Privacy Policy
Last updated: 26 October 2026
This Privacy Policy explains how we collect, use, share, and protect personal data when you use:
the websites at celdon.io and get-noah.ai and their subdomains;
the Celdon AI web application at noah.celdon.ai; and
the related services and features (together, the "Service").
1. Who is responsible (Controller)
Celdon AG, Bahnhofplatz, 6300 Zug, Switzerland, is the controller for the processing described here.
Contact: info@celdon.ai.
As a controller established in Switzerland that offers services to people in the EU, we have appointed a representative in the European Union under Art. 27 GDPR: Celdon Analytics GmbH, Dircksenstr. 40, 10178 Berlin, Germany — info@celdon.ai. You may contact our EU representative on any data protection matter.
We have not appointed a Data Protection Officer. For any question about this Policy or your personal data, please use the contact details above.
2. The data we process
2.1 Data you give us
Account and identity data: email address, first and last name, locale/language preference, and any role or persona you set. For organisation accounts we also store your membership of an organisation and your role within it.
Content you submit: the messages you send to the assistant, your conversation history, and the files you upload (for example CSV, XLSX, and XLS spreadsheets) together with the data extracted from them. These files may themselves contain personal data about third parties (for example, data about your own customers or employees) — see section 7 on your responsibilities as a controller.
Feedback: ratings (thumbs up/down) and categories you provide about the assistant's responses.
Billing data: your subscription tier and status, and the identifiers needed to link your account to our payment processor. Payments are collected by Stripe Payments Europe, Ltd. (Ireland), acting as merchant of record on behalf of Celdon AG. We do not receive or store your card or payment-instrument details — these are handled directly by Stripe.
Contact and scheduling data (marketing website): if you request test access to the Service or book a demo through celdon.ai or get-noah.ai, we process the details you submit — typically your name, email address, and any scheduling information.
2.2 Data generated through your use
Authentication data: one-time passcodes (OTPs) sent to your email, and session/refresh tokens.
Usage and quota data: AI token consumption, number of processes run and files uploaded, and related metering used to enforce plan limits and (where enabled) billing.
Technical and usage data: data observed automatically when you use the Service, including your IP address, device and browser type, operating system, approximate location derived from your IP (such as city/region/country), and records of your interaction with the Service. This is collected through our content-delivery network and server logs for the purpose of delivering, securing, and operating the Service — not for advertising or cross-site tracking.
AI request traces: records of requests sent to the AI models, used to operate, debug, and monitor quality (see section 5 on Langfuse).
2.3 Do you have to provide your data?
You are not legally obliged to give us any personal data. However, we need your email address and name to create an account, and your content to perform the tasks you ask for; without them, we cannot provide the Service. Billing details are needed only for paid plans. Information on the website contact and booking forms is voluntary, but we cannot answer your request without it.
3. Why we process it, and the legal basis
Purpose | Legal basis (GDPR Art. 6) |
|---|---|
Creating and managing your account; providing the chat, process, and extraction features | Performance of a contract — Art. 6(1)(b); for authorised users within a customer organisation (who are not themselves our contracting party), our legitimate interest in providing the Service to that organisation — Art. 6(1)(f) |
Handling test-access requests and demo bookings from the website | Taking steps at your request before entering a contract — Art. 6(1)(b); our legitimate interest in responding to enquiries — Art. 6(1)(f) |
Processing your messages and uploaded files through AI models to produce answers and run processes | Performance of a contract — Art. 6(1)(b) |
Sending OTP login emails and maintaining sessions | Performance of a contract / our legitimate interest in account security — Art. 6(1)(b), (f) |
Processing payments and managing subscriptions (where billing is enabled) | Performance of a contract — Art. 6(1)(b); compliance with legal retention duties — Art. 6(1)(c) |
Metering usage and enforcing plan limits | Performance of a contract — Art. 6(1)(b) |
Detecting the language of your messages to provide responses in the right language | Performance of a contract — Art. 6(1)(b) |
Operating, monitoring, securing, and improving the Service (including AI request tracing and quality review) | Our legitimate interest in a reliable, secure, high-quality service — Art. 6(1)(f) |
Handling your feedback | Our legitimate interest in improving the Service — Art. 6(1)(f) |
Where we rely on legitimate interests, you may object as described in section 8.
