---
title: Klex privacy policy
changeSummary: Website and Cloud analytics, email communications, transfer safeguards, debugging and retention
---

## 1. Who is responsible

stagewise GmbH, Obernstraße 50, 33602 Bielefeld, Germany, is the controller for the website, account administration and other processing for our own purposes described here. Contact [privacy@klex.bot](mailto:privacy@klex.bot) for privacy questions and [support@klex.bot](mailto:support@klex.bot) for service support.

This notice covers the public Klex website and Klex Cloud. It does not cover stagewise IDE. Website visitors and signed-in Cloud users are subject to different processing, as explained below.

The [Klex Cloud Terms of Service](/legal/terms/2026-11-04) govern the service agreement. This notice is not a contract amendment or consent to processing. For personal data processed on a customer's instructions in hosted agents, memory, files or Klex Machines, the applicable processing agreement governs our role. The customer determines its own purposes and may provide its own notice. Depending on the arrangement, we may act as processor or subprocessor. We do not use customer-instructed hosting as permission for unrelated use of that data.

## 2. What we process and where it comes from

We receive information from you, your organization, providers you connect, payment and support communications, and the operation of the service. An organization may supply your invitation, membership, role and business contact details. Connected services supply data within the permissions granted for the connection. Where we obtain personal data about you indirectly for our own purposes, applicable source and processing information must be supplied within the legally required period, including by the first communication or disclosure where required. Contact privacy@klex.bot to ask about the source of information concerning you.

| Activity | Information involved |
| --- | --- |
| Accounts and authentication | Name, email address, account identifiers, verification state, organization membership and roles, timestamps, authentication-provider information and credentials required for the selected sign-in method. Sessions may include IP address, user agent and active organization. |
| Billing | Billing/contact and tax details, payment-provider references, purchases, balance, invoices and metered resource usage. Stripe performs payment functions. Saving a payment method and enabling automatic top-up are separate actions. |
| Security and abuse prevention | Network and request metadata, security events, account/session references, pseudonymous rate-limit subjects and permitted audit metadata. Automated checks of email addresses, domains, IP addresses and abuse signals can block registration or lead to account suspension, including with Cloudflare's assistance. Pseudonymous identifiers remain personal data when linkable. |
| Support, contract notices and privacy requests | Contact details, correspondence, attachments, relevant contract references, receipt and response records, and other information you choose to supply. We receive requests through support and privacy communications and any applicable service controls. Receipt of a declaration does not itself verify identity, authority or entitlement. Avoid sending passwords, API keys or unnecessary sensitive content. Intercom supports communications where used. |
| Internal CRM and service coordination | Contact and account identifiers, organization/workspace details and limited lifecycle or usage information, such as member or agent counts and relevant timestamps, synchronized to Attio. Relevant support and issue information may also be handled through Slack for internal communications and Linear for product issue management. |
| Cloud frontend analytics | Account identifiers, pseudonymous organization keys, allowlisted usage events, route templates and limited browser, device and session metadata about use of the Cloud interface, collected through the PostHog SDK and a relay. The relay truncates the forwarded IP address. The event schema excludes names, emails, free-text event properties and raw page URLs. Session replay and autocapture are disabled. These analytics are pseudonymous, not anonymous. |
| Cloud organization analytics | Server-side events about an organization's use of Cloud, such as Bot lifecycle and integration activity, with pseudonymous organization keys and relevant user, Bot, resource or work-item identifiers. These events are governed by a separate organization-level setting and do not depend on the browser analytics SDK. They can remain linkable to people and are not anonymous. |
| Website analytics | A fresh random identifier for each document load, pageview events and filtered click events sent directly through the PostHog SDK. Click events retain structural element information rather than text, element attributes or link URLs. Sent properties exclude raw page URLs and use a fixed landing-page path. No Cloud account identity is attached, no persistent tracking identifier is stored, and session replay is disabled. Although IP/geolocation processing is suppressed in event properties, the direct request exposes network and browser-request metadata to PostHog. We do not describe this flow as anonymous. |
| Email communications | Name, email address, account identifier, mailing preferences, subscription changes and limited lifecycle events, such as account, organization or Bot creation, synchronized to Loops. We use this information for subscribed product updates, onboarding or lifecycle messages, and promotional communications. Loops records email sending, delivery, bounces, subscription preferences and unsubscribes. Email open-tracking pixels and recipient-level link-click tracking are disabled. Necessary service messages are distinct from optional marketing. |
| Diagnostics | Performance/navigation and API measurements, ephemeral browser-session metadata, errors and stack traces through Grafana Cloud. Filtering removes certain URL secrets, but identifying path segments, error text and other context can remain. We do not claim all sensitive content is automatically removed. |
| Enabled voice connections | Call audio, room and participant information, browser-call display names and necessary network/connection metadata processed through LiveKit for browser-to-Bot calls and Discord voice connections. Customer-instructed communications remain governed by the DPA. |
| Requested workloads and authorized debugging | Instructions, content, memory, files, configuration, credentials and workload state needed for hosted functions and connected providers. This is generally processed on the customer's instructions rather than for our independent analytics purposes. Temporary support debugging can involve necessary excerpts of internal bot data, which may contain sensitive information, under the access conditions below. |

