach of the APPs. We will respond to your complaint within 30 days.
• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au if you are not satisfied with our response.

Sensitive information: genealogy records may contain information that reveals racial or ethnic origin, which is “sensitive information” under the Australian Privacy Act. We collect such information only with your consent (which you provide by uploading the document) and use it solely for the purpose of providing the genealogy service.

11.5 Canadian residents (PIPEDA)

Under the Personal Information Protection and Electronic Documents Act (PIPEDA), you have the right to:

• Access your personal information held by us
• Challenge the accuracy and completeness of your personal information and have it amended as appropriate
• Withdraw consent for the collection, use, or disclosure of your personal information (subject to legal or contractual restrictions)
• Complain to us about our personal information handling practices
• Lodge a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca if you are not satisfied with our response.

11.6 New Zealand residents

Under the New Zealand Privacy Act 2020 and the Information Privacy Principles (IPPs), you have the right to:

• Access your personal information (IPP 6)
• Request correction of your personal information (IPP 7)
• Lodge a complaint with the Office of the Privacy Commissioner at privacy.org.nz.

11.7 Israeli residents

Under Israel’s Protection of Privacy Law 5741-1981 (as amended, including Amendment 13 effective August 2025), you have the right to:

• Access personal data held about you in our databases
• Request correction or deletion of inaccurate data
• Object to the use of your data for direct marketing purposes
• Sue for privacy violations without the need to prove actual harm (under Amendment 13)
• Lodge a complaint with the Privacy Protection Authority (PPA) at gov.il/privacy-protection-authority.

We have designated a Privacy Protection Officer, reachable at [email protected], who is responsible for our compliance with the Protection of Privacy Law and for handling your requests.

To exercise any of the rights described above, please contact us at:

Email: [email protected]

We will respond to your request within:

• 30 days for GDPR / UK GDPR requests (extendable by two further months for complex requests)
• 45 days for CCPA/CPRA requests (extendable by an additional 45 days with notice)
• 30 days for Australian Privacy Act requests
• 30 days for PIPEDA requests (extendable to 60 days with notice)
• 20 working days for New Zealand Privacy Act requests
• 30 days for Israeli Protection of Privacy Law requests

We may need to verify your identity before processing your request. We will not charge a fee for processing reasonable requests, except where requests are manifestly unfounded or excessive.

KleioBase is not intended for use by anyone under the age of 16. We do not knowingly collect personal information from children under 16. If you believe that we have collected personal information from a child under 16, please contact us at [email protected], and we will take steps to delete that information.

Note regarding genealogy data: uploaded historical records may contain information about individuals who were minors at the time the record was created. This data is processed solely for genealogical research purposes and does not involve the direct collection of data from children.

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit (TLS/HTTPS) and at rest
• Authentication via secure, industry-standard methods (Supabase Auth)
• Access controls limiting who can access personal data
• Regular review of security practices
• Incident response procedures (see Section 15)

No method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially reasonable means to protect your personal data, we cannot guarantee its absolute security.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach (as required by GDPR Art. 33 and UK GDPR)
• Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms (GDPR Art. 34)
• Notify the OAIC and affected individuals as soon as practicable under Australia’s Notifiable Data Breaches scheme
• Comply with breach notification requirements under CCPA, PIPEDA, the NZ Privacy Act 2020, and Israel’s Privacy Protection Law as applicable

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the “Last updated” date at the top of this policy
• Notify you by email or through a prominent notice on our website
• Where required by law, obtain your consent to material changes

We encourage you to review this policy periodically.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Email: [email protected]
Website: https://kleiobase.com/privacy

For EEA residents: a GDPR Article 27 EU Representative is being appointed. Until then, please direct any EEA data-protection enquiries to us using the contact details above and we will respond.

For UK residents: a UK GDPR Article 27 UK Representative is being appointed. Until then, please direct any UK data-protection enquiries to us using the contact details above and we will respond.

This Privacy Policy is designed to comply with the EU General Data Protection Regulation (GDPR), the UK General Data Protection Regulation (UK GDPR), the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the Australian Privacy Act 1988, the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA), the New Zealand Privacy Act 2020, and Israel’s Protection of Privacy Law 5741-1981 (as amended).