4. AI processing
A core function of the Service is to process your messages and uploaded files using large language models to generate answers, run finance processes, and extract structured data. We use Anthropic Claude models and Amazon Titan embeddings, hosted within Amazon Web Services (AWS) Bedrock in EU regions. We use Bedrock's EU cross-region inference, which may route a request across AWS data centres in several EU countries (such as Germany, Ireland, and France) to balance load; processing remains within the EU. Because the models run inside our AWS environment via Bedrock, your content is not sent to Anthropic as a separate recipient, and — per AWS Bedrock's terms — is not used to train the underlying models.
The assistant generates outputs, but a person always remains in control: you review its output and decide how to use it. It does not make decisions about you by purely automated means that produce legal or similarly significant effects within the meaning of Art. 22 GDPR.
When you use Celdon through the ChatGPT app, the messages and files you send and the results we return are additionally processed by OpenAI as part of operating ChatGPT, under OpenAI's own terms and privacy policy. In that case the EU-only processing described above applies to the processing within our own environment; the ChatGPT layer itself is operated by OpenAI and may involve processing in the United States — see sections 5 and 6.
5. Who we share data with (recipients / processors)
Processors. The following service providers process personal data on our behalf, bound by our instructions and data processing agreements:
Provider | Role | Location of processing |
|---|---|---|
Amazon Web Services (hosting, S3 file storage, PostgreSQL database, Bedrock AI models, Amazon Titan embeddings, Amazon Comprehend language detection, Amazon SES for sending OTP emails) | Infrastructure, storage, AI processing, transactional email | EU regions (primary region Frankfurt; Bedrock cross-region inference may route AI requests across other EU regions) |
Amazon CloudFront (AWS) — serves the static web app and marketing site | Content delivery; processes connection/technical data (such as IP) at edge locations, not customer content | Global edge network |
Other recipients. The following recipients receive personal data for the purposes described, but are not our processors:
Recipient | Purpose and role | Location |
|---|---|---|
Stripe Payments Europe, Ltd. (Ireland) | Acts as merchant of record on behalf of Celdon AG, handling payment processing, subscription and metered billing. Stripe processes payment data as an independent controller — in particular to process payments, prevent fraud, and meet its own legal obligations (e.g. anti-money-laundering) — under its own privacy policy | EU (Ireland); Stripe may transfer some data to Stripe, Inc. (US) — see §6 |
OpenAI (OpenAI, L.L.C. / OpenAI Ireland Ltd.) | Operates ChatGPT and the Celdon app platform. If you use Celdon inside ChatGPT, the messages and files you send to the app, and the results we return, are processed by OpenAI as part of running ChatGPT. OpenAI acts as an independent controller for its ChatGPT service, under its own privacy policy | United States / global — see §6 |
We also use Langfuse for AI request tracing and quality monitoring. Our Langfuse instance is self-hosted on our own Celdon infrastructure in the EU (AWS) (not a third-party cloud service), so these traces — which can include the content of your messages — stay within our own EU environment.
Beyond these recipients, we disclose personal data only where required by law, to protect our rights, or in connection with a corporate transaction, and always within the limits of the law.
6. International transfers
Your account, content, uploaded files, and AI processing are processed within the European Union (AWS EU regions). Two elements involve processing or transfer outside the EU/EEA:
Content delivery (Amazon CloudFront): the static web app and marketing site are served through a global edge network, which processes limited connection/technical data (such as your IP address) at the edge location nearest you, which may be outside the EU. This is covered by our data processing terms with AWS and the EU Standard Contractual Clauses.
Payments (Stripe): our payment processor is Stripe Payments Europe, Ltd. (Ireland); Stripe may transfer some payment-related data to Stripe, Inc. in the United States, relying on the EU Standard Contractual Clauses (and, where applicable, the EU–US Data Privacy Framework).
ChatGPT app (OpenAI): if you choose to use Celdon through the ChatGPT app, the messages and files you send and the results we return are processed by OpenAI as part of operating ChatGPT, which may involve processing in the United States. This processing takes place on OpenAI's platform under OpenAI's own terms and safeguards, before data reaches, and after it leaves, our EU environment. Using the ChatGPT app is optional; you can use the Service entirely within the EU through our web application at noah.celdon.ai instead.
Except for the optional ChatGPT app described above, we do not route your uploaded files or chat content through CloudFront — these go to our EU backend directly.
7. Your data in uploaded files
The spreadsheets and documents you upload may contain personal data about other people. For that data, you (or your organisation) are the controller and we act as your processor, processing it only to provide the Service and on your instructions. This processing is governed by our Data Processing Agreement (available at https://celdon.io/dpa), which forms part of your agreement with us.
