How we handle your data.

KleioBase is operated by Itamar Denkberg (“we,” “us,” or “our”), a sole proprietor based in Israel.

KleioBase is a genealogy platform that helps users digitize, organize, and explore historical family records using artificial intelligence.

Contact for privacy matters

Email: privacy@kleiobase.com
Website: https://kleiobase.com

EU representative (GDPR Article 27)

To be appointed. Details will be added here once an EU representative service is designated.

UK representative (UK GDPR Article 27)

To be appointed. Details will be added here once a UK representative service is designated.

This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use KleioBase, including our website at kleiobase.com and all related services (collectively, the “Service”).

This policy applies to users worldwide and includes jurisdiction-specific sections for the European Economic Area (EEA), the United Kingdom, California (USA), Australia, Canada, Israel, and New Zealand.

3.1 Data you provide directly

3.2 Data we collect automatically

3.3 Data generated through AI processing

When you upload documents for processing, our AI system extracts structured data including:

• Names of individuals mentioned in the document
• Dates (birth, death, marriage, immigration, and similar)
• Places and locations (which may be geocoded to coordinates via Mapbox)
• Family relationships
• Other factual details present in the record

Important: Uploaded documents, particularly historical records, frequently contain personal data of third parties (people other than you). This may include living individuals. See Section 6 for how we handle third-party data in genealogy records.

We process your personal data for the following purposes and on the following legal bases:

4.1 Legitimate interest assessments

Where we rely on legitimate interest as a legal basis, we have conducted balancing tests to ensure our interests do not override your fundamental rights and freedoms. You may request details of these assessments by contacting us at privacy@kleiobase.com.

4.2 Emails asking about your experience

From time to time we email account holders a short question about how they are getting on: what stopped you if you signed up and never uploaded anything, what brought you here after your first record was processed, what stopped you if the first record we read is still sitting unconfirmed, what you are using KleioBase for after you subscribe, what stopped you if you used up your free credits and did not carry on, what you got stuck on if your account has gone quiet, and why you left if you cancel. Each one is a plain-text note from a person, with a question in it and a reply address. You are welcome to ignore it, and ignoring it changes nothing about your account.

These emails never advertise anything. They carry no prices, no plan comparisons, no upgrade or checkout links, no discounts or offers, and no feature promotion. That is a deliberate limit rather than a matter of taste: it is what makes these messages a question rather than marketing, and we enforce it with an automated check that inspects every one of these emails and fails if promotional wording appears in any of them. Marketing email is a separate thing entirely, it is opt-in only, and nothing here changes that.

How we decide who to ask, and when. We look at a few plain facts about how your account has been used: whether any record has been processed yet, when the last one was, whether your free credits are used up, whether a subscription has just started or just been cancelled, and how long it has been since you did anything. Deciding who to email on that basis is profiling under data protection law, so we tell you about it plainly here rather than leaving it implied. It has no effect on you beyond whether an email is sent. It does not change your plan, your price, your credits, what you can do in the product, or how we treat your account in any other way, and nobody outside KleioBase sees it. We do not read the contents of your records to decide this - only counts and dates.

How to stop them. Every one of these emails carries an unsubscribe link that works without signing in, and your mail app’s own unsubscribe button works too. There is also a toggle in Settings > Account & Preferences. Any of them stops these emails permanently, not just for a while, and we treat it as an objection under Article 21 that we simply honour rather than weigh up. Even if you never opt out, we send at most one of these every 14 days and five in total for the life of your account, and we hold them back entirely while you have an open support conversation with us.

A different email: reminders about records waiting for you. Separately from the questions above, we send an occasional reminder when records you uploaded have been read but are still waiting for you to confirm them, because nothing from a record joins your knowledge base until you confirm it. It is a notification rather than a question, so it has no reply invitation, and it names up to five of the records concerned so you can see what is waiting. It lists records only from the workspace you are currently working in, never from another workspace, and it never contains the document image or anything we extracted from it. It carries no advertising, no prices and no upgrade prompts, and the same automated check that polices the emails above polices this one too. You get at most one every 30 days, stretching to every 60 and then every 90 days if you do not act on them, and they stop altogether after ten; confirming any record resets that. If you have nothing waiting, we send nothing. It is on by default and stops permanently via the unsubscribe link in any of them (no sign-in needed) or the toggle in Settings > Account > Email preferences.

What we keep from all this is listed in Section 3 (the record of which of these emails we sent you, your cancellation reason if you gave one, and any reply you chose to write), and how long we keep it is in Section 9.

5.1 How AI processing works

When you upload a document, it is sent to Google’s Gemini API for text extraction and analysis. The AI identifies and structures information such as names, dates, places, and relationships contained in the document.

The Research Companion also uses the Google Gemini API to answer questions about your knowledge base and assist with research. With your explicit confirmation, the Research Companion can modify your knowledge base on your behalf - for example, creating or updating person profiles, linking records to profiles, adding family relationships, merging duplicate profiles, or resolving and dismissing research findings. The AI reads current data before proposing any change, and every modification requires your explicit approval before it is applied.

You can also attach your own image or PDF files directly to a Research Companion conversation, separately from your knowledge base, to ask about a document you have not uploaded through the normal record-processing flow. The file is sent to Google’s Gemini API as soon as you send the message you attached it to, and again later if the assistant needs to look at it again, and is stored in private file storage for the life of the conversation, deleted when the conversation is deleted. Attaching a file this way does not use an upload credit; it counts against your Research Companion usage budget instead.

To protect the assistant from misuse, each message you send to the Research Companion is first checked for attempts to manipulate it (for example, instructions to ignore its rules). The first 2,000 characters of the message are sent to Google’s Gemini API for this check. From 29 October 2026, the check may instead be answered by TypeSafe AI, Inc. (Jev), as a backup if Gemini fails and in Gemini’s place once our primary AI provider’s included capacity is used up; TypeSafe receives only that same message text, never your account details or knowledge base. A message identified as a manipulation attempt is answered with a short refusal and flagged for our review.