Access to internal bot data through our support, issue-management and AI development tools occurs only for temporary debugging in connection with a support request and with the customer's agreement. Such access is logged. Our own Klex Bots may analyze Grafana Cloud debug traces using the AI model providers identified below. This remains subject to the same customer agreement, access logging and purpose limits. It is not routine access for independent product research or model training. We limit the information shared to what is necessary for the agreed investigation and apply the relevant processing agreement and safeguards. This does not change separate, lawfully required security or legal processing described in this notice.

Authentication methods and security checks depend on the method you use and the service configuration. Where enabled, Cloudflare Turnstile processes browser/request information for anti-bot verification. Registration checks can query the email domain through DNS. Supported password-setting checks send only the first five characters of a SHA-1 password hash to the Pwned Passwords service, not the password, full hash or email address. The query comes from our server, not directly from your browser. The SHA-1 prefix describes that breach check, not the format used to store your password. These controls are separate from product analytics.

If the session-location feature is enabled, session security records can include country and IP-derived estimated latitude and longitude supplied through verified Cloudflare metadata. This is not a request for your device's GPS location. It must not be confused with the separate analytics flows described above.

Providing information needed for authentication, billing or a requested function is necessary to supply that function. If you do not provide it, the function or purchase may not be available. Optional information is not required merely because an account exists.

## 3. Purposes and legal bases

Where the GDPR applies, we use the following bases according to the actual relationship and processing activity:

| Purpose | Basis and relevant interests |
| --- | --- |
| Provide accounts and services requested by an individual customer | Contract necessity under Article 6(1)(b), to the extent the processing is necessary for that individual's contract or requested pre-contract steps. |
| Administer an organization's access and cooperate with its authorized users | Legitimate interests under Article 6(1)(f) in supplying and administering the organization's service, subject to necessity and balancing. The organization's contract does not automatically make every employee a party to it. |
| Process payments and maintain required financial records | Contract necessity where applicable and Article 6(1)(c) for applicable accounting, tax and other legal duties. |
| Protect accounts and service integrity, prevent abuse and establish or defend claims | Legitimate interests in secure operation, fraud/abuse prevention and legal protection, subject to proportionality, or an applicable specific legal duty. |
| Handle support, contract notices, privacy requests and account communications | Contract necessity where applicable, legitimate interests in resolving requests, preserving evidence and maintaining the customer relationship, and applicable legal duties to receive declarations, provide acknowledgments and handle statutory rights. A declaration may be made without continued account access. Proportionate identity and authority review precedes disclosure or changes affecting a customer. |
| Internal CRM | Legitimate interests under Article 6(1)(f) in managing business contacts and customer relationships, subject to necessity and balancing. |
| Website analytics, Cloud frontend analytics and Cloud organization analytics | Legitimate interests under Article 6(1)(f) in understanding website interactions, improving the Cloud interface and understanding organization-level service use, respectively, subject to necessity, balancing and applicable device-access rules. The flows and controls differ as described in sections 2 and 7. Terms acceptance is not analytics consent. |
| Optional product updates, lifecycle campaigns and promotional emails | Consent under Article 6(1)(a) within the scope of the subscription you give. An earlier product's email permission applies only to the extent it covers the sender and messages concerned. Necessary account, security, billing and support messages use the applicable service, legitimate-interest or legal-duty basis described above, not marketing permission. |
| Operational diagnostics | Legitimate interests in detecting failures, maintaining security and supplying a reliable service, with appropriate minimization; customer-instructed processing remains governed by its processing arrangement. |

If an activity requires consent, including under applicable rules on storing or accessing information on your device, that consent must be obtained separately before the activity. You may withdraw consent prospectively without affecting the lawfulness of earlier processing. A legitimate interest under the GDPR does not itself establish an exemption from device-access consent rules.

