Privacy Policy
Last updated: October 18, 2026
This policy explains what personal data Kagelot collects, why, who receives it and your rights. Controller: Kagelot, Inc. (Delaware, USA), support@kagelot.com.
1. What we collect
| Data | Examples | Why |
|---|---|---|
| Account | email, display name, hashed password, plan, credit balance | to create and run your account |
| Your Content | prompts, chat messages, scripts, uploads (images, audio, video), generated media, project files and canvas layout | to provide the Service |
| Billing | plan, purchase history, credit usage | to bill and enforce limits (card data is handled by Stripe; we never see your full card number) |
| Usage and technical | generation logs (model, cost, time), error logs, IP address, browser type | security, preventing abuse, fixing bugs, pricing |
| Communications | emails you send us, invite and notification emails | support and service messages |
We don't sell personal data and don't use advertising or analytics trackers.
2. Legal bases
Where the GDPR or Indonesia's Personal Data Protection Law applies, we rely on: contract (running your account and generations) · legitimate interests (security, abuse prevention, improving the Service) · legal obligation (tax and accounting records) · consent (for anything optional, such as featuring your work; you can withdraw it any time).
3. Who receives your data
To work, Kagelot sends data to these providers. Each receives only what its task needs.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Supabase | database, sign-in | account, project data, chat | region of our project |
| Bunny.net | file storage and delivery | uploads and generated files | region of our storage, global delivery |
| Netlify | app hosting | requests, logs | USA / global |
| Anthropic (Claude) | AI chat and writing | prompts, chat, project text | USA |
| Moonshot AI (Kimi) | AI chat and writing | prompts, chat, project text | China |
| Google (Gemini) | image generation, AI | prompts, reference images | USA / global |
| OpenAI | image generation | prompts, reference images | USA |
| OpenRouter | AI model routing | prompts, chat | USA |
| kie.ai | image model access | prompts, reference images | outside your country |
| BytePlus (ByteDance), Seedance + VOD | video generation and processing | prompts, reference images, videos | outside your country |
| Resend | email address, message | USA | |
| Stripe | payment, tax, invoices, subscriptions | name, email, billing address, payment details | USA |
Each provider handles data under its own API or business terms, including how long it keeps it for abuse monitoring.
4. International transfers
Your data is processed outside your country, including in the USA and China (see the table). Where the law requires, we rely on the providers' standard contractual clauses or equivalent safeguards.
5. How long we keep it
Account and Your Content: while your account is active, and deleted within 30 days after you delete it (backups within 90 days). Billing records: as long as tax law requires (kept by Stripe and us). Logs: 90 days. Provider copies: per each provider's retention terms.
6. Shared projects
Team members you invite can see the whole project, including its files and AI chat. Anyone with a share link can see the one file that link points to. Don't put other people's personal data in a shared project unless you're allowed to.
7. Browser storage
We use your browser's storage for your sign-in session, preferences (such as the chosen style or tab) and a local copy of your project for speed. No advertising cookies. Clearing site data signs you out.
8. Security
Data is encrypted in transit (HTTPS). Database access is limited by role and row-level rules, and MCP keys are stored hashed. No system is perfectly secure; tell us at support@kagelot.com if you find a problem.
9. Your rights
You can access, correct, export or delete your data, object to or restrict some processing, and withdraw consent: email support@kagelot.com and we'll answer within 30 days. You can also complain to the data protection authority in your country.
10. Children
Kagelot isn't for anyone under 18. We delete accounts we learn belong to a child.
11. Changes
We'll post updates here and email you about material changes.