At your request, the Research Companion can also generate a written biography for a person in your knowledge base. To do this, the existing data you have already saved for that person (linked records, facts, family relationships, and timeline) is sent to Google’s Gemini API, which returns a prose life story. No new category of data is collected; the biography is derived from data you already provided. You can view the result in the app and download it as a PDF.

When it helps answer your question, the Research Companion can also search the public web and read public web pages. In production, web searches are sent primarily to the Brave Search API (operated by Brave Software, Inc.), which receives the search query text. Once our monthly Brave request budget is nearly exhausted, or if Brave returns an error, searches overflow to a self-hosted search service we operate on our own infrastructure, which queries public search engines on your behalf. When the assistant opens a public web page to read it, our server fetches that page; the third-party website sees our server's request (our IP address and a KleioBaseBot/1.0 identifier), not your identity. We do not send your account details, uploaded documents, or other personal data to these third-party websites beyond the search query and the page address the assistant chooses to open. When you, or an app you connect (Section 7.7), ask us to upload an image from a web address, our server fetches it in the same way, identifying itself as KleioBase-Fetcher/1.

On the Archivist and Professional plans, our AI also runs a periodic background analysis (batched once daily) that looks for possible relationships between people named across the records you have already uploaded - for example, suggesting that two of your separate family branches may connect. This uses the Google Gemini API and operates only on the genealogical data you have already provided; it does not collect any new category of data and does not share your data with any new third party. Any suggested connection is presented for your review and is never applied to your knowledge base automatically.

On the Researcher plan and above, our AI also helps detect when your own notes record one fact - such as an occupation - under several different wordings on the same person (for example, two translations of the same job title). To do this, we ask the Google Gemini API a narrow, deliberately context-free question: given two recorded values and the kind of fact they are, do they mean the same underlying thing? We send only those two short values and the fact type - never a person’s name, a profile identifier, or any other information about your tree. The answer is stored in a dictionary shared across all KleioBase accounts, keyed only on the two values and the fact type, so the dictionary itself never contains your name, your profile data, or any way to identify you. From 29 October 2026, the check for occupations and names may instead be answered by TypeSafe AI, Inc. (Jev), which receives only the same two short values and their type: as a backup if Gemini fails, and in Gemini’s place once our primary AI provider’s included capacity is used up. We manually review each proposed pair before it is treated as confirmed, and a candidate pair that has not yet been reviewed is temporarily linked to the account that triggered it so we can see where a proposal came from during review; that link is removed once the pair is confirmed or rejected. Nothing is merged or changed on your profile automatically - you always choose which recorded wording to keep, and the others are kept as alternates rather than deleted. This feature is available on the Researcher plan and above; on the free Explorer plan, the underlying detection is available up to a lifetime total of 20 AI lookups, and upgrading removes that limit immediately.

We also offer an in-app customer support chat, Chativox, which uses an AI assistant to answer your product and account questions. Chativox is operated by the same sole proprietor who operates KleioBase, so opening the support chat does not hand your details to an outside company - but it is a separate system on separate infrastructure, so we describe it here in full. When you open the support chat we pass your account identifier, name, email address, and plan tier so the assistant can identify you, along with the messages you send. Replies are generated using Google’s Gemini AI, support conversations are stored in the United States and kept for up to 12 months, with deletion available on request. The support chat is separate from the Research Companion and does not have access to your uploaded documents or knowledge base. You control when to start a conversation and what you share in it.

Key facts about our AI processing:

• We use the Google Gemini API on a paid tier. Under Google’s paid API terms, your data is not used to train or improve Google’s AI models.
• Google retains prompts and contextual information for 55 days solely for abuse monitoring and policy enforcement purposes. This data is not used for model training or fine-tuning.
• All AI-extracted results are placed in a “review” state by default. You must manually confirm or correct the extracted information before it is treated as verified. The AI does not make final decisions. Human review is always required.
• Knowledge-base modifications proposed by the Research Companion also require your explicit confirmation before they are applied. No change is made to your data automatically.
• AI extraction may contain errors. We make no guarantee of the accuracy of AI-generated genealogical conclusions. You are responsible for verifying all extracted data.

5.2 Automated decision-making (GDPR Article 22)

KleioBase’s AI processing assists you in extracting information from documents and in managing your knowledge base. It does not make decisions that produce legal effects or similarly significantly affect you. The AI is a tool that presents suggestions and proposed changes for your review. It does not determine legal rights, financial outcomes, or access to services.

You always have the ability to review, correct, or reject any AI-extracted data or AI-proposed knowledge-base modification.

5.3 AI transparency (EU AI Act)

KleioBase deploys AI systems for document analysis, data extraction, and research assistance (including knowledge-base modifications initiated by the Research Companion with your confirmation). We are transparent about the use of AI throughout the platform: our use of AI is disclosed in this Privacy Policy and in our Terms of Service, which you accept when you create an account, and AI-processed results are clearly labeled in the product and placed in a “review” state for your confirmation.

Genealogy records inherently contain personal data about individuals other than the user who uploads them. Historical records may reference living individuals (for example, a birth certificate from 40 years ago names a person who is likely still alive).

