Privacy notice

Erys AI Ltd runs Klarbon and controls the personal data described here. The site viewer works on your device. Server tools create no document archive; email and encrypted tab results have separate handling. Processing is not guaranteed to stay entirely in the EU. We retain account, payment and security information as described below. Write to privacy@klarbon.app with any question.

Who is responsible for my data?

Erys AI Ltd, a private limited company registered in England and Wales under number 15781123, with its registered office at Suite 12, Rivers Lodge, West Common, Harpenden, England, AL5 2JD. Privacy contact: privacy@klarbon.app. All company details are in the legal notice.

Our representative in the European Union under Article 27 GDPR: to be confirmed.

When a business uses Klarbon to process invoices or statements that contain other people's data, that business is the controller of those documents and Erys AI Ltd processes them on its behalf, under the data processing agreement.

What happens to my documents?

Opening an e-invoice in the site viewer, widget or extension, printing it or saving it as a PDF runs on your device without uploading it. The API and MCP use server processing even to open an invoice.

Checking, converting, fixing, making, bank statement conversion and email-in send files or entered data to servers. The application processes document data for the current request, without writing an upload archive, extracted text or document fields to its database, logs or analytics. Engine scratch storage is memory-backed. Returned files that you download remain where you save them.

PDF extraction is not currently enabled. If enabled after the required controls are verified, it will use an AI inference provider processing in the EU under a data processing agreement, with no retention. We do not use submitted documents as training examples. You must check extracted values before continuing.

A prepared paid result is sent back encrypted with AES-256-GCM. Leaving to sign in or pay can keep only ciphertext, tool, credit cost, optional export format and server expiry in this tab's sessionStorage, never a filename or unencrypted document data. The decryption key stays on the server. The result normally expires 30 minutes after preparation. Resuming or abandoning clears the saved entry; expired entries are removed on page load or by an active-page timer. A suspended browser can delay local deletion.

Purpose	Legal basis	Kept
Doing the check, conversion or read you asked for	Contract (Art. 6(1)(b)); for a business's documents, its instructions under the data processing agreement (Art. 28)	Only for the request

Please do not send invoices or bank statements to support. Describe the problem, and we will ask only for what we need.

What do you keep about my account?

Data	Why	Legal basis	Kept
Email address, language, account creation date	Your account, sign-in and service emails	Contract	While the account exists
Plan, plan status and billing period	Providing what you pay for	Contract	While the account exists
Your email-in address	Receiving files you email to Klarbon	Contract	While the account exists
Seat invitations (Bookkeeper): the invited email addresses	Sharing your credits with people you choose	Contract	Until you remove the seat or delete the account
Referral code, and which account referred which	Giving referral credits	Contract	Until the account is deleted
Whether you have opted out of offers by email	Respecting your choice	Legal obligation (Art. 6(1)(c))	While the account exists

Sign-in works with a one-time code sent to your email. We store the code only as a keyed hash, valid for 10 minutes, with a keyed hash of your address and of the device asking, to limit attempts. Daily cleanup deletes these records after the code has expired and the hourly attempt window has closed, and removes an address's send count after its UTC day has ended. A signed-in session is stored as a hash and ends 30 days after you last used it. When you sign in, we also remember keyed hashes of the network block and the device you signed in from, for 90 days, so that your own sign-in requests are never held back by limits meant for others. Legal basis: contract, and our legitimate interest in keeping accounts safe (Art. 6(1)(f)).

Deleting your account from the account page cancels any subscription at once, removes your saved cards and your name, email and phone from our payment provider's customer record, deletes your sessions, sign-in records, usage counts, API keys, auto top-up settings, referrals, seats and invitations, and replaces your email address with a meaningless placeholder. Payment records stay under an account reference, as described below. They are pseudonymous, not necessarily anonymous: a payment reference may still be matched to a legally retained Stripe record. Withdrawal contact details are retained separately for the period below.

What do you keep about payments?

Payments are handled by Stripe. Stripe collects your card or bank details, billing address and any VAT number on its own pages; we never see a full card number. Stripe acts as a separate controller for its own fraud prevention and legal duties, under the Stripe privacy policy.