We do not use Customer Content to train models or independently reuse hosted-agent content or memory. Hosting, storing and routing data to provide the customer's requested service are necessary service operations. Customer-selected model providers' own practices and settings are separate.

## 4. Who receives information

Authorized staff and service providers receive information only for the relevant purposes and subject to applicable access restrictions and legal arrangements. Our providers include:

| Provider | Purpose |
| --- | --- |
| Amazon Web Services EMEA SARL | Hosting, compute, storage, database and supporting infrastructure; service communications through AWS SES. |
| Cloudflare, Inc. | Website/service proxying, DNS and security functions, including Turnstile anti-bot verification and session-location metadata where enabled; Zero Trust for internal administration. |
| PostHog Inc. | EU-hosted product and website analytics through their distinct collection paths. |
| Raintank, Inc., doing business as Grafana Labs | EU-hosted operational telemetry and error analytics. |
| Attio Limited | Internal customer relationship management. |
| Astrodon Corporation, doing business as Loops | Email contact and preference synchronization, lifecycle-triggered communications, subscribed campaigns, sending and delivery records, bounces and unsubscribes. |
| Intercom R&D Unlimited Company | Support and privacy-request communications. |
| Slack | Internal communications and support coordination, including necessary internal bot information only for the agreed, temporary debugging described above. |
| Linear | Product issue management and support-related fixes, including necessary internal bot information only for the agreed, temporary debugging described above. |
| Google Cloud, Microsoft Azure, Anthropic and OpenAI | AI-assisted development and troubleshooting. Customer-controlled internal bot information is shared only for the agreed, temporary debugging described above, not as a general development or training dataset. |
| Vanta | Compliance management and supporting evidence, which may include relevant business contacts and personnel information. Its use does not authorize unrelated reuse of customer workload data. |
| Stripe | Payment, billing and associated fraud/tax functions, with roles depending on the service. |
| LiveKit Incorporated | Realtime media transport and signaling for enabled browser-to-Bot calls and Discord voice connections. Media routing and project metadata residency are distinct; this does not imply Germany-only processing or use of unrelated recording, voice-cloning or inference features. |
| Pwned Passwords service | Server-side checks for compromised passwords where supported password-setting checks are enabled, using the minimized query described above. |

The [Data Processing Agreement](/legal/data-processing-agreement/2026-11-04) identifies the subprocessors used for customer-instructed personal-data processing. Not every provider of our own analytics, CRM or billing functions is a customer-content subprocessor. Support attachments and diagnostic context can contain customer personal data, so those flows need the applicable protections too.

When you connect a model provider or integration, the relevant instructions, content, tool inputs/outputs and credentials can be transmitted as needed for that connection. Who pays the provider does not determine its legal role. Its own terms and processing practices may also apply.

We may disclose information to professional advisers, authorities or others where required or permitted by applicable law, limited to the necessary purpose and scope. A business transfer does not remove applicable data-protection duties or independently authorize unrelated use.

## 5. International processing

We prefer EU hosting where available, but do not promise EU-only storage, access or processing. AWS hosting is in Germany, and PostHog Cloud and Grafana Cloud use EU hosting. Loops is operated by a US provider, and its privacy notice describes processing in the United States. Intercom's default hosting and Linear's primary processing operations are also in the United States; service-specific regional arrangements can differ. Attio and other international providers use onward providers outside the EU/EEA. Support and administrative access can involve additional countries even when primary storage is in the EU.

For restricted transfers not covered by an applicable adequacy decision, the contractual safeguard we rely on is the European Commission's Standard Contractual Clauses incorporated into the relevant provider's data-processing terms, with any required supplementary measures. These arrangements are described, for example, in the [AWS GDPR information](https://aws.amazon.com/compliance/gdpr-center/), [Attio Data Processing Addendum](https://attio.com/legal/attio-data-processing-addendum), [PostHog DPA](https://posthog.com/dpa), [Intercom DPA](https://www.intercom.com/legal/data-processing-agreement), [Linear DPA](https://linear.app/dpa) and [Vanta DPA](https://www.vanta.com/legal/dpa). A provider's published terms do not by themselves establish coverage of every service or onward transfer.

