Terms of service

1.1 These terms. These Terms of Service (“Terms”) are an agreement between you and Sinan Büyükbayrak, an individual based in Istanbul, Türkiye, who runs Kelrova (“Kelrova”, “we”, “us”). They govern your use of kelrova.com, the app at app.kelrova.com, the Kelrova MCP server and related services (the “Service”). Our Privacy Policy explains how we handle personal data, and our Refund Policy forms part of these Terms.

1.2 Accepting them. You accept these Terms when you create an account, start a trial, buy a plan or otherwise use the Service. If you do not agree, do not use the Service.

1.3 Using Kelrova for an organization. If you use the Service for a company or other organization, you accept these Terms on its behalf and confirm that you have authority to bind it; “you” then includes that organization. Where a signed Enterprise agreement conflicts with these Terms, the Enterprise agreement prevails.

1.4 Eligibility. You must be at least 18 years old and able to enter into a binding contract. You may not use the Service where the laws that apply to you forbid it, including sanctions and export control laws.

2.1 Your account. Give accurate information and keep it up to date. Keep your password and sign-in codes to yourself, and turn on two-step verification. You are responsible for activity under your account; tell us at once if you suspect anyone else is using it.

2.2 Organizations. Work in Kelrova belongs to an organization: your personal organization, or a team organization you create or join. Owners and admins invite members, assign roles and manage billing, and the organization controls its workspace. How many members an organization can have depends on its plan.

2.3 Connected services. When you connect GitHub, GitLab, Bitbucket or an MCP client, you authorise Kelrova to access it as shown when you connect. Your use of those services remains subject to their own terms.

3.1 Authorised repositories only. Connect and scan only repositories that you or your organization own, or that you have the owner’s permission to analyse for security. Being able to read a repository is not, on its own, permission to scan it.

3.2 No third-party targets. Do not use the Service to look for weaknesses in software, systems or networks that belong to others without their permission. Adversary scans read your repository from an attacker’s point of view; they do not authorise testing any live system.

3.3 Responsible use of findings. Use findings to understand and fix software you are responsible for, and to report issues to others through coordinated disclosure. Do not use findings to exploit, attack or harm any system, person or organization, and do not publish a finding about someone else’s software before they have had a reasonable chance to fix it.

3.4 Fair use of the Service. You must not: (a) break or work around plan limits, usage controls, access controls or security measures; (b) access the Service by automated means other than the interfaces we provide, such as the MCP server; (c) disrupt the Service or place an unreasonable load on it; (d) upload malware, unlawful content or content you have no right to share; (e) resell the Service or share access with people outside your organization except as these Terms allow; (f) copy, reverse engineer or decompile the Service, except where the law allows it despite this restriction; or (g) use the Service or its output to build or train a competing product or service.

3.5 Enforcement. We may investigate suspected breaches of this section and suspend access as section 14 describes.

4.1 What Kelrova does. Kelrova scans the repositories you connect in its cloud runtime and reports findings with evidence and fix guidance. Scans run at five depths, Quick, Focused, Standard, Extended and Full, and as Adversary scans, which read the project from an attacker’s point of view. You can re-check findings, schedule scans, ask Kelrova to open a fix as a pull request (Go Fix), and work on findings from coding agents and other MCP clients through the MCP server.

4.2 Plans. We sell the Basic, Go, Pro and Max plans at checkout. Each is a monthly subscription that includes usage up to its price. Adversary scans and the Best model tier need Pro or above. Enterprise is arranged with us under a separate agreement. The pricing page describes what each plan includes, and that description forms part of your order.

4.3 Pull requests. Kelrova changes code in a repository only through a pull request a member asks it to open, and it merges or closes that pull request only when a member asks. When you connect a GitLab or Bitbucket repository, Kelrova also registers a webhook on it, as our Privacy Policy describes. A pull request is a proposal: review and test every change before you merge it.

4.4 Preview features. Features marked as beta or preview are provided as they are. They may change or end at any time and are excluded from any service commitment.

5.1 The Basic trial. A new personal organization can start the Basic plan with a 14-day free trial, once per account. Checkout asks for a payment method, and the Basic price is charged when the trial ends unless you cancel before then.

5.2 During the trial. The trial includes the Basic plan’s usage. Scans run at the Quick and Focused levels.

5.3 Changing plans. Upgrading during the trial ends it and charges the new plan at once. Downgrading is not available during the trial.

