How Celes Labs, Inc. collects, uses, and protects personal information when you use CelesChat.
Effective April 27, 2026
This Privacy Policy explains how Celes Labs, Inc. ("Celes Labs", "we", "us", "our") collects, uses, discloses, retains, and protects personal information when you use CelesChat, our websites (including https://www.celeslabs.com), and related services (together, the "Service").
Celes Labs does not sell personal information, does not share personal information for cross-context behavioral advertising, and does not use the content of your chats, files, or any AI interactions to train its own artificial-intelligence models. CelesChat's AI Features are powered by OpenAI, L.L.C. ("OpenAI"), a third-party AI service provider whose published API terms prohibit training OpenAI's foundation models on content submitted via the API. Section 3.1 describes precisely what data is sent to OpenAI, when it is sent, and how you authorize that transmission.
This Policy applies to all users of the Service. Sections 12 and 13 set out additional rights and information applicable, respectively, to residents of the European Economic Area ("EEA"), the United Kingdom, and Switzerland, and to residents of U.S. states with comprehensive consumer privacy laws.
Celes Labs, Inc. is the "data controller" for your personal data for purposes of the EU General Data Protection Regulation ("GDPR") and the UK GDPR, and the "business" for purposes of the California Consumer Privacy Act, as amended ("CCPA").
We collect information you provide to us, information we collect automatically when you use the Service, and information we receive from third parties.
Celes Labs does not operate third-party advertising-tracking software development kits that retarget you or build cross-application advertising profiles, does not use device fingerprinting for advertising or cross-application tracking, and does not deliberately collect special categories of personal data (including health, biometric, racial, religious, or political data). If such information is included in Your Content, it is because you chose to include it.
We use the information described in Section 2 for the following purposes:
CelesChat includes AI-powered features that allow you to interact with an AI assistant ("AI Features"). The AI Features are operated by OpenAI, L.L.C., a third-party AI service provider with its principal place of business at 3180 18th Street, San Francisco, CA 94110, USA. OpenAI is engaged by Celes Labs as a sub-processor under written terms that comply with the GDPR, the UK GDPR, and applicable U.S. state privacy laws. OpenAI's privacy policy is available at https://openai.com/policies/privacy-policy, and its API data-usage terms are available at https://openai.com/policies/api-data-usage-policies.
Data is transmitted to OpenAI only when you actively invoke an AI Feature — for example, by tapping the AI assistant button, replying to the AI assistant in a conversation, or including the AI-trigger word "@celes" in a message. When you do not invoke an AI Feature, no chat content, message metadata, or other personal information is transmitted to OpenAI. Celes Labs does not send your messages to OpenAI in the background, on a schedule, or for any purpose other than generating the response you have requested.
Before any data is transmitted to OpenAI for the first time, CelesChat presents an in-app consent screen that:
If you tap "Cancel," no data is transmitted to OpenAI and the AI Features remain disabled for your account. You may withdraw your permission at any time from Profile → Disable AI Features, which deactivates all AI Features and stops further transmission to OpenAI immediately. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. CelesChat will request your permission again, through the same in-app consent screen, before resuming any transmission to OpenAI.
When you invoke an AI Feature, only the text content of chat messages is transmitted to OpenAI, for the sole purpose of generating the response you have requested. Specifically:
The following data is never transmitted to OpenAI: images, photos, videos, voice notes, audio recordings, files, attachments, or any other media of any kind; your phone number; your name, profile photo, or status message; your contacts or address book; your device identifier, advertising identifier, or IP address (CelesChat proxies all OpenAI requests through its own servers, so OpenAI does not see your IP address); your message-delivery metadata; your account history; or any messages you have not specifically selected for the AI action.
Under Celes Labs's API agreement with OpenAI, OpenAI is contractually prohibited from:
These restrictions are documented in OpenAI's API data-usage policies and the data-processing addendum executed between Celes Labs and OpenAI. Celes Labs has determined that OpenAI provides protections for personal data that are equal to or greater than those Celes Labs provides under this Policy, as required by Apple App Store Review Guideline 5.1.2(i). Celes Labs monitors OpenAI's terms for changes and will notify you in-app if a material change to OpenAI's data-handling practices affects your rights under this Policy.
Celes Labs does not use Your Content, AI prompts, or AI outputs to train any artificial-intelligence model, whether operated by Celes Labs, OpenAI, or any other party. AI prompts and the AI assistant's responses are retained on Celes Labs's servers as part of your AI history, and may be cleared at any time as described in Section 8.
Celes Labs does not use automated decision-making that produces legal or similarly significant effects concerning you. Celes Labs uses automated systems to detect spam, abuse, and child sexual abuse material; decisions made by those systems are reviewable on request to [email protected].
Celes Labs does not sell personal information. We disclose personal information only in the circumstances described below:
We retain personal information only as long as necessary for the purposes described in this Policy. Standard retention periods are:
Celes Labs is headquartered in the United States, and personal information we collect is processed in the United States and in other jurisdictions where our service providers operate. When personal information is transferred from the EEA, United Kingdom, or Switzerland to a jurisdiction that has not received an adequacy decision, the transfer is protected by appropriate safeguards, which may include: the European Commission's Standard Contractual Clauses (2021 module), the UK International Data Transfer Agreement or International Data Transfer Addendum to the SCCs, and, where applicable, certification under the EU-U.S. Data Privacy Framework. A copy of the applicable safeguards is available on request at [email protected].
Celes Labs maintains administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. Current measures include:
No system can be guaranteed secure, and Celes Labs does not represent that any specific level of security will be maintained at all times.