Data	Why	Legal basis	Kept
Each purchase: payment reference, item, credits, amount, currency, whether a VAT number was given, refunds, date, the terms version you accepted and when you asked us to start at once	Supplying the purchase, receipts, refunds, withdrawals and disputes	Contract; legal obligation	Ten years from year end, with the settlement criteria below
Credit ledger: every credit added, used, returned or refunded	Your balance, and reconciling refunds and disputes	Contract; legal obligation	Ten years from year end, with the settlement criteria below
Subscription payments, disputes and payment notifications from Stripe (reference, type, amount)	Billing records and disputes	Legal obligation	Ten years from year end, with the settlement criteria below
Withdrawal statements: your name, email address, description, selected purchase, acknowledgement, refund and outcome	Handling and proving your withdrawal and any billing review	Contract; legal obligation	Ten years from the end of the year the case is closed; an open case is kept until settled
Auto top-up: the pack, the threshold, the saved card's brand and last four digits, and Stripe's reference to it	Buying credits when your balance runs low, as you set up	Contract	Settings remain while the account exists; saved-card details change when you replace the card and are deleted with the account. Switching top-up off stops purchases, not retention of its settings

The non-Union OSS rule requires transaction records for ten years from the end of the transaction year (VAT Directive, Article 369). We keep detailed finance records for that period. A balance or dispute that is still open is kept until settled, then for ten years from that year's end. The daily expiry job removes a settled account's detailed financial history only when all its credit and API balances are zero, no subscription or dispute is open, and its last financial activity is outside that period. This avoids deleting a grant that still supports a non-expiring balance. It also removes expired closed withdrawal contact data. Payment-notification references are removed after the transaction window even where an open account still needs its purchase and ledger history. Revenue totals without account or payment identifiers may remain. These duties can require records to stay after account deletion.

What about API keys?

Legal basis: contract and our legitimate interest in preventing unauthorised access. An API key is shown to you once. We keep a keyed hash of it, its first characters so that you can recognise it, the name you gave it, when it was made and when it was last used, until you revoke it or delete the account. Requests repeated with the same idempotency key are recognised for 24 hours from a keyed hash of the key and a digest of the request, never the document. Expired entries are purged on the daily cleanup, when another key is claimed, or on account deletion. Rate-limit records hold pseudonymous subjects and token counts, not documents; stale buckets expire after 90 days of inactivity and are removed on daily cleanup or account deletion.

What about email-in?

Email-in processes the message and its attachments for the requested reply under the service contract, or the business customer's processing instructions. The application does not archive the message. Sent-message previews are switched off for mail.klarbon.app, verified on 5 November 2026 at 21:52 UTC. Delivery still passes through the email service's queue, and the receiving mailbox keeps its own copies. We cannot promise EU-only SMTP handling or immediate erasure from delivery queues. Do not use email-in if those copies are unsuitable for your data. We count messages per account and day to apply the limit.

Service emails, including codes, receipts and withdrawals, contain the address and the information necessary for that message. Our email sending provider receives those details for delivery under contract. Codes expire after ten minutes; payment and withdrawal records have the retention described above. Delivery metadata is separate from application records.

What if I contact support?

The company support, billing, privacy and security mailboxes receive the address, message and any information you send. We use this to answer you, resolve a contract issue or meet a legal duty: contract, legitimate interests in resolving enquiries, or legal obligation as applicable. Access is limited to Klarbon operations and the contracted mailbox provider. Resolved support threads are deleted 24 months after resolution unless a legal hold requires retention for a dispute, regulatory duty or claim. Finance and withdrawal evidence follows the longer schedule above. Do not send invoices or bank statements to support.

What is logged for security?

Our application diagnostics name technical steps, statuses, error categories and payment or withdrawal references where necessary, not document content, filenames, email bodies or sign-in codes. Worker invocation logs and traces are disabled; deliberate structured application logs remain enabled. Hosting and email delivery services can separately process network and request metadata, including IP addresses. Stored Worker logs have a maximum seven-day retention. Legal basis: our legitimate interest in protecting a secure, working service (Art. 6(1)(f)).

To apply daily limits without an account, we count requests against a keyed hash of the network block your IP address belongs to, never the address itself. Daily cleanup removes these counts, and the per-account ones, after their 90-day retention window.

Turnstile. Signing in, and some server tools, include a short check by Cloudflare Turnstile that you are a person. It processes signals such as your IP address, browser and connection to tell people from automated traffic. Cloudflare does this on our behalf, and also uses those signals as a separate controller to improve Turnstile, as its Turnstile privacy addendum explains. Legal basis: our legitimate interest in protecting the service from abuse.

Do you use analytics or cookies?