Our approach:

• Deceased individuals are generally not data subjects under the GDPR (Recital 27). However, some jurisdictions may offer limited post-mortem privacy protections.
• Living individuals named in records you upload are data subjects with privacy rights. By uploading records containing third-party personal data, you represent that you have a lawful basis for doing so (such as a legitimate interest in family history research) and accept responsibility for ensuring that the upload does not violate any applicable privacy laws.
• We process third-party data contained in your uploads under legitimate interest (Art. 6(1)(f) GDPR), specifically the recognized interest in historical and genealogical research. We have conducted a balancing test weighing the genealogical research purpose against the privacy interests of individuals named in records.
• Special-category data. Genealogy records can reveal special categories of personal data within the meaning of Art. 9 GDPR, in particular racial or ethnic origin and religious belief. Where they do, our primary condition is Art. 9(2)(j) GDPR - processing necessary for archiving in the public interest or for historical research - applied with the safeguards required by Art. 89(1). Those safeguards include data minimization (we extract only what the record itself contains), strict per-user access isolation so records are not shared across accounts by default, mandatory human review before extracted data is treated as verified, and the right of any identified individual to seek access, correction, or erasure. Where a record was manifestly made public by the individual concerned (for example, a published or publicly archived record), we may additionally rely on Art. 9(2)(e). The large majority of individuals in historical records are deceased and fall outside the GDPR (Recital 27).
• Historical context matching. Some entries in our admin-curated library of historical events are further scoped to a specific religion, nationality, or caste (for example, the Holocaust is shown only for an ancestor recorded as Jewish or Romani). Where we do this, we compare that event against the religion, nationality, or caste already recorded on a person's profile in your tree. If a person has none of their own recorded, we derive one from their nearest recorded ancestor or, failing that, a spouse, so that relevant historical context can still be shown; a person's own recorded value always takes priority over one derived this way. You can switch that derivation off at any time with the Infer historical context from relatives setting in your account preferences, in which case we match historical events only against what each person has recorded of their own. This is an additional use of special-category data you or a record you uploaded has already provided under Section 4 above - we do not ask you or any user for a person's religion, nationality, or caste, and we never infer it from a name, a place, or any source outside your own tree.
• If an individual identified in a record contacts us directly to exercise their privacy rights (access, erasure, objection), what we do depends on our role. Where we act as a customer’s processor (see below), we do not answer the request substantively: we forward it to that customer without undue delay, tell the requester that we have done so and that the customer is the controller responsible for answering, and assist the customer in responding. Where KleioBase is the controller, we handle the request ourselves in accordance with applicable law.

If you use KleioBase professionally

Where you use KleioBase in the course of a business - for example, a professional genealogist researching on behalf of a client - you are the controller of the records you upload and KleioBase acts as your processor for that content, on the terms of our Data Processing Agreement. That agreement is in force automatically for every customer within its scope, from its effective date, with no signature and no request needed.

The legitimate-interest basis described above applies where KleioBase is the controller. That is the position for personal and family history research: researching your own family history for yourself falls within the household exemption in Article 2(2)(c) GDPR, so there is no controller-to-processor relationship to govern, the Data Processing Agreement does not apply, and this Privacy Policy governs our handling of your data instead.

We do not sell your personal data. We share data only with the following categories of recipients, and only to the extent necessary for the stated purposes.

7.1 Service providers (data processors)

7.2 Sharing and collaboration features

Certain paid plans offer sharing and collaboration features that allow you to invite other users to access your knowledge base. Where these features are available on your plan:

• Read-only collaborators you invite can view but not edit your shared knowledge base.
• Edit-access collaborators you invite can view and modify the shared knowledge base.
• Revoking an invitation immediately removes access.
• We do not share your data with other users unless you explicitly enable sharing.

Availability of these features depends on your subscription plan. See our pricing page for current details.

7.3 Public profile sharing

You can choose to publish a public, read-only web link to a single person profile’s AI-generated biography. This is entirely owner-initiated: no link exists unless you create one, and you can revoke any link at any time, which immediately removes public access.

What a shared link exposes. A shared page shows only a curated public subset of the profile: the person’s name, lifespan dateline, birth and death places, the AI-generated biography text (including its historical-context callouts and external historical references), and a read-only event timeline.

What is never exposed. Shared pages do not include source record images or scans, transcriptions, extracted structured data, or any other person’s profile.

• Living-person safeguard. If a profile could be a living person (no evidence of death and a birth within the last 100 years, or an unknown birth year), you must explicitly confirm that the person is deceased or that you have consent to share before a link can be created. We store this acknowledgment.
• Optional password protection. You can require a password to view a shared page. We store the password only as a salted scrypt hash, never in plain text.
• Expiry controls. A link can be set never to expire, or to expire after 7, 30, or 90 days.
• Not search-indexed. Shared pages carry a KleioBase attribution and are marked noindex so they are not added to search-engine results.

Retention of share links. We store share links in a profile_share_links record (link token, optional expiry, optional password hash, the deceased acknowledgment, the living-person consent confirmation and the date it was given, a revocation timestamp, and a view count). Active links are retained until you revoke or delete them. Once a link is revoked or has expired, the underlying record is permanently purged 30 days after revocation or expiry by a scheduled job. The consent confirmation and its date are part of that same record and are purged with it.

Sharing a profile of a living person. Where a person is marked as living in your knowledge base, we ask you to confirm that you hold their consent, or their guardian’s if they are a minor, before a public link can be created, and we require the link to be password-protected. We record that confirmation and the date you gave it as evidence of the lawful basis you asserted. If a person is marked as living after a link was shared, the shared page stops loading unless that confirmation was recorded.

7.4 On This Day share cards

From the dashboard’s On This Day widget, you can share a single anniversary highlight as an image card. This is entirely user-initiated: nothing is shared unless you click the share button on that specific highlight.

What a share card exposes. Only the subject’s first name, the type of event (born or died), how many years ago it happened, and their relationship to you (for example “Great-Aunt”).

What is never exposed. A share card never includes a person or profile identifier, source records, your full tree, or any other person’s data.

How the link works. The link is a signed token that is not stored in our database, so there is nothing to revoke or that expires on a timer. It stops reflecting current data if the underlying fact in your account changes.

7.5 Legal requirements

We may disclose personal data if required by law, legal process, or government request, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of KleioBase, its users, or the public.

This includes the blocked-access records described in Section 14.1: where someone is blocked for harassing or abusive conduct, we may pass that record to the police, to a regulator, or to a court, and we keep it for that reason. It is not disclosed to anyone else, and it is never given to an advertiser or an analytics provider.