For transfers to a US recipient covered by a valid EU–US Data Privacy Framework certification and the applicable adequacy decision, that framework can instead provide the transfer basis. PostHog, Intercom and Loops publish framework-related disclosures. We rely on that basis only where the recipient's certification and the data concerned are covered, not merely because a provider mentions the framework. EU hosting does not exclude overseas access.

Contact [privacy@klex.bot](mailto:privacy@klex.bot) for information about the countries and safeguards applicable to your data and a copy of relevant safeguards, subject to lawful redactions. Provider-specific locations and arrangements must be maintained with the relevant disclosures and processing agreements.

## 6. Retention and deletion

We retain information only for a justified purpose and applicable period. Closing an account, stopping execution and deleting stored data are separate operations.

- PostHog analytics data is retained for 30 days.
- General Grafana telemetry/error data is retained for up to 90 days. Full-content Bot debug traces follow the DPA's separate maximum of 30 days and can be deleted earlier on request; the general telemetry period does not extend that limit.
- Account and authentication records are retained while needed to operate your active account and authorized sessions. After closure, the criteria are whether a record is still necessary to complete a requested return/deletion, meet an identified legal duty, investigate an unresolved security incident or establish, exercise or defend a specific claim within the applicable limitation period. Only the information needed for that remaining purpose may be kept. Expiry or revocation of a session is not necessarily physical deletion of every associated record.
- Attio and Loops contact records associated with a deleted Klex user account are deleted within 30 days after account deletion. This does not mean deletion is instantaneous or that required financial, support or other records elsewhere are erased at the same time. Necessary subscription evidence and objection or suppression records may be retained separately only for the applicable compliance or specific claims purpose, not to continue marketing after an objection.
- Contract declarations and receipt and response evidence are retained only for the applicable contract, legal-duty or specific claims purpose. Account deletion does not automatically erase that evidence. Access is limited to the handling and evidence purpose; database protection against ordinary editing is not authority for indefinite retention. A reviewed retention or erasure decision must distinguish original evidence from unrelated operational data.
- Routine support records held for our own controller purposes are deleted 24 months after the request is resolved or the last substantive interaction, whichever is later. A specifically justified legal duty, dispute or hold may require a limited record for longer. A valid erasure request may require earlier action. This is our support-retention policy, not a period inferred from the support provider's default settings.
- Financial records are retained for applicable accounting and tax duties. Under German AO section 147 and HGB section 257, this generally means eight years for accounting vouchers, ten years for books, inventories and financial statements, and six years for covered business correspondence. The period normally starts at the end of the relevant calendar year. Applicable exceptions or an unresolved tax matter can require longer retention. Necessary claim records may have a separate justified claim or legal-hold period. These rules do not justify retaining unrelated live account or workload data.
- Security records are retained according to whether an alert or incident remains under investigation, whether the record is necessary for remediation or prevention of the identified threat, or whether an identified legal duty or claim requires it. Once those purposes end, the record must be deleted or irreversibly anonymized. A general possibility of future abuse does not justify indefinite identifiable retention. Where session-location records are used, their configured validity is limited to the linked session's validity and at most 30 days after capture, after which they are scheduled for deletion. Validity expiry is not the same as immediate physical erasure of every copy. Account deletion does not automatically erase audit references. Linkable IDs remain personal data.
- Customer-instructed content and state, including support or diagnostic copies processed on a customer's instructions, follow the agreed service lifecycle, applicable processing agreement and mandatory retrieval, switching and deletion rights. Controller-side retention periods do not authorize a minimum retention period for such instructed data. A depleted balance or paused Machine does not itself erase content. Under the [Service and billing conditions](/legal/service-and-billing/2026-11-04), deletion solely because of exhausted credits may occur only after at least 30 consecutive days without available credits. It is discretionary after that minimum, not an automatic deletion schedule. Customer-requested deletion, longer agreed retention and mandatory legal duties remain applicable.

