Privacy Policy

Last updated: August 28, 2026

Scope and roles

Kaldrus provides a compliance dashboard and Chrome extension for money transfer offices in Germany. A customer office generally acts as the controller for the customer and transaction data it submits. Kaldrus processes that data to provide the contracted service. Kaldrus acts as controller for its own account administration, service security, and billing data.

Data we process

The Extension captures a supported provider page only when the user explicitly starts a capture. Depending on the page and workflow, Kaldrus processes:

• Sender, receiver, identity, address, and contact information
• Transaction amounts, fees, countries, references, and provider details
• The provider page URL and a compact text representation of relevant page and form content
• Account details, authentication records, roles, and store membership
• Risk assessments, alerts, reviews, reports, and audit records
• Technical metadata needed to secure, operate, and diagnose the service

Kaldrus does not intentionally collect general browsing history or capture unsupported websites. Kaldrus does not use submitted data for advertising or behavioral analytics.

Processing and storage

• Extension traffic is sent over HTTPS to the Kaldrus service at kaldrus.com.
• Captured content is processed by Google Cloud Vertex AI through the EU multi-region jurisdictional endpoint for structured extraction.
• Account, customer, transaction, audit, and structured analysis records are stored in the Kaldrus Supabase PostgreSQL project. New analysis records do not retain the captured provider page or full page URL.
• The Kaldrus application runs on Google Compute Engine in europe-west10 (Berlin).
• Cloudflare provides authoritative DNS only; website traffic is not proxied through Cloudflare.

Kaldrus does not sell submitted personal data or share it for advertising.

Cookies and local storage

• The public website does not currently use optional analytics or advertising cookies.
• The dashboard uses strictly necessary Supabase authentication and security cookies after login.
• The Extension does not use browser cookies. It stores connection configuration and authentication tokens in chrome.storage.local.
• Logging out clears locally stored authentication tokens. Removing the Extension clears its local storage.

Service providers

Retention and deletion

Customer and transaction records are retained according to the applicable customer contract and statutory GwG retention obligations. New analysis records do not retain raw provider-page content. Historical raw analysis records and technical logs remain subject to a separate, purpose-limited retention decision. Kaldrus is implementing an automated lifecycle with a five-year default statutory period, a ten-year maximum where another legal obligation requires it, and documented legal holds.

Until that lifecycle is deployed and verified, Kaldrus does not claim that records are deleted automatically.

Your rights and contact

Requests for access, correction, deletion, restriction, portability, or objection should normally be directed to the money transfer office responsible for the transaction. Privacy and service requests can also be sent to support@kaldrus.com.