7.6 Tools you connect through the API

If you create an API key, a program you run with it can read and change your research data much as you can in the app: your knowledge base, your past Research Companion conversations and the files attached to them. It can also import GEDCOM files and download GEDCOM exports. It cannot send messages to the Research Companion. Nothing leaves KleioBase through the API unless a request is made with your key.

If your program passes that data on to a third-party tool or service, that is done on your instruction. The tool is your own choice, not one of our service providers, and its own terms govern what it does with the data. You can revoke a key at any time under Settings > Developer, and it stops working at once.

7.7 Apps you connect

You can connect an AI assistant (such as Claude or ChatGPT) or another app to your account through our MCP server. When you approve it, the app can do what an API key can (Section 7.6), with the permission you chose. Each call is checked against your plan and that permission.

We store the details listed in Section 3.1 (Connected app details). The app receives the data it asks for on your instruction. It is your choice, not one of our service providers, and we do not control what it does with that data: its own terms and privacy policy apply.

You can revoke an app at any time under Settings > Developer. It stops working at once, and any upload link it created stops working too.

KleioBase is operated from Israel. Your data may be transferred to and processed in countries outside your country of residence, including the United States and Israel.

8.1 Transfer safeguards

We use the following mechanisms to ensure adequate protection for international transfers:

Israel: Israel has an adequacy decision from the European Commission (and a separate UK adequacy decision), meaning transfers of personal data from the EU/EEA and UK to Israel are permitted without additional safeguards.

United Kingdom: The United Kingdom has an adequacy decision from the European Commission, so transfers of personal data from the EU/EEA to the UK (for example, to incident.io, our UK-based incident-management provider) are permitted without additional safeguards.

United States: For each US-based service provider, we rely on one or more of the following:

• EU-US Data Privacy Framework (DPF): Google, Mapbox, PostHog, Resend, Sentry, and Cloudflare are certified under the EU-US DPF, providing an adequate level of protection for transatlantic transfers. Meta is certified under the EU-US DPF for its onward transfers and acts as an independent (and, for the initial collection, joint) controller of advertising-measurement data rather than as our processor. TikTok likewise acts as an independent controller of advertising-measurement data; transfers to TikTok rely on the Standard Contractual Clauses incorporated in TikTok’s Business Products (Data) Terms.
• Standard Contractual Clauses (SCCs): For providers not certified under the DPF (Supabase, Freemius, Railway, Linear, and Brave Search), we rely on the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914, controller-to-processor module), supplemented by additional technical and organizational measures (encryption in transit and at rest, data minimization, and per-user access isolation). We have assessed these transfers in an internal Transfer Impact Assessment and concluded they provide an adequate level of protection. Brave Search relies on a Data Processing Addendum incorporating these Standard Contractual Clauses, and only minimal search query text is shared with that search provider.
• Data Processing Agreements (DPAs): Each service provider is bound by a DPA that includes commitments on data security, confidentiality, and breach notification. Most DPAs are incorporated automatically into the provider’s terms or accepted electronically; the remainder are executed by signature.

8.2 United Kingdom transfers

For personal data of UK users transferred to the United States, we rely on the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”) for providers that have separately certified to the UK Extension (Google, Mapbox, Cloudflare, PostHog, Resend, and Sentry). UK certification is a separate step from EU-US certification, so for other US providers we rely on the UK International Data Transfer Addendum to the SCCs, supported by a transfer risk assessment. Transfers from the UK to Israel are permitted under the UK’s adequacy decision for Israel without additional safeguards.

8.3 Australian users: cross-border disclosure (APP 8)

If you are located in Australia, your personal information will be disclosed to overseas recipients in the United States (all providers listed above) and Israel (KleioBase’s place of operation). As our reasonable steps under APP 8.1, we bind each overseas recipient by an enforceable Data Processing Agreement requiring it to handle your personal information in a way consistent with the Australian Privacy Principles. We do not ask you to consent to a waiver of APP 8 protections.

Under section 16C of the Privacy Act, we remain accountable for the handling of your personal information by these overseas recipients as if we had handled it ourselves. If an overseas recipient mishandles your information, you retain your rights and remedies under the Privacy Act against us.

8.4 Canadian users: international transfers

If you are located in Canada, your personal information is transferred to and processed in the United States and Israel. Under PIPEDA, this transfer to our service providers for processing is a “use” of your information for the purposes you originally agreed to, not a separate disclosure requiring fresh consent. We remain accountable for your information and bind each processor by contract to a comparable level of protection.

Foreign access: while your information is stored or processed outside Canada, it may be accessible to the courts, law enforcement, and national security authorities of those jurisdictions under their laws.

Meaningful consent: so that your consent is meaningful, we highlight throughout this policy (1) what personal information we collect, (2) the parties we share it with, including the service providers listed in Section 7, (3) the purposes for which we use it, and (4) the residual risks involved, including the foreign-access risk described above.

8.5 Quebec residents (Law 25)

If you are a resident of Quebec, Quebec’s Act respecting the protection of personal information in the private sector (as amended by Law 25) applies to our handling of your personal information, regardless of where KleioBase is located.

• Person in charge of privacy. Our designated privacy officer is Itamar Denkberg, reachable at privacy@kleiobase.com.
• Transfers outside Quebec. Before transferring your personal information outside Quebec (to our US and Israel-based infrastructure and service providers), we conduct a privacy impact assessment of the transfer, confirm the information will receive adequate protection, and bind the recipient by contract.
• Sensitive information. Genealogy records can constitute sensitive personal information. We collect and process it only with your consent, which you provide when you upload documents for processing, and use it solely to provide the Service.
• Your rights. You have the rights of access, rectification, and, where applicable, de-indexing and data portability. To exercise them, or to complain, contact our privacy officer above. You may also lodge a complaint with the Commission d’accès à l’information du Québec (CAI).