Residual backup copies are limited to recovery and protection until removal under the applicable backup-deletion cycle, unless a specific legal requirement justifies retention. For Customer Personal Data processed on instructions, the DPA's deletion deadlines also apply to backups and copies within our processing chain; a backup cycle does not extend those deadlines. They must not be returned to ordinary use for an unrelated purpose. If a backup is restored, applicable deletion instructions must be reapplied before affected data returns to ordinary use. Information subject to a justified hold must be restricted to that purpose and deleted when the need ends. The PostHog and Grafana retention periods must not be read as a promise that all customer, support, financial or backup data disappears within those periods.

## 7. Device access and choices

Authentication and security functions may store or access information needed for their purpose. Website analytics and Cloud frontend analytics use separately configured PostHog SDKs with identifiers held in memory rather than persistent tracking storage. Cloud organization analytics are sent from our servers. These flows can involve personal data even without persistent tracking cookies. Device-access rules apply separately from the GDPR legal basis; memory-only operation and an opt-out do not themselves establish an exemption from prior consent requirements.

You can object to Cloud frontend analytics through Account settings. Cloud stores your objection flag locally to honor it, without a tracking identifier in that flag. Global Privacy Control and Do Not Track signals disable Cloud frontend analytics and website analytics. These browser controls do not disable server-side Cloud organization analytics, which have a separate organization-level setting, or the separately configured Grafana diagnostics, authentication and security processing. You may object to personal-data processing in any of these flows as explained below; the browser setting is not the only way to exercise your rights.

You can change email categories in your user profile and use the unsubscribe or preference link in an optional email. Unsubscribing from optional emails does not stop necessary account, security, billing or legal notices. For assistance with your choices, contact [privacy@klex.bot](mailto:privacy@klex.bot).

Where consent is required, it must be obtained separately before the relevant activity. You may withdraw consent or object to legitimate-interest processing as explained below. General Terms agreement is not marketing consent, and this notice does not itself supply consent for analytics or device access.

## 8. Your rights

Under applicable law and its conditions, you may request access, correction, erasure, restriction and portability of your personal data. Where processing is based on consent, you may withdraw it without affecting the lawfulness of earlier processing. You also have the GDPR right not to be subject to a solely automated decision producing legal or similarly significant effects, subject to the statutory exceptions and safeguards, including human intervention and an opportunity to express your view and contest a decision where applicable. Our automated security checks can block account creation or lead to suspension as described in section 2. Contact [support@klex.bot](mailto:support@klex.bot) if you believe a block or suspension is mistaken or to request review. Stripe performs its own payment and fraud checks under the arrangements applicable to its services. Whether a particular decision falls within Article 22 depends on its effects and the actual decision process; the use of a provider does not remove applicable safeguards.

### Your right to object

You may object to processing based on legitimate interests on grounds relating to your particular situation. We must stop that processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or need the processing for legal claims. You may object at any time to processing for direct marketing, including related profiling, and we must stop that use. The product-analytics opt-out described above does not require you to give a reason.

Contact [privacy@klex.bot](mailto:privacy@klex.bot). We may request proportionate information needed to verify your identity or authority. GDPR requests are ordinarily free of charge and answered without undue delay and within one month. Where complexity or the number of requests justifies an extension, we will notify you and explain it within that month; the permitted extension is up to two further months. If we do not act on a request, we will explain the reason and available complaint and judicial remedies as required by law. Different applicable local deadlines remain preserved. A justified legal duty or other lawful exception can require retention of some information, but does not justify refusing every part of a request.

For data controlled by a customer, we assist under the processing arrangement and may direct the request to that customer rather than decide its purposes ourselves. Service export, cloud switching and GDPR portability have different scopes.

You may complain to a competent supervisory authority, including where you live or work or where an alleged infringement occurred. Our relevant German authority is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen. Its contact details and complaint information are available at [ldi.nrw.de](https://www.ldi.nrw.de/).

## 9. Updates and local rights

We will keep this notice consistent with actual processing and give appropriate notice of material changes. A policy revision does not itself authorize an unrelated new purpose or replace a required consent, legal basis or contractual amendment.

Mandatory local privacy and language rights remain applicable. The GDPR legal bases above do not replace consent or other conditions required by applicable Canadian or other local law. Where such consent is required, it must be obtained in the legally required form before the relevant processing, and withdrawal must be handled under that law. This notice does not claim that every international jurisdiction has identical requirements or that an English notice alone satisfies every local requirement.