Skip to content
Kairoset

Legal

Privacy Policy

Effective date: [Operator: effective date]

Template — operator details required

This document is a starting template. Highlighted fields must be completed by the operator of this instance by setting NEXT_PUBLIC_LEGAL_ENTITY, NEXT_PUBLIC_LEGAL_ADDRESS, NEXT_PUBLIC_LEGAL_JURISDICTION, NEXT_PUBLIC_LEGAL_EFFECTIVE_DATE, NEXT_PUBLIC_SUPPORT_EMAIL, and the text should be reviewed by qualified counsel before publication.

This Privacy Policy explains how [Operator: legal entity name] (“we”, “us”), operator of Kairoset at kairoset.com, collects and uses personal data when you visit our website or use the Kairoset service (the “Service”). For data you process about others through the Service, you are the controller and we act as your processor.

1. Who we are

Controller: [Operator: legal entity name], [Operator: registered address]. Contact for privacy matters: support@example.com.

2. Data we collect

  • Account data: name, email address, password (stored only as a salted scrypt hash), profile picture, and workspace membership and role.
  • Content: posts, drafts, comments, media files, tags, signatures and schedules you create.
  • Connected social accounts: when you connect a network we receive access tokens and basic profile information (account id, name, handle, avatar) from that network. Tokens are encrypted at rest with AES-256-GCM and are only decrypted in server memory to publish on your behalf.
  • Billing data: plan, subscription status and invoices. Card details are handled by our payment processor and never reach our servers.
  • Technical data: IP address, user agent, session identifiers, and logs of security-relevant actions (audit log) and publishing attempts.

3. How we use data

  • To provide the Service: authenticate you, store and publish your content at the times you choose (contract).
  • To keep the Service secure: rate limiting, fraud and abuse prevention, audit logs (legitimate interests).
  • To communicate: transactional email such as invites, password resets and publishing failures (contract).
  • To bill paid plans and meet tax and accounting obligations (contract, legal obligation).
  • To improve the Service using aggregated, de-identified usage information (legitimate interests).

We do not sell personal data and do not use your content to train AI models.

4. Data from social networks

We access each network only with the permissions you grant, solely to publish and manage the content you schedule and to display your account details inside the Service. Use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. If you connect YouTube, you also agree to the YouTube Terms of Service and acknowledge the Google Privacy Policy. You can revoke access at any time from the network’s security settings (for Google: myaccount.google.com/permissions) or by disconnecting the channel in Kairoset.

5. AI features

If you use the optional AI assistant, the text you submit is sent to our AI provider to generate a response. It is not used to train models and is not retained by us beyond what is needed to show you the result.

6. Service providers

We share data only with providers that help us run the Service, under data processing agreements:

  • Vercel Inc. — Application hosting, edge network and scheduled jobs
  • Managed PostgreSQL provider (e.g. Neon) — Primary database
  • Vercel Blob — Media file storage
  • The social networks you connect — to publish your content (governed by their own privacy policies)

We may also disclose data where required by law or to protect our rights and users.

7. Cookies and local storage

We use strictly necessary cookies only: a session cookie that keeps you signed in and a cookie remembering your active workspace and sidebar preference. Your theme choice is stored in your browser’s local storage. We do not use advertising or cross-site tracking cookies.

8. Retention

We keep account data and content while your account is active. Deleted posts, channels and media are removed from the active service immediately and purged from backups within [Operator: backup retention period, e.g. 30 days]. Expired sessions are deleted automatically. Billing records are kept as required by law.

9. Deleting your data

You can disconnect any social account in Channels, which deletes its stored tokens immediately. To delete your account and all associated data, email support@example.com from your account address with the subject “Delete my data”; we complete verified requests within 30 days and confirm by email. This also serves as our data deletion instructions for platforms such as Meta and TikTok.

10. Your rights

Depending on where you live (for example under the GDPR, UK GDPR or CCPA) you may have the right to access, correct, export, delete or restrict processing of your personal data, to object to processing, and to withdraw consent. Contact support@example.com. You may also complain to your local data protection authority.

11. Security

Data is encrypted in transit (TLS) and secrets at rest; access is isolated per workspace and restricted by role. No method of transmission or storage is completely secure, but we work to protect your data and will notify you of breaches as required by law.

12. International transfers

Our providers may process data outside your country. Where required we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

13. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data.

14. Changes

We will post updates on this page and, for material changes, notify account owners by email before they take effect.

15. Contact

[Operator: legal entity name], [Operator: registered address] — support@example.com. See also our Terms of Service.