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law.

When you delete your account via the self-service flow (Settings - Account), deletion is processed immediately and covers: all data in our database (records, profiles, families, conversations, and your account row), your uploaded files in our file storage, your contact record in Resend (email delivery), your analytics profile in PostHog, and your active Freemius subscription (if any). A durable audit log entry recording the request, when it was completed and the account email it came from is retained as evidence that we honoured it. A deletion request you start but never confirm is deleted after 30 days. Payment records held by Freemius as Merchant of Record are subject to their own retention obligations (typically 7 years for tax purposes).

Backups. Deleting data removes it from the live Service immediately, but a copy may remain in routine encrypted infrastructure backups until those backups expire on their normal rotation. Our database provider currently retains daily backups on a rolling 7-day window, after which they are overwritten. Backups are encrypted at rest, are not accessible from the running Service, and are used only for disaster recovery. If a backup is ever restored, we re-apply any deletion that the restore reversed. The same position is set out in the deletion and return section of our Data Processing Agreement.

Data sharing with Meta and TikTok via their pixels is governed by the CCPA opt-out described in Section 11.3. Account deletion removes the identifiers we share with Meta and TikTok going forward; historical attribution data already processed by either is subject to that company’s own retention policies.

Mail you send to our role addresses (privacy@, contact@, support@, abuse@, security@, legal@, marketing@) is stored in our own systems and retained until manually deleted. Quarantined spam is automatically deleted after 30 days. You may request deletion of your message at any time by writing to privacy@kleiobase.com.

We use cookies and similar technologies on our website. We categorize them as follows.

Essential cookies (always active)

• Supabase authentication session cookies (managed by @supabase/ssr)
• kb-low-contrast - accessibility preference (stores your display contrast setting)
• kb-welcome-seen - remembers for a day that you have seen the plan page shown once after signing up, so it is not shown again
• kb-theme - interface preference (stores your light or dark theme choice)
• kb-date-format - interface preference (stores how dates are displayed: day, month, or year first)
• kb-view-mode, kb-records-view-mode - interface preference (stores whether the People and Records pages show cards or a list)
• kb-cookie-consent - records your analytics and marketing cookie choices, the detected region, any Global Privacy Control signal, the timestamp, and whether you have answered the banner yet. It is written as soon as you arrive, before you choose, so that the settings that apply to your region by default (see below) are applied consistently by both your browser and our servers. Answering the banner overwrites it with your actual choice
• kleio_ban_id - a security cookie used only to enforce blocks against people who abuse or harass. It holds a randomly generated identifier and nothing else: no account details, no name, no email address, and nothing about what you look at on the site. It is set on every visit, including before you sign in and on our public pages, because someone we have blocked will not be signed in. It lasts up to 12 months and its expiry is extended each time you visit. It is HttpOnly, so it cannot be read by scripts running in the page, and it is never shared with an advertiser, an analytics provider, or anyone else. Unless you are on our block list, the value is never recorded anywhere and is simply handed back to you on each request. See Section 14.1 for how blocking works and Section 9 for how long a block record is kept

Why the essential cookies above are not behind the banner. A cookie that is strictly necessary to provide the service you asked for - keeping you signed in, remembering your accessibility and display settings, recording the cookie choice you made, and enforcing a security block - is exempt from the prior-consent requirement under the EU ePrivacy Directive (Art. 5(3)) and the UK PECR (reg. 6(4)). We still tell you about each of them here, which is required. The kleio_ban_id cookie in particular is a security measure, not a tracking cookie: we cannot allow it to be switched off, because a person we have blocked for harassment would simply switch it off. If you object to it, the balancing test we ran and your right to object are described in Section 11, and you can write to privacy@kleiobase.com.

Local storage (browser storage, not cookies)

• Essential functional preferences. We store small interface and draft-state values in your browser’s local storage (under the kb- prefix) so the app remembers things like your view and sidebar settings, in-progress upload tabs, export options, and recent searches. These are not used for tracking, are not shared with anyone, and require no consent.
• PostHog analytics identifiers. Only after you consent to analytics, or, in the United States, before you make a choice (analytics is on by default there), PostHog uses browser localStorage (not cookies) to maintain a session identifier for product analytics that can be linked to your account.
• PDF pages, while you pick them. When you drop a PDF into the upload workspace, we hold it temporarily in your browser’s IndexedDB storage (not on our servers) so you can open the page picker and choose which pages to bring in. It stays there until you close that page picker tab, which removes it immediately, or until you clear your browser’s storage. If a picker tab is ever lost without being closed (a browser crash, for example), the next time you open the upload workspace clears any PDF left without a tab. Like the preferences above, this is first-party, is not used for tracking, is never shared with anyone, and requires no consent. Only the individual pages you choose to add are ever uploaded to us.
• A family tree file you send from a free tool. Our free tools at kleiobase.com/tools process files and dates entirely in your browser; nothing you check or type in them is uploaded to us. If you choose Open in KleioBase in the GEDCOM checker, the file is kept in your browser’s IndexedDB storage so the import can pick it up after you sign up. It is deleted as soon as the import reads it. If it is never used it is ignored after 24 hours and deleted the next time you open the GEDCOM checker or the import page, or when you clear your browser’s storage. To take you straight to that import once you confirm your email, your new account also carries a one-word marker saying the signup came from the checker; it holds nothing about the file. Like the items above, this is first-party, is not used for tracking, and requires no consent; the file reaches us only when you start the import yourself.

Session replay (requires your consent to analytics)

Only after you make a choice and consent to analytics, two providers record masked session replays. A session replay is a reconstruction of how a page behaved - clicks, scrolling, navigation, and page changes - so we can fix bugs and see where the product is hard to use. Our error-monitoring provider (Sentry) records a small sample of sessions and sessions where an error occurs, with all text and form inputs masked. Our analytics provider (PostHog) records sessions to show how the product is used: form inputs are always masked, all text inside your account and on shared pages is masked, and text on our public pages (such as the home page, pricing, the blog and the help center) is recorded as shown. Record images, uploaded documents, profile photos and embedded content are never captured by either provider. Replays are held briefly in your browser’s session storage before they are sent, and PostHog deletes them after 30 days. If you do not consent to analytics, or before you make a choice, no session replay is recorded. Withdrawing analytics consent stops any further recording immediately.

