Privacy and data

Your writing stays yours. Here’s exactly where it goes.

Keypop is designed for people who can’t send their writing just anywhere. Here, in plain terms, is where your writing goes, who hosts it and what we never allow ourselves to do.

Last updated: 27 October 2026 · This translation is provided for information only; the French version prevails.

On your computer

Local AI runs on your machine, even offline: your text never leaves it.

Nothing is stored

With cloud AI, your text is processed in Paris, then forgotten.

Never used for training

Neither Keypop nor its host uses your writing to train an AI.

French company and servers

JWDT LABS, a French company. Cloud AI hosted in Paris by Scaleway.

Where your writing goes

ModeWhere the text is processedStored?
Local AIOn your computerNo, nothing leaves the computer
Sovereign cloud AIIn Paris, at ScalewayNo
Voice dictationOn your computer, or in ParisNo, the audio isn’t kept

The mode is always shown in the Keypop bar and can be changed in one click. By default, Keypop chooses according to the task; you can enforce local AI at any time.

Cloud AI: in Paris, nothing stored

Your request is encrypted all the way. It goes through the Keypop relay, then Scaleway’s AI servers in Paris, and the reply comes straight back. Keypop records neither your text nor the reply, and Scaleway’s terms exclude their retention and any training.

The AI models are open models, run in France: neither Google, nor OpenAI, nor any other vendor receives your writing.

What we never do

  • Use your writing, your replies or your voice to train an AI.
  • Read your writing, even for support: we have no access to it.
  • Sell, rent or share data, or run advertising.
  • Send your writing outside the European Union.

Sovereignty

JWDT LABS is a French company, with no parent company or subsidiary outside the European Union. Scaleway is a French company. Your writing processed with cloud AI is processed in France, and nothing is transferred outside the European Union. As no text is stored, there is nothing to hand over to anyone.

Certifications. Scaleway is ISO 27001 certified and a certified health data host (HDS); its SecNumCloud qualification is in progress. If your organisation requires qualified hosting, write to us: we will look together at connecting Keypop to your infrastructure.

Your account

To create your account, we only ask for your email address. For the Pro plan, we add your company and VAT number if you provide them, and your invoices. Payment goes through Stancer, a French payment provider: your card details stay with them.

Legal basis: performance of the contract, and our accounting obligations for invoices. We don’t send newsletters without your consent.

The keypop.io website

The website sets no advertising or tracking cookies. We count visits to the home page with Umami, a cookie-free tool which we host ourselves in Europe: no data can identify you. A single technical cookie, “langue”, remembers the language you chose.

The demo and the free tools send your text to the Keypop relay in Paris, like the app’s cloud AI, without storing it.

GDPR roles and data processing agreement (DPA)

DataControllerJWDT LABS’s role
Text processed with cloud AI for a business customerThe business customerProcessor (Article 28 of the GDPR)
Text from an individual userJWDT LABSController
Account and billingJWDT LABSController

For businesses, the data processing agreement (DPA) is part of the terms and conditions. A signed version is available on request.

Subprocessors

CompanyRoleLocation
Scaleway SAS (Iliad group), FranceHosting of the Keypop relay, cloud AI, dictation and accountsFrance (Paris)
Stancer, FrancePayment for the Pro planFrance
OVHcloud, Francesupport@keypop.io email and domain namesFrance

We inform you at least 30 days before adding or replacing a subprocessor that processes your writing.

Security

  • All connections are encrypted.
  • AI access keys stay on our servers, never in the app.
  • No text in our logs: there is nothing to leak.
  • App updates are signed and verified before installation.

Retention periods

DataPeriod
Text, replies, audioNot stored
AccountAs long as your account exists; deleted on request
Invoices10 years (accounting obligation)

Your rights

You can request access to your data, its rectification, erasure or portability, or object to its processing. Write to support@keypop.io; we reply within one month. You can also lodge a complaint with the CNIL (cnil.fr).

Data controller: JWDT LABS, 20 B avenue Aristide Briand, 34170 Castelnau-le-Lez, France.

Do your IT director, DPO or procurement team have questions?

Data processing agreement (DPA), list of subprocessors, security questionnaire, data flow diagram: we’ll send them to you, and the founder answers personally.

support@keypop.io