We count product steps, such as "a check started" or "a conversion was downloaded". Each event records only its name, the page type, the tool, the step, the format, an error code and the page language. It holds no identifier, no IP address, no cookie and nothing from your document, and it is kept for three months. Page views and loading times may also be measured with Cloudflare Web Analytics, which sets no cookie and does not identify or follow you across sites. Legal basis for both: our legitimate interest in knowing which pages and tools work (Art. 6(1)(f)). We use no advertising, tracking or social media scripts.

What is stored in my browser?

Klarbon has no advertising or analytics cookies and displays no cookie banner. The following storage supports requested features; the referral cookie also attributes a purchase to a referral. Cookie-free analytics is not a claim that no personal data is processed.

Name	Type	What it does	How long
`__Host-kb_session`	cookie	Keeps you signed in	30 days after last use
`__Host-kb_dev`	cookie	Recognises a device you have signed in on, so your sign-in codes always get through	90 days
`kb_ref`	cookie	Remembers the referral link you followed, so that the referral credits are given when you create an account	30 days
`kb_lang`	cookie	Remembers the language you chose	1 year
`kb_theme`	local storage	Remembers light or dark mode, only if you choose one	Until you choose System
`klarbon:pending`	session storage	Keeps only an encrypted result and limited metadata while you sign in or pay	Until resumed, abandoned or found expired; normally 30 minutes from preparation, subject to a suspended tab
Offline shell pages	cache storage	Lets the installed app open its public shell offline, never a document archive	Replaced on service-worker updates
Shared file handover	service worker memory, not persistent storage	Passes a file once to the tool under a random id	Claimed once or 60 seconds; a restart loses it. Old share caches are removed on activation

The browser extension stores only your language setting in the browser's extension storage. Stripe's checkout pages and the Turnstile check run on their providers' own domains and follow their own policies.

Will you send me offers?

Service emails, such as sign-in codes, receipts, renewal notices and replies to email-in, are part of the service. When your purchase supplies an address, you may also receive an occasional offer about Klarbon plans, such as a yearly plan when you pay monthly. You can refuse these when you create your account or buy, and every offer email has a link that stops them at once. Legal basis: our legitimate interest in telling customers about similar services (Art. 6(1)(f)), as the ePrivacy rules on email to existing customers allow (Art. 13(2)). We never share your address for others' marketing.

Who receives my data?

We use these recipient categories for the purposes above. Processors act under contract; Stripe and Turnstile also have the separate controller purposes described above:

Provider	What for	What they receive
Hosting, network, database and email routing (Cloudflare)	Running the website, the servers, the account database, sending and receiving email, Turnstile	Everything our servers process, for the purposes above
Payments (Stripe)	Checkout, subscriptions, receipts, refunds	Your email, billing details, purchases
AI inference provider processing in the EU under a data processing agreement, with no retention	PDF extraction, currently disabled	No current document traffic on this path
Our email provider for the support, privacy and billing mailboxes	Answering you	The messages you send us

Klarbon uses Cloudflare's global network, so TLS decryption and request handling can occur outside the EU. Worker placement near Frankfurt is a best-effort preference, not an EU-only guarantee, and does not regionalise email or scheduled jobs. Engine compute is EU-constrained by container configuration. The D1 account databases have EU jurisdiction. Neither setting regionalises the network, email delivery, analytics, payment processing or support. These are distinct boundaries, not an end-to-end EU processing claim. For restricted international transfers we use the applicable adequacy decision or appropriate contractual safeguards, such as standard data-protection clauses and the UK addendum where required. Ask privacy@klarbon.app about the applicable recipient, access locations and a copy of the safeguards. A compute location does not itself provide a transfer mechanism.

Business customers can obtain the named list of sub-processors under the data processing agreement. We do not sell personal data, and we disclose it to authorities only where the law requires.

What are my rights?

You can ask for a copy of your data, its correction, its erasure, a restriction of its use, or a copy in a portable format, and you can object to processing based on our legitimate interests. Write to privacy@klarbon.app from the address on your account, or say which account you mean; we answer within one month, which the law lets us extend by two further months for complex requests, and we tell you if we do. We never ask you to send a document to prove who you are. Some payment records must be kept for the period above even if you ask us to erase them. Klarbon makes no decision about you that is based solely on automated processing and has legal or similarly significant effects.

How do I complain?

Write to privacy@klarbon.app first, and we will try to put it right. You can also complain to the Information Commissioner's Office in the UK, at ico.org.uk/make-a-complaint, or, if you live or work in the EU or the problem happened there, to the data protection authority of that country. The European Data Protection Board lists them.

How will I hear about changes?

This notice shows its version and the date it takes effect. When we change what we collect or why, we update this notice before the change applies, and we tell account holders by email when the change affects them.