Cookieless, anonymized analytics (no consent required)

If you reject analytics, we still measure overall product usage (such as page views and aggregate traffic) in a cookieless, anonymized mode. Outside the United States, analytics also runs in this mode before you make a choice. In the United States, analytics is on until you choose, as described above. In the cookieless mode PostHog stores nothing on your device - no cookies, no local or session storage. Visitor identity is derived by PostHog on its servers as a privacy-preserving hash of your IP address and browser user-agent combined with a secret salt that rotates daily and is then deleted, so the result cannot be traced back to you and is not used to identify or track you across days. Because nothing is stored on your device and the data is anonymized, this does not require your consent; we rely on our legitimate interest in understanding whether the product is being used (see Section 4). If you consent to analytics, we switch to full, identifiable analytics as described above.

Some product events are recorded by our servers rather than your browser (for example that a record finished processing, that a subscription started, or that someone opened a public shared profile page). They contain counts and categories only, never names, record contents or file names. If you have not consented to analytics, each one is sent with a random identifier created for that single event and never reused, and with no IP address, device details or account identifier, so it counts towards totals but cannot be linked to you or to your other activity. The same applies to anyone who visits a public shared profile page without an account: the visit is counted, but never linked to the visitor or to the person who shared the page. Calls to our developer API and from AI assistants you connect to KleioBase (such as Claude or ChatGPT) are counted slightly differently, so that one working session reads as one session rather than hundreds of unrelated calls: if you have not consented, each call carries an identifier made by hashing your account identifier with a secret that is held only in our server’s memory and replaced every day, together with a session identifier for the connected app. It stays the same for that day only, cannot be linked to your other days, and cannot be turned back into your account once the secret is replaced. Each event records which endpoint or tool was used, whether it succeeded, roughly how long it took and whether the app was Claude, ChatGPT or another app, never what you asked or what was returned. If you have consented, these events are linked to your account like the rest of your analytics. So that this also works for events that happen while you are not on the site, such as a payment confirmation, we keep a copy of your current analytics choice on your account and update it when you sign in or change it.

To keep our figures accurate, each analytics event carries a coarse label that says whether the visit looks like a real browser or an automated one (for example a headless browser), and, while you are actively using a page, we send a periodic “still active” signal. This applies whether or not you consented to analytics. The label and the signal themselves contain nothing that identifies you; if you consented, the events they travel with are linked to your account as described above.

Analytics cookies (requires your consent)

• kb_attr - remembers which channel brought you to the site (for example, a search engine, a social network, or an advertisement) so we can measure our marketing. It stores the campaign parameters and referring page from your first visit, and lasts up to 90 days. We write it only once you have consented to analytics cookies, and it is never written before then. If you sign up, the value is copied once to your account so we can report which channel brought us your signup; it is not overwritten on later visits, so it always reflects your original first visit.
• kb_tool - remembers which of our free tools you used first, so we can measure which tools lead to signups. It stores only the tool’s name and lasts up to 90 days. Like kb_attr, we write it only once you have consented to analytics cookies, and if you sign up the tool name is copied once to your account.

Marketing cookies (requires your consent)

• Meta Pixel: sets cookies to measure advertising effectiveness and deliver relevant advertisements. The two it uses are _fbp (a browser identifier) and _fbc (a record of the advertising click that brought you here). Both last up to 90 days.
• _fbc, written by us: if you arrive from a Meta advertisement (your link carries an fbclid parameter) and the Meta Pixel has not written this cookie itself, our own code writes it, using the same format and the same 90-day lifetime, so the click can still be attributed. We do this only once you have consented to marketing cookies, and we never overwrite a value the Pixel has already set.
• TikTok Pixel: sets _ttp (a browser identifier) to measure advertising effectiveness, and may set other TikTok measurement cookies with the same purpose. It loads only once you have consented to marketing cookies.
• kb_ttclid, written by us: if you arrive from a TikTok advertisement (your link carries a ttclid parameter), our own code stores that click identifier for up to 30 days so the click can still be attributed when you later sign up or subscribe. We write it only once you have consented to marketing cookies, and delete it if you withdraw that consent.
• Account-side copy: while you are signed in with marketing consent given, we copy these cookie values, along with your IP address and browser user-agent, to your account so our server can send the matching sign-up, checkout, subscription and purchase confirmations to Meta and TikTok. This account-side copy is deleted along with the rest of your account data if you delete your account.

Google preferred sources (nothing loads until you use it)

Our blog articles, our help-centre articles and our site footer carry an Add as a preferred source button. Preferred sources is a Google Search feature: if you choose to use it, you are telling Google that you would like to see KleioBase more often in its results. The choice is stored by Google against your Google Account, not by us, and we are never told who used it.

This button is deliberately not the drop-in one Google supplies. The standard version loads a Google library on every page, which starts logging, opens a Google frame, and records that you were shown the button, all before you touch anything. Ours contacts Google only after you move to use it: pointing at or tabbing to the button fetches Google’s library so the window opens without a delay, and nothing is written to or read from your device until you actually click. If the library is blocked or has not arrived yet, the button is an ordinary link that opens Google’s own settings page instead. Because nothing is stored on your device before you ask for it, this is not a tracking technology and does not sit behind the cookie banner; from the click onwards you are dealing with Google under Google’s privacy policy, as you would be on any Google page. We record only that the button was clicked, and which page it was clicked from, in our own analytics, which stays gated on your analytics consent.

