This is version 2026-10-02. The current version is at /privacy/.
How we use your data
Version 2026-10-02. Effective date: 2026-10-02.
This notice explains what Kalst does with your information when you visit kalst.com, use your Kalst dashboard, or connect another service to Kalst.
Who we are
The controller of your information is FLON OLSEN (ENK), which runs Kalst.
Kalst is run by FLON OLSEN (ENK), org. no. 922 312 109, Skåreråsen 16, 1473 Lørenskog, Norway.
Write to support@kalst.com with any privacy question or request.
If you bought from a Kalst store
The store you bought from publishes its own privacy notice, and the creator who runs it decides what happens to your information. Kalst runs the software for that creator, on their behalf.
To reach the creator, use the contact on their store. You can also write to support@kalst.com with the store's address and the email you bought with, and we will pass your request on.
What we collect
Your account: your email address, your name if you give one, and a protected form of your password. We never store the password itself.
Your store: what you put in it, such as its text, prices, files and settings.
Your sales: what was bought, what was paid, when, and by which buyer email.
Payouts: the details Stripe needs to pay you go to Stripe, not to us.
Conversations: the messages between your buyers and your AI Seller.
Technical records: the ordinary record a web server keeps of a request, used to serve pages, keep the service running and look into abuse.
We never receive or store card numbers, yours or your buyers'.
Chats with the Seller
A store can let the Seller answer its buyers in the store chat and in Instagram DMs, comments and story replies.
To write a reply, we send the buyer's message and the parts of the store it answers from through Cloudflare AI Gateway to OpenAI. OpenAI writes the reply as our processor.
Each message and each reply is checked for harmful content before it is used.
Cloudflare Workers AI turns a store's content into a search index, so the Seller can find the right answer. Workers AI is also our processor.
Every reply carries a tag that says it is AI.
The creator can read every conversation in their inbox and take it over.
If a store connects Instagram, Meta sends us those messages under Meta's own terms.
Conversations are kept for 12 months, then deleted. A creator can choose a shorter time.
AI assistants that read a store
When a store is published and open to search engines, we share its public catalog with ChatGPT, Perplexity and Google's shopping services, so they can find its products.
Any AI assistant can also read that public catalog through the store's own connection point.
The catalog holds only what any visitor can already see: product names, descriptions, prices, images and links. It never holds buyer data or drafts.
A creator stops this by turning off search indexing in the store's settings.
Insights from your niche
We count themes across many stores in one niche, such as common questions and objections, and show each creator what their niche asks.
We never share conversation text, buyer identities or store names. A theme shows only when enough stores stand behind it.
A creator can opt out in the store's settings. A store that opts out adds nothing and sees nothing.
How to opt out
Creators: turn off search indexing to leave the assistant feeds, and turn off niche insights in your store's settings. You can pause the Seller at any time.
Buyers: ask the store's creator, or write to support@kalst.com, to stop the use of your information or to delete it.
A store's advertising pixels run only after the buyer agrees.
Who else sees your data
Kalst uses these companies to run the service.
Stripe, to take payments for creators and to bill Kalst plans.
Cloudflare, to serve the site, run the software and hold files, and through Cloudflare AI Gateway and Workers AI to run the Seller.
OpenAI, to write the Seller's replies, reached through Cloudflare AI Gateway.
Resend, to send the emails the service has to send, such as a receipt or a download link.
Google, Microsoft, Zoom or Apple, only if you connect your calendar, and only to do what you connected them for.
Supabase, to hold the database.
We do not sell your information, and we do not share it for anyone's advertising.
Some of these companies hold information outside Norway and the EEA.
For each company that holds information outside the EEA, the transfer rests on the EU Standard Contractual Clauses.
Where that company is certified under the EU-US Data Privacy Framework, the transfer also rests on that framework.
Google user data
If you sell sessions, you can connect your Google Calendar so that a booking lands in your calendar with a Google Meet link, and so that nobody can book a time you are already busy. Connecting is your choice, and Kalst works without it.