The following controls are available through the Service:
Celes Labs does not currently offer a self-service data-export tool. You may submit a written request for a copy of the personal information associated with your account (including access, portability, or correction requests) by emailing [email protected]. Celes Labs will provide the information in a structured, commonly used format within the time required by applicable law.
To protect your privacy, Celes Labs verifies requests by confirming control of the account associated with the request, typically by sending a verification code to the phone number on file. Authorized agents may submit requests on your behalf with signed authorization and proof of identity. Celes Labs does not discriminate against users, charge additional fees, or reduce the quality of the Service in response to the exercise of any right described in this Policy.
Region-specific rights are set out in Section 12 (EEA, UK, and Switzerland) and Section 13 (U.S. states).
Celes Labs may disclose personal information in response to valid legal process, including subpoenas, court orders, and search warrants, to comply with applicable law, to enforce our Terms of Service, and to protect the rights, property, and safety of our users, Celes Labs, or the public. The standards Celes Labs applies to law-enforcement requests are set out in the Law Enforcement Guidelines.
Our policy is to notify the affected user of a request for their information before disclosure, so that the user has an opportunity to seek to narrow or challenge the request, unless notice is prohibited by law (for example, by a non-disclosure order accompanying the request) or would create a risk of imminent harm to an identifiable individual. Emergency disclosure requests are evaluated under the standards permitted by applicable law.
CelesChat is not directed to children under the age of 13, or under the applicable minimum age in your jurisdiction where that age is higher, and Celes Labs does not knowingly collect personal information from children under the applicable minimum age. If Celes Labs becomes aware that personal information has been collected from a user under the applicable minimum age, such information will be deleted promptly.
Additional protections apply to users under the age of 18: no targeted advertising (Celes Labs does not show targeted third-party advertising inside the Service), no behavioral profiling of minors, and privacy-preserving default settings. The Children's Privacy Notice provides the complete description, including the process by which parents and guardians may exercise rights on behalf of a minor.
Celes Labs may update this Policy from time to time. Where a material change is made — including, for example, when a new category of personal data is collected (such as precise geolocation for an AI Feature), when paid subscriptions are introduced, or when new processing activities are added — Celes Labs will notify users in-app at least 30 days before the change takes effect, unless a shorter notice period is required by applicable law. The "Effective" date at the top of this Policy reflects the current version, and an archive of prior versions is maintained on our website.
If you are located in the EEA, the United Kingdom, or Switzerland, you have the following rights under the GDPR and the UK GDPR with respect to your personal data:
Requests may be submitted to [email protected]. Celes Labs will respond within one month and may extend the response period by up to two additional months for complex or numerous requests, in which case it will inform you of the extension within one month of receipt.
Where Celes Labs relies on legitimate interests as a legal basis — for example, to operate abuse and fraud detection, analyze pseudonymized performance data, and maintain reliability — Celes Labs has considered the balance between its interests and the rights and freedoms of data subjects, and has concluded that its interests are not overridden, on the basis that: (a) processing is limited to the data necessary for the stated purpose; (b) data is pseudonymized or de-identified where feasible; (c) the impact on data subjects is limited and proportionate; and (d) data subjects may object at any time by contacting [email protected]. Additional information about this assessment is available on request.
Where required by law, Celes Labs will appoint an EU representative and a UK representative before the Service is offered in the EEA or the United Kingdom. The representatives' names and contact details will be published in this Section 12.2 on our website at that time. In the interim, data-protection questions may be directed to [email protected].
Under the CCPA, California residents have the right to:
Celes Labs does not sell personal information for monetary or other valuable consideration, and does not share personal information for cross-context behavioral advertising. No opt-out is therefore required; other rights remain available and may be exercised by contacting [email protected] or using the in-app controls described in Section 8.
Categories of personal information collected. In the preceding 12 months Celes Labs has collected the following categories of personal information: identifiers (such as your phone number and account ID); customer records; internet and other electronic network activity (such as device, app, and usage signals); audio, electronic, visual, or similar information where you transmit voice notes, images, or files; and inferences drawn from the foregoing. Each category is described further in Section 2.
If you reside in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Tennessee, Delaware, or another state with a comprehensive consumer privacy law in effect, you may have rights to access, correct, delete, obtain a portable copy of, and opt out of "targeted advertising," "sale," or certain profiling of your personal data. Celes Labs does not show targeted third-party advertising inside the Service and does not sell personal data.
Rights requests may be submitted to [email protected]. Celes Labs will respond within the timeframe required by applicable law, typically 45 days, with a permitted extension where provided by statute. If Celes Labs declines a request in whole or in part, you have the right to appeal by replying to the response with the subject line "Privacy Appeal," or by writing to [email protected] with that subject line. Appeals will be reviewed and a written decision provided within the timeframe required by the applicable state law, typically 60 days. If the appeal is declined, you have the right to contact the Attorney General of your state.
The CelesChat mobile applications do not use browser cookies. They use limited on-device storage for session tokens, preferences, and similar functional data. Our websites use a limited set of cookies and similar technologies for essential operation, analytics, and, where applicable, to record cookie preferences. The Cookie Policy describes the categories, purposes, and controls in detail.
Questions, complaints, or requests relating to this Privacy Policy may be directed to:
Celes Labs will acknowledge receipt within a reasonable time and respond within the timeframe required by applicable law — for example, within 30 days under the GDPR and UK GDPR, and within 45 days (extendable once for another 45 days where permitted) under the CCPA and similar U.S. state laws.