Privacy Policy

Kadapt Ltd (UK) is the data controller. Contact:mike@kadapt.com. UK GDPR applies because we’re a UK company; US state privacy laws (CCPA/CPRA, and similar laws in Colorado, Connecticut, Virginia, Utah, and other states) apply to covered US residents. Effective 2026-07-13 (provisional).

1. What we collect

Category	Examples	Source
Account	name, email, business name, timezone/working hours	you
Brand & uploads	listing photos, logos, headshots, brand docs, website content we scrape at your request	you
Generated content	stills, videos, scripts, captions, voiceover	created by the service
Usage & analytics	pages/features used, generation counts, device/browser, approximate location	GA4 + our logs
Billing	handled by Stripe — we never hold full card numbers; we see customer/subscription status and card fingerprint (trial-abuse control)	Stripe
Comms	support messages, chat with the agent, push subscription endpoints, self-reported performance (“how did the reel do?”)	you
Affiliate	referral attribution (who referred whom, commissionable events)	Reditus / Stripe

2. Why we process it (lawful bases)

Contract (provide the service, generate content, bill you);legitimate interests (product improvement, fraud/abuse prevention, proactive in-app suggestions); consent (marketing emails, analytics cookies, showcasing your content); legal obligation (tax, accounting).

3. Processors / sub-processors

Processor	Role	Data	Location
Cloudflare (R2, Pages)	storage & hosting	uploads, generated media, backups	global network (US entity)
OpenRouter → model providers (ByteDance/Seedance et al.)	AI generation	your prompts and uploaded photos are sent to the model provider to generate content	US / provider-dependent
Stripe	payments, tax	billing data, card fingerprint	US/global
Resend	transactional email	email address, message content	US
Reditus	affiliate tracking	referral + commission data	EU
Google (GA4)	analytics	usage events, device data	US/global
VPS provider (Hetzner/OVH)	app hosting & database	account + application data	EU

Please note in particular: content you upload is processed by third-party AI model providers under their terms; we configure no-training/limited-retention options where the provider offers them.

4. Retention

Uploaded and generated media: auto-deleted 90 days after creation.
Account data: for the life of the account + a short wind-down; deleted on verified request (except billing records we must keep for tax — UK: 6 years).
Backups: encrypted, rotated; deletions propagate on backup expiry.

5. International transfers

We’re a UK company; our customers are mostly in the US and most processors are US-based. Transfers out of the UK rely on the UK International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses, adequacy where available, and processor data-processing agreements.

6. Security & breach notification

Transport encryption everywhere; media stored under scoped credentials; database on a hardened server with continuous encrypted backup; secrets never in client code; access limited to Kadapt personnel who need it.
Payment card data is handled entirely by Stripe (PCI-DSS); it never touches our servers.
If a breach creates risk to you, we’ll notify the UK ICO within 72 hours where required and affected users without undue delay, with what happened and what we’re doing.

7. Your rights

UK/EU-style rights (access, rectification, erasure, portability, objection, restriction) — honoured for everyone as policy.
California (CCPA/CPRA) and similar states: know/access, delete, correct, opt out of “sale”/“sharing.” We do not sell personal information for money.
How to exercise: in-app (account deletion, data export, marketing opt-out are self-serve) or emailmike@kadapt.com; we verify identity via the account email and respond within one month (UK GDPR) / 45 days (CCPA), whichever applies.
Complaints: UK ICO; or your state attorney general.

8. Cookies

Cookie/tech	Type	Purpose	Consent?
Session/auth (first-party)	essential	keep you signed in	no (strictly necessary)
GA4 (`_ga` etc.)	analytics	usage measurement	yes, banner-gated
Reditus referral cookie	attribution	60-day affiliate attribution window	yes
Stripe (checkout)	essential	payment/fraud prevention	no (necessary for payment)
Web Push subscription	not a cookie	notifications — the browser permission prompt is the consent	browser-level

9. Business changes

If Kadapt Ltd is acquired or its assets sold, customer data transfers with the business under the same commitments; we’ll notify you.