Privacy policy

1. What we collect

• Account data: your email address, a display name if you give one, and the sign-in identifiers that come with email or Google sign-in. We never see your Google password.
• What you give us to work with: photographs, logos, documents, the links you ask us to read, your notes about what you do, and the carousels you make and change here.
• Billing data: your plan, your credit balance, your transaction history and the subscription identifiers that come with them. Card payments go to Stripe, and we do not collect or store your full card number.
• Usage data: what was generated and when, log and diagnostic records, rough device and browser information, and timestamps. We use these to run Kloti and to keep it secure.

2. Why we use it

We use personal data to:

• set up your account and sign you in;
• run the service, meaning write, store and deliver your carousels and the pictures in them;
• take payments, manage plans and credits, and prevent abuse and fraud;
• keep Kloti working, secure and improving;
• write to you about your account, your payments and important changes;
• meet our legal obligations.

We do not use your photographs or your words to train models of our own.

3. Consent and legal bases

Singapore, under the PDPA. By giving us your personal data and using Kloti, you consent to us collecting, using and disclosing it for the purposes above. You can withdraw that consent at any time, see section 8, although it may mean we can no longer run the service for you.

Europe and the United Kingdom, under the GDPR. If you are in the EEA or the UK, we rely on: performance of a contract, to give you the service you asked for; legitimate interests, to secure, debug and improve Kloti and to prevent abuse, weighed against your rights; consent, where we ask for it; and legal obligation, where the law requires something of us. You can withdraw consent, or object to processing based on legitimate interests, at any time.

4. Who else processes it

We pass personal data on only as far as running Kloti requires, to providers who process it for us:

• Supabase: sign-in, the database, and image storage;
• Render: hosting, which means it handles the requests that run the service;
• Stripe: payments and subscriptions;
• Google: optional sign-in;
• Resend: account and transactional email, such as a password reset;
• the AI providers that write the words and make the pictures, which receive the text and the images a generation needs. We will name the current ones if you write and ask.

We do not sell your personal data, and we use no third-party analytics today. If that changes we will update this list and give whatever notice or choice the law requires. We may also disclose data where the law requires it, to enforce our terms, or to protect the rights and safety of people including ourselves.

5. Sending data abroad

We and our providers operate internationally, so your data is processed outside your own country, including in the United States and in the European Union. Where data crosses a border, we take reasonable steps so that it keeps a standard of protection comparable to the law of your own jurisdiction. For transfers out of the EEA or the UK we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, or another lawful mechanism. Ask us and we will tell you which one applies.

6. How long we keep it

• We keep your personal data and your content while your account is open, and for as long as running the service needs it.
• When you delete your account we delete or anonymise your personal data and your content, meaning projects, uploads and generated pictures, within a reasonable time, apart from records we are required to keep.
• We keep billing and transaction records after an account is deleted, because Singapore tax and accounting law requires it.

7. Deleting your account

You can delete your account from your settings, or by emailing us. Deleting removes your personal data and your content as described above, cancels a subscription if one is running, and cannot be undone. Billing records are kept only for as long as the law requires.

8. Your rights

Which rights you have depends on where you live. We honour these globally where we reasonably can, and as the law that applies to you requires.

• Everyone, and Singapore under the PDPA: ask what personal data we hold about you and how it has been used or disclosed, have inaccurate data corrected, withdraw your consent, and ask for your account and data to be deleted.
• The EEA and the UK under the GDPR: also rectification, erasure, restriction of processing, data portability, the right to object to processing including processing based on legitimate interests, and the right to complain to your local data protection authority.
• California under the CCPA and CPRA: know what personal information we collect and how it is used, have it deleted or corrected, and opt out of any sale or sharing of it. We do not sell or share personal information, and we will not treat you differently for exercising a right.

Write to support@kloti.co to use any of these. We will check who you are before acting, and answer within the time the applicable law allows. Some of these rights have legal limits and exceptions.

9. Security

We use reasonable technical and organisational measures, including encrypted transport, access controls and established infrastructure providers. No method of transmission or storage is completely secure, so we cannot promise absolute security.

10. Cookies and what your browser keeps

We use cookies and browser storage that are strictly necessary: keeping you signed in, and holding the carousel you are working on so that it is still there when you come back. There are no advertising cookies. If we ever add analytics, we will update this policy and give whatever notice or choice the law requires.

11. Children

Kloti is not meant for children under 16, and we do not knowingly collect their personal data. If you believe a child has given us data, tell us and we will delete it.

12. Changes to this policy

We may update this policy. We will post the new date at the top and, where a change is significant, tell you by email or in the app.

13. Contact

For anything about privacy, or to use one of the rights above, write to support@kloti.co.