5.4 Misuse. We may refuse or end a trial used to get around these Terms, for example by creating accounts to repeat it.

6.1 Merchant of record. Polar is our merchant of record. You buy the subscription and any top-ups from Polar, which charges your payment method, adds VAT or sales tax where it applies, and issues invoices and receipts. Polar’s buyer terms also apply to the payment.

6.2 Prices. Prices are in US dollars, charged monthly in advance, and exclude tax. There are no seat fees and no yearly plans.

6.3 Included usage. Each plan includes usage up to its monthly price, consumed as your organization runs scans, re-checks and fixes. The app shows how much of the period’s usage you have used. Unused usage does not roll over to the next period.

6.4 Balance and on-demand. When the included usage runs out, scans can continue on your organization’s prepaid balance if on-demand is turned on. You add to the balance with one-time top-ups. We do not charge metered overage.

6.5 Plan changes. An upgrade takes effect at once and charges the prorated difference for the rest of the period. A downgrade takes effect at the next renewal, and the current period is not refunded.

6.6 Cancellation. You can cancel at any time in the app. The plan stays active until the end of the period you paid for and then ends; you can resume it before then. Refunds are covered by our Refund Policy.

6.7 Failed payments. If a payment fails, new scans and scheduled runs pause until it succeeds. Scans already running finish, and your findings and settings stay readable.

6.8 Price changes. We may change prices with at least 30 days’ notice by email or in the app. A new price applies from your first renewal after the notice period. If you do not accept it, cancel before it takes effect.

7.1 Your content. “Customer Content” means the repositories and other material you or your organization submit to the Service, the settings you configure, and the findings, reports, fix guidance and pull requests the Service produces for you. As between you and us, you own your Customer Content.

7.2 Our permission to use it. You grant us a worldwide, non-exclusive licence to host, copy, process, transmit and display Customer Content only as needed to provide, secure and support the Service for you, including through the service providers described in our Privacy Policy. We do not use Customer Content for any other purpose, and we do not sell it.

7.3 Your responsibility. You are responsible for your Customer Content and for having the rights needed to submit it to the Service.

7.4 Our property. We and our licensors own the Service, including its software, design and documentation, and the Kelrova name and marks. These Terms give you only the right to use the Service while your trial or subscription lasts. We may use aggregated measurements of how the Service operates, such as scan durations and error rates, which identify neither you nor your Customer Content, to run and improve it.

7.5 Feedback. If you send us ideas or feedback, we may use them without any obligation to you.

8.1 What is confidential. Each party may receive non-public information from the other (“Confidential Information”). Your Customer Content is your Confidential Information. Non-public parts of the Service, Enterprise pricing and security information we share with you are ours.

8.2 How it is protected. The receiving party uses Confidential Information only to perform under these Terms, protects it with at least reasonable care, and shares it only with its personnel and service providers who need it and are bound by similar duties.

8.3 Exceptions. These duties do not apply to information that is or becomes public through no fault of the receiving party, that it already knew without restriction, that it develops independently, or that it lawfully receives from someone else without restriction.

8.4 Disclosure required by law. If the law requires disclosure, the receiving party may disclose only what is required and, where lawful, will tell the other party first.

9.1 Reporting a vulnerability in Kelrova. If you find a vulnerability in the Service, report it through the contact page or to info@kelrova.com, with enough detail for us to reproduce it, and give us reasonable time to fix it before you disclose it publicly.

9.2 Good-faith research. While researching, do not access or change data that is not yours, degrade the Service for others, use social engineering, or keep data longer than you need to show the issue. We will not take legal action against research that follows these rules in good faith.

9.3 Issues in third-party code. If a scan surfaces an issue in someone else’s code, such as an open-source dependency, report it to that project through its published security process rather than in public.

9.4 Incidents on our side. If we become aware of a security incident that affects your Customer Content, we will tell you without undue delay, share what we know, and keep you updated.

10.1 Availability. We work to keep the Service available, but we do not promise it will be uninterrupted or error-free, and no service level applies unless an Enterprise agreement sets one. A scan can take a long time, stop early or finish with partial coverage; when it does, the result is marked as partial.