Embedded YouTube videos

Some of our articles embed videos from YouTube. When such a page loads, YouTube receives your IP address and may store information on your device, under Google’s privacy policy.

Bot protection

• Cloudflare Turnstile: may set cookies transiently during bot verification challenges on forms.

You can manage your tracking preferences at any time through our consent banner or by visiting your tracking settings. Rejecting non-essential tracking does not affect your ability to use KleioBase.

For more information about how to control cookies and local storage in your browser, visit your browser’s help documentation.

11.1 Rights for all users

Regardless of where you are located, you can:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Export your data (including GEDCOM export of family tree data)
• Withdraw consent for optional processing (analytics, marketing)
• Object to processing based on legitimate interest

Many of these rights are available as self-service actions inside the platform, without needing to contact us:

• Download my data - a full ZIP export of all personal data we hold (account, records, people, families, matches, Research Companion history, and original file uploads) is available at Settings - Import / Export. We email you a download link when the archive is ready. The link expires after 7 days and can be regenerated.
• Delete account - permanently erases your account and all associated data. Available at Settings - Account. The flow requires you to type your account email, click a single-use confirmation link sent to that address, and then re-authenticate (re-enter your password, or re-sign-in with your identity provider). See Section 9 for what deletion covers.
• Clear KB data - deletes all knowledge-base content (records, profiles, families, matches, Research Companion conversations) while keeping your account active. Available at Settings - Account. Like account deletion, it requires confirming via a single-use link emailed to you and then re-authenticating.
• Delete a workspace - permanently erases one workspace (a separate knowledge base) and everything in it, including a workspace currently locked to read-only, while leaving your other workspaces and the rest of your account untouched. Available at Settings - Workspaces by typing the workspace's name, then confirming via a single-use link emailed to you that requires you to re-authenticate (re-enter your password, or re-sign-in with your identity provider) and expires after 30 minutes. Your default workspace cannot be deleted this way; make another workspace the default first. If every other workspace is locked to read-only after a downgrade, you cannot promote one yourself - email support@kleiobase.com (see Section 9.6 of our Terms of Service). Deletion happens immediately once confirmed and cannot be undone.

For any right not covered by a self-service flow, contact us at privacy@kleiobase.com.

11.2 EEA and UK residents (GDPR / UK GDPR)

If you are in the European Economic Area or the United Kingdom, you have the following additional rights under the GDPR (or UK GDPR):

• Right of access (Art. 15): obtain a copy of all personal data we process about you.
• Right to rectification (Art. 16): correct inaccurate or incomplete personal data.
• Right to erasure (Art. 17): request deletion of your personal data (“right to be forgotten”).
• Right to restriction of processing (Art. 18): request that we limit how we use your data in certain circumstances.
• Right to data portability (Art. 20): receive your data in a structured, commonly used, machine-readable format. We support GEDCOM export for genealogy data and JSON export for other data.
• Right to object (Art. 21): object to processing based on legitimate interest, including profiling.
• Right to withdraw consent (Art. 7(3)): withdraw consent at any time for processing based on consent, without affecting the lawfulness of processing before withdrawal.
• Right to lodge a complaint: you may file a complaint with your local supervisory authority. A list of EEA data protection authorities is available at edpb.europa.eu. For UK residents, contact the Information Commissioner’s Office (ICO) at ico.org.uk.

11.3 California residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides you with specific rights regarding your personal information.

Categories of personal information collected

Using CCPA-defined categories, we collect the following:

Sale and sharing of personal information

We do not sell your personal information as defined by the CCPA.

We may “share” personal information (as defined by the CCPA/CPRA) with Meta for cross-context behavioral advertising purposes when you have consented to marketing cookies. The categories shared are A. Identifiers (email address, account identifier, IP address, and the Meta browser cookies), B. Personal information categories (first and last name), D. Commercial information (that you started a checkout or subscribed, and the amount, currency and transaction reference of a purchase), F. Internet or similar network activity (page views, your browser user-agent, and the fact that you confirmed your first record), and G. Geolocation data (the billing country and postal code of a purchase). We do not share uploaded documents or any genealogy data with Meta.

On the same terms we may share personal information with TikTok: A. Identifiers (hashed email address, hashed account identifier, IP address, the TikTok browser cookie and advertising click identifier), D. Commercial information (that you started a checkout or subscribed, and the amount, currency, plan and transaction reference of a purchase), and F. Internet or similar network activity (page views, your browser user-agent, and the fact that you confirmed your first record). We do not share your name, billing details, uploaded documents or any genealogy data with TikTok. You can opt out of all of this sharing at any time by:

• Adjusting your cookie preferences to reject marketing cookies
• Using the “Do Not Sell or Share My Personal Information” link in our website footer
• Enabling the Global Privacy Control (GPC) signal in your browser. We honor GPC signals as a valid opt-out request.

Sensitive personal information

Genealogical data may be considered sensitive personal information under the CPRA, particularly where it reveals racial or ethnic origin. We use sensitive personal information only as necessary to provide the Service (document processing and genealogy research) and do not use it for purposes beyond what is permitted under the CCPA/CPRA.

Your CCPA/CPRA rights

• Right to know: request disclosure of (a) the categories of personal information we have collected about you, (b) the categories of sources, (c) the business or commercial purpose for collecting, and (d) the specific pieces of personal information we have collected about you (CCPA § 1798.110).
• Right to delete: request deletion of your personal information.
• Right to correct: request correction of inaccurate personal information.
• Right to opt out of sale/sharing: opt out of the sharing of your personal information for cross-context behavioral advertising.
• Right to limit use of sensitive personal information: direct us to limit the use of your sensitive personal information to what is necessary for the Service.
• Right to non-discrimination: we will not discriminate against you for exercising any of your CCPA/CPRA rights.

We do not use or disclose sensitive personal information for purposes other than those permitted under CCPA § 1798.121.

Authorized agents

You may designate an authorized agent to make requests on your behalf. We may require the agent to provide proof of your written authorization and verify your identity directly.

