Privacy notice
Last updated: October 2026 · Draft, not yet reviewed by a lawyer. The German version is the authoritative one.
This notice describes which personal data we process on kelon-ai.com, why, and for how long.
1. Controller
Josiane Guimbang, sole proprietorship, trading as “Kelon-AI”
Franz-Mehring-Straße 5, 17489 Greifswald, Germany
Email: hello@kelon-ai.com · Phone: +49 170 8820611
No data protection officer has been appointed because there is no legal duty to do so.
2. In short
- We set no advertising or tracking cookies and build no user profiles.
- We collect only what you enter into a form, plus the technical data needed to deliver the website.
- We use your details to prepare your call and to answer your request. We do not sell data.
- Your form answers are not used to train AI models.
3. Visiting the website (hosting)
The website is delivered by Cloudflare (Cloudflare, Inc., USA; in the EU: Cloudflare Germany GmbH). When you open a page, Cloudflare processes technically necessary data: IP address, date and time, page requested, browser and device type, referrer.
Purpose: delivery, stability and security of the website.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).
Storage: Cloudflare keeps log data only for a short time.
A data processing agreement is in place with Cloudflare. Data may be transferred to the USA; this relies on the EU-US Data Privacy Framework and the EU standard contractual clauses.
4. Audience measurement
We use Cloudflare Web Analytics. It sets no cookies, stores nothing on your device and builds no profiles of individual visitors. We also count anonymous events on our own server (for example how often a service page was opened), with no identifier of any person.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving the website).
5. Protection against abuse (Cloudflare Turnstile)
When you submit a form, Cloudflare Turnstile checks that the request comes from a person. Cloudflare processes technical characteristics of your browser and your IP address. To limit mass requests we also process your IP address briefly in shortened or hashed form; it is not stored with your booking.
Legal basis: Art. 6(1)(f) GDPR (protection against spam and abuse); where your device is accessed, § 25(2) no. 2 TDDDG (strictly necessary).
6. Booking an introductory call
When you book a call we process: name, email address, organisation, the service chosen, language, appointment time, your role in the decision, your answers to the preparation questions and, optionally, your phone number.
Purpose: scheduling, preparing and holding the call; confirmation, reminder, rescheduling or cancellation.
Legal basis: Art. 6(1)(b) GDPR (steps taken at your request before a contract).
Storage: 12 months after the call if no business relationship follows. If you become a client, statutory retention periods apply (usually 6 or 10 years for business and tax records).
The booking is stored in our database at Cloudflare and in our customer management system GoHighLevel (see section 10). The appointment is entered into our Google calendar.
7. Custom request without an appointment
If you send a request without booking, we process what you entered in order to review it and reply.
Legal basis: Art. 6(1)(b) GDPR; for general enquiries Art. 6(1)(f) GDPR.
Storage: 6 months after the last contact.
8. “Notify me” (Kelon Research)
For services that are not open yet you can leave your email address. We then write to you once, when the service becomes available.
Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw consent at any time for the future, through the link in the email or by writing to hello@kelon-ai.com.
Storage: until three months after the service opens, at most 12 months, then deleted unless you renew.
9. Contact by email or phone
If you write to us or call, we process your details to handle your request. Our mailbox is provided by Google Workspace (Google Ireland Limited).
Legal basis: Art. 6(1)(b) or (f) GDPR.
Storage: until your request is resolved, then according to statutory retention duties.
10. Recipients and service providers
We use the following providers as processors:
| Provider | Task | Location |
|---|---|---|
| Cloudflare | Hosting, booking database, abuse protection, audience measurement | USA / EU |
| GoHighLevel (HighLevel Inc.) | Customer management, calendar, confirmation and reminder emails | USA |
| Google (Google Workspace) | Mailbox and calendar | Ireland / USA |
Our GoHighLevel access is provided through the agency Shiney.ai Solutions, which administers the account technically and may have access to the data stored there.
For providers based in the USA, the transfer relies on the EU-US Data Privacy Framework where the provider is certified, otherwise on EU standard contractual clauses.
11. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time (Art. 7(3)).
Write to hello@kelon-ai.com. We reply within one month.
You can also complain to a supervisory authority, for example:
Der Landesbeauftragte für Datenschutz und Informationsfreiheit Mecklenburg-Vorpommern, Schwerin, www.datenschutz-mv.de
12. Required details, automated decisions
Form fields marked with a star are needed to give you an appointment; without them no booking is possible. No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.
13. Security
The website is delivered only over an encrypted connection (HTTPS). Access to booking data is limited to the owner.
14. Changes
We update this notice when the website or the law changes. The version published here applies.