When you connect, Google asks you to grant Kalst exactly two permissions.
See your availability (calendar.freebusy): we ask Google whether a given time is busy or free. Google answers with busy or free and nothing else. We never receive the title, the guests, the location, the notes, or any other content of your existing events.
See, create, change and delete events on calendars you own (calendar.events.owned): we create the event for a booking, put the Google Meet link on it, change it if the session is moved, and remove it if the session is cancelled. We act only on events Kalst created.
We ask for no other Google permission. We do not read your mail, your contacts, your files, or your Drive, and we do not ask for permission to.
What we keep: the connection Google gives us, stored encrypted, the calendar you chose, and the identifier of each event we created, so that we can change or cancel that event later. We do not keep a copy of your calendar, and we do not keep the busy or free answers after we have used them to show your availability.
What we never do with it: we do not sell it, we do not transfer it to anyone for their own purposes, we do not use it for advertising of any kind, and we do not use it to train artificial-intelligence or machine-learning models. No person at Kalst reads your Google data, except where you have asked us to look at something to help you, where it is necessary to investigate abuse or a security problem, or where the law requires it.
Kalst's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Google API Services User Data PolicyHow to disconnect: open your Kalst dashboard, go to your calendar settings, and disconnect Google. You can also revoke Kalst's access from your Google Account at any time, and it takes effect at once either way.
Manage apps connected to your Google AccountWhen you disconnect, we delete the stored connection, and Kalst can no longer read or write anything in your calendar. Events we already created stay in your calendar, because they are your sessions with your clients and removing them would cancel real appointments. You can delete any of them yourself in Google Calendar.
Microsoft, Zoom and Apple calendars
The same rules apply to every other service you connect, and each connection is separate and optional.
Microsoft (Outlook, Microsoft 365): we ask to read your busy times and to create and manage the events Kalst creates, including a Teams link on them. We ask for no permission to your mail, your files, or your contacts.
Zoom: we ask only to create, read and remove Zoom meetings for the sessions you sell. We do not access your recordings, your chat, or your account's other meetings.
Apple Calendar: you give Kalst an app-specific password, which works only for calendar access and can be revoked from your Apple Account without changing your Apple password.
As with Google, none of it is sold, used for advertising, or used to train models, each connection is stored encrypted, and disconnecting deletes it.
How payment works
Payments run through Stripe. Card details go straight from the buyer's browser to Stripe and never pass through Kalst. Stripe tells us whether a payment succeeded and gives us a reference for it; that is all we receive, and all we store.
Stripe handles payment information under its own terms, as an independent controller of that information.
How long we keep it
Your account and your store: while your account is open. A deleted store is kept for 30 days, then deleted.
Sales records: as long as tax and business law requires.
Calendar connections: until you disconnect, or until you close your account, whichever comes first.
Conversations: 12 months, or less if the creator chooses.
Technical records: 90 days.
Why we may use it
Your account and store, payments and billing, the Seller, and the emails the service sends: we need them to perform our contract with you.
Bookkeeping records: the law requires us to keep them.
Security records: Kalst's legitimate interest.
Your rights
You can ask for a copy of what we hold about you, ask us to correct it or delete it, ask us to stop using it for a purpose, or take back a consent you gave.
Send every request to support@kalst.com.
You can also complain to Datatilsynet, the Norwegian Data Protection Authority, or to the data protection authority where you live.
Keeping it safe
Traffic to and from Kalst is encrypted.
A calendar connection is stored encrypted, is never sent to a browser, and is reachable only by the part of the service that creates your bookings.
Card numbers never pass through Kalst.
Files you sell are delivered through links that expire.
Changes to this notice
When we make a material change, such as a new kind of information or a new company that handles it, we email you 30 days before it takes effect. Only a change the law forces on us takes effect sooner.
Each version is published here with its effective date.
Write to us
Questions about this notice, or about anything in it, go to support@kalst.com.
Earlier versions
Every earlier version of this notice stays readable at its own address, with the date it took effect.