Financial incentive programs

We do not offer any financial incentive programs tied to the collection of personal information.

11.4 Australian residents

Under the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs), you have the right to:

• Access your personal information (APP 12)
• Request correction of inaccurate, out-of-date, incomplete, or misleading personal information (APP 13)
• Complain about a breach of the APPs. We will respond to your complaint within 30 days.
• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au if you are not satisfied with our response.

Sensitive information: genealogy records may contain information that reveals racial or ethnic origin, which is “sensitive information” under the Australian Privacy Act. We collect such information only with your consent (which you provide by uploading the document) and use it solely for the purpose of providing the genealogy service.

11.5 Canadian residents (PIPEDA)

Under the Personal Information Protection and Electronic Documents Act (PIPEDA), you have the right to:

• Access your personal information held by us
• Challenge the accuracy and completeness of your personal information and have it amended as appropriate
• Withdraw consent for the collection, use, or disclosure of your personal information (subject to legal or contractual restrictions)
• Complain to us about our personal information handling practices
• Lodge a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca if you are not satisfied with our response.

11.6 New Zealand residents

Under the New Zealand Privacy Act 2020 and the Information Privacy Principles (IPPs), you have the right to:

• Access your personal information (IPP 6)
• Request correction of your personal information (IPP 7)
• Lodge a complaint with the Office of the Privacy Commissioner at privacy.org.nz.

11.7 Israeli residents

Under Israel’s Protection of Privacy Law 5741-1981 (as amended, including Amendment 13 effective August 2025), you have the right to:

• Access personal data held about you in our databases
• Request correction or deletion of inaccurate data
• Object to the use of your data for direct marketing purposes
• Sue for privacy violations without the need to prove actual harm (under Amendment 13)
• Lodge a complaint with the Privacy Protection Authority (PPA) at gov.il/privacy-protection-authority.

We have designated a Privacy Protection Officer, reachable at privacy@kleiobase.com, who is responsible for our compliance with the Protection of Privacy Law and for handling your requests.

To exercise any of the rights described above, please contact us at:

Email: privacy@kleiobase.com

We will respond to your request within:

• 30 days for GDPR / UK GDPR requests (extendable by two further months for complex requests)
• 45 days for CCPA/CPRA requests (extendable by an additional 45 days with notice)
• 30 days for Australian Privacy Act requests
• 30 days for PIPEDA requests (extendable to 60 days with notice)
• 20 working days for New Zealand Privacy Act requests
• 30 days for Israeli Protection of Privacy Law requests

We may need to verify your identity before processing your request. We will not charge a fee for processing reasonable requests, except where requests are manifestly unfounded or excessive.

KleioBase is not intended for use by anyone under the age of 16. We do not knowingly collect personal information from children under 16. If you believe that we have collected personal information from a child under 16, please contact us at privacy@kleiobase.com, and we will take steps to delete that information.

Note regarding genealogy data: uploaded historical records may contain information about individuals who were minors at the time the record was created. This data is processed solely for genealogical research purposes and does not involve the direct collection of data from children.

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit (TLS/HTTPS) and at rest
• All traffic to the site, including the authenticated product, is routed through Cloudflare, our content delivery network and reverse proxy, which terminates TLS at its edge before forwarding requests to our application infrastructure. See Section 7.1 for Cloudflare’s full role as a service provider.
• Authentication via secure, industry-standard methods (Supabase Auth)
• Blocking, at that same Cloudflare edge, of visitors we have blocked for abuse or harassment, so the request is stopped before it reaches our application (see Section 14.1 below)
• Access controls limiting who can access personal data
• Regular review of security practices
• Incident response procedures (see Section 15)

No method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially reasonable means to protect your personal data, we cannot guarantee its absolute security.

14.1 Blocking access for abuse or harassment

We reserve the right to refuse access to the site to anyone who abuses or harasses us, our users, or the people who work on KleioBase. We do not do this lightly, and it is not automated: a block is added by hand, by a person, after a decision that the conduct warrants it. See Section 8 of our Terms of Service for the conduct that can lead to a block.

A block is held against an IP address and against the random kleio_ban_id identifier described in Section 10, and is enforced at Cloudflare’s network before the request reaches our application. Using the identifier as well as the IP address is deliberate: an IP address changes when someone moves network or restarts a router, and blocking on IP alone would either fail immediately or force us to block whole ranges of addresses shared by unconnected people. Checking the identifier lets us keep the block narrow and aimed at the one person it concerns.

If you have been blocked and believe it is a mistake - for example because you share an IP address with someone else - write to privacy@kleiobase.com and we will review it. What we retain about a block, and for how long, is set out in Section 9.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach (as required by GDPR Art. 33 and UK GDPR)
• Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms (GDPR Art. 34)
• Notify the OAIC and affected individuals as soon as practicable under Australia’s Notifiable Data Breaches scheme
• Comply with breach notification requirements under CCPA, PIPEDA, the NZ Privacy Act 2020, and Israel’s Privacy Protection Law as applicable

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the “Last updated” date at the top of this policy
• Notify you by email or through a prominent notice on our website
• Where required by law, obtain your consent to material changes

We encourage you to review this policy periodically.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Email: privacy@kleiobase.com
Website: https://kleiobase.com/privacy

For EEA residents: a GDPR Article 27 EU Representative is being appointed. Until then, please direct any EEA data-protection enquiries to us using the contact details above and we will respond.

For UK residents: a UK GDPR Article 27 UK Representative is being appointed. Until then, please direct any UK data-protection enquiries to us using the contact details above and we will respond.

This Privacy Policy is designed to comply with the EU General Data Protection Regulation (GDPR), the UK General Data Protection Regulation (UK GDPR), the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the Australian Privacy Act 1988, the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA), the New Zealand Privacy Act 2020, and Israel’s Protection of Privacy Law 5741-1981 (as amended).