8. Your rights
Subject to the conditions in the GDPR, you have the right to:
access the personal data we hold about you;
have inaccurate data corrected;
have your data erased;
restrict or object to processing (including processing based on our legitimate interests);
receive your data in a portable format; and
withdraw any consent you have given, without affecting processing already carried out.
To exercise these rights, contact us at info@celdon.ai. You also have the right to lodge a complaint with a supervisory authority. If you are in the EU/EEA, you may complain to the authority in the country where you live or work. In Switzerland, the competent authority is the Federal Data Protection and Information Commissioner (FDPIC).
8.1 Users in Switzerland
If you are in Switzerland, the Swiss Federal Act on Data Protection (FADP) applies. Within its limits, you can ask us for information about the data we hold on you, have incorrect data corrected, receive your data in a transferable format, and ask us to stop processing it or to delete it. Send requests to info@celdon.ai.
In line with Art. 19 FADP, we inform you that personal data may be disclosed to recipients abroad: to the United States (our payment processor's US affiliate; and OpenAI, if you use the optional ChatGPT app) and, through our global content-delivery network, to edge locations in various countries. These disclosures are safeguarded by the Standard Contractual Clauses and, where applicable, the EU–US / Swiss–US Data Privacy Framework.
8.2 Users in Brazil (LGPD)
If you are in Brazil, the Lei Geral de Proteção de Dados applies. You may ask us to confirm whether we process your data; access it; correct incomplete or outdated data; anonymise, block, or delete unnecessary or non-compliant data; obtain information about the third parties we share it with; port it to another provider; and delete data processed on the basis of your consent. You may withdraw consent at any time and lodge a complaint with the ANPD. Requests can be made at info@celdon.ai.
8.3 Users in the United States
This section applies if you are a resident of a US state with a comprehensive privacy law (for example California, Virginia, Colorado, Connecticut, Texas, Oregon, and others). We do not sell or share your personal information, and we do not use it for targeted advertising or profiling. Subject to your state's law, you have the right to know and access the personal information we hold, to correct it, to delete it, to obtain a portable copy, and not to be discriminated against for exercising these rights. California residents may also request that we limit the use of sensitive personal information to what is necessary to provide the Service. To exercise these rights, contact us at info@celdon.ai; we will verify your identity before responding. Because we do not sell or share personal information, there is no opt-out of sale/sharing to honour, and we will respect a Global Privacy Control signal consistent with that position.
If we decline a rights request, you may appeal that decision by replying to our response or writing to info@celdon.ai. We will review the appeal and inform you of the outcome within the period your state's law requires; where your state provides for it, we will also tell you how to contact your state Attorney General if you remain dissatisfied.
8.4 Users in other countries
The protections described in this Policy are our global baseline and apply wherever you use the Service. If your country has its own data protection law, you may have additional rights under it — for example to access, correct, delete, or port your personal data, to object to or restrict certain processing, or to lodge a complaint with your national data protection authority. To exercise any of these rights, contact us at info@celdon.ai, and we will respond as that law requires.
9. Retention
We keep personal data only as long as needed for the purposes above:
Account and content data: for as long as your account is active, and then deleted or anonymised within a reasonable period after closure.
Billing and transaction records: retained for the periods required by applicable commercial and tax law. As Celdon AG is the contracting seller, established in Switzerland, Art. 958f of the Swiss Code of Obligations applies (generally 10 years).
Logs and AI traces: retained for a reasonable period for security and troubleshooting.
OTPs: valid for 5 minutes and then invalidated.
10. Cookies and local storage
The Service uses only strictly necessary cookies and browser storage — there is no advertising, analytics, or cross-site tracking. Specifically:
a session cookie and a refresh-token cookie that keep you logged in; and
browser local/session storage holding your language preference and short-lived interface state.
Because these are strictly necessary to provide a service you have requested, they do not require consent under the ePrivacy rules and the German TDDDG (the renamed TTDSG, in force since May 2024).
11. Security
We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls, and hosting within the EU. No system is perfectly secure, but we work to protect your data and will meet our legal obligations in the event of a data breach.
12. Children
The Service is not intended for, or directed at, anyone who is not an adult under the law that applies to them, and we do not knowingly collect their data.
13. Changes to this Policy
We may update this Policy from time to time. We will post the updated version here with a new "last updated" date and, where the law requires, notify you in advance.
14. Contact
Questions about this Policy or your data: Celdon AG, Bahnhofplatz, 6300 Zug, Switzerland — info@celdon.ai.