10.2 Changes. We may add, change or remove features. If we remove a material feature of a paid plan, we will give you reasonable notice, and you may cancel before the change takes effect.

10.3 Third-party services. The Service depends on services we do not control, such as source hosts and payment and infrastructure providers. We are not responsible for their availability or for changes they make.

11.1 Findings are analysis, not a guarantee. Kelrova’s scans are automated analysis. Findings can be incomplete or wrong: a scan can miss vulnerabilities and can report issues that are not real. A scan with no findings does not mean your software is secure. The Service is not a security audit, penetration test, certification, or legal or compliance advice, and it does not replace your own review.

11.2 Fixes are suggestions. Fix guidance and pull requests are suggestions. You decide whether to apply them, and you are responsible for reviewing, testing and merging any change.

11.3 As is. To the extent the law allows, the Service is provided “as is” and “as available”, and we disclaim all warranties, express or implied, including warranties of merchantability, fitness for a particular purpose, title and non-infringement.

11.4 Consumer rights. Nothing in these Terms limits rights you have as a consumer that cannot be limited by contract.

12.1 Excluded losses. To the extent the law allows, neither party is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue, data or goodwill, arising out of these Terms or the Service, even if it was told they were possible.

12.2 Cap. To the extent the law allows, each party’s total liability arising out of these Terms or the Service is limited to the amounts you paid for the Service in the 12 months before the event that gave rise to the claim. This cap does not apply to your payment obligations or to your obligations under section 13.

12.3 What is not limited. These limits do not apply to liability that cannot be limited by law, including liability for fraud, wilful misconduct, gross negligence, or death or personal injury caused by negligence.

13.1 Claims arising from your use. You will defend Kelrova against claims by third parties arising from your Customer Content, or from your use of the Service in breach of section 3, such as scanning code you were not authorised to scan, and pay the resulting damages and reasonable costs. We will tell you about such a claim promptly and let you control its defence. This section applies to consumers only to the extent the law allows.

14.1 By you. You can stop using the Service and cancel your subscription at any time, as section 6.6 describes. To close your account or organization, contact us.

14.2 By us. We may suspend or end your access if you materially breach these Terms, including section 3, if you do not pay, if the law requires it, or if your use creates a security risk for the Service or others. We will give notice where it is reasonable to do so and, where we can, a chance to fix the problem first. Ending access for your breach does not entitle you to a refund.

14.3 What happens next. When access ends, your right to use the Service ends, and we delete Customer Content as our Privacy Policy describes. Sections 7.4, 8, 11, 12, 13, 15 and 17 continue to apply.

15.1 Law and courts. These Terms are governed by the laws of the Republic of Türkiye, without regard to its conflict-of-laws rules. The courts and enforcement offices of Istanbul have exclusive jurisdiction over any dispute arising out of them.

15.2 Consumers. If you are a consumer, you keep the protection of the mandatory laws of the country where you live, and you may bring a claim in its courts or consumer bodies where those laws allow.

15.3 Talk to us first. Before starting proceedings, contact us so we can try to resolve the dispute informally within 30 days.

We may update these Terms. For a material change, we will notify account holders by email or in the app at least 30 days before it takes effect, unless the law or a security risk requires it sooner. If you keep using the Service after a change takes effect, you accept it; if you do not accept it, cancel before then.

17.1 Entire agreement. These Terms, with the Privacy Policy, the Refund Policy and any order or Enterprise agreement, are the whole agreement between you and us about the Service.

17.2 Assignment. You may not transfer these Terms without our written consent. We may transfer them as part of a merger, acquisition or sale of assets, and will tell you if we do.

17.3 Events beyond control. Neither party is liable for a delay or failure caused by events beyond its reasonable control.

17.4 Severability and waiver. If a provision is found unenforceable, the rest remains in effect. Not enforcing a provision is not a waiver of it.

17.5 Notices. We send notices to your account’s email address or in the app. Send notices to us at info@kelrova.com or to Sinan Büyükbayrak (Kelrova), Istanbul, Turkey.

17.6 Language. These Terms are written in English. Any translation is for convenience, and the English version prevails where the law allows.

17.7 Relationship. The parties are independent contractors. These Terms create no rights for anyone other than you and us.

Questions about these Terms: email info@kelrova.com, write to Sinan Büyükbayrak (Kelrova), Istanbul, Turkey, or use the contact page.