Kloti: Privacy Policy

Effective date: 2026-06-09 Last updated: 2026-06-17

This Privacy Policy explains how Kloti ("we", "us", "our"), a service operated by Kloti based in Singapore, collects, uses, discloses, and protects your personal data when you use Kloti (the "Service"). We handle personal data in accordance with Singapore's Personal Data Protection Act 2012 ("PDPA"). If you are located outside Singapore, your data may be processed under the laws described here.

Contact / Data Protection: support@kloti.co.

1. Personal Data We Collect

• Account data: your email address, display name, and authentication identifiers (including via Google sign-in). We do not receive your Google password.
• Content you provide: product images, logo and reference ("theme") images, brand colours, descriptions, and the visuals you generate and edit.
• Billing data: your plan, credit balance and transaction history, and subscription identifiers. Card payments are handled by Stripe; we do not collect or store your full card number.
• Usage data: generations, edits, log/diagnostic data, approximate device/browser information, and timestamps, used to operate and secure the Service.

2. How We Use Your Data

We use personal data to:

• create and manage your account and authenticate you;
• provide the Service: generate, store, edit, and deliver your visuals;
• process payments, manage plans and credits, and prevent abuse or fraud;
• maintain, secure, debug, and improve the Service;
• communicate with you about your account, transactions, and important changes;
• comply with legal obligations.

3. Consent and Legal Bases

Singapore (PDPA). By providing your personal data and using the Service, you consent to our collection, use, and disclosure of it for the purposes above. You may withdraw consent at any time (Section 8), though doing so may mean we can no longer provide the Service.

EEA / UK (GDPR). If you are in the European Economic Area or the United Kingdom, we process your personal data on these legal bases: performance of a contract (to provide the Service you request); legitimate interests (to secure, debug, and improve the Service and prevent abuse, balanced against your rights and freedoms); consent (where we ask for it, such as optional communications or non-essential cookies); and legal obligation (to comply with applicable law). You may withdraw consent, or object to processing based on legitimate interests, at any time (Section 8).

4. Disclosure to Third Parties (Sub-processors)

We share personal data only as needed to run the Service, with providers who process it on our behalf:

• Supabase: authentication, database, and image storage (hosting your account data and images);
• Render: application hosting; processes requests to operate the Service;
• Stripe: payment processing and subscription management;
• Google: optional sign-in (OAuth);
• Resend and Namecheap Private Email: sending account and transactional emails (such as sign-up confirmation and password-reset messages).

We do not currently use a third-party analytics provider. If we add one, we will update this list and provide any notice or choices required by law.

We do not sell your personal data. We may also disclose data if required by law, to enforce our Terms, or to protect the rights, safety, and property of Kloti or others.

5. International Transfers

We operate globally, and our providers process data outside your country, including in the United States and the EU. Where we transfer personal data across borders, we take reasonable steps so it receives a standard of protection comparable to the law of your jurisdiction. For transfers from the EEA or UK, we rely on appropriate safeguards such as the European Commission's **Standard Contractual Clauses (SCCs)** and the UK International Data Transfer Addendum, or another lawful transfer mechanism. You may request information about these safeguards using the contact in Section 13.

6. Retention

• We retain your personal data and content for as long as your account is active or as needed to provide the Service.
• When you delete your account, we delete or anonymise your personal data and content (projects, uploaded images, and generated images) within a reasonable period, except records we are legally or operationally required to keep.
• We retain billing and transaction records (as required for tax, accounting, and legal compliance in Singapore) even after account deletion.

7. Account Deletion

You can request deletion of your account from your account Settings (or by emailing us). Deletion removes your personal data and content as described in Section 6, cancels any active subscription, and is irreversible. Retained billing records are kept only as required by law.

8. Your Rights

Depending on where you live, you have the rights below. We honour them globally where we reasonably can, and as required by the laws that apply to you.

All users / Singapore (PDPA):

• Access the personal data we hold about you and how it has been used or disclosed;
• Correct inaccurate or incomplete personal data;
• Withdraw consent to our collection, use, or disclosure of your personal data;
• request deletion of your account and data.

EEA / UK (GDPR): in addition, you have the right to rectification, erasure ("right to be forgotten"), restriction of processing, data portability, to object to processing (including processing based on legitimate interests), and to **lodge a complaint with your local data-protection supervisory authority**.

California (CCPA/CPRA): you have the right to know what personal information we collect and how it is used, to delete and correct it, and to opt out of any "sale" or "sharing" of personal information. We do not sell or share your personal information, and we will not discriminate against you for exercising your rights.

To exercise any right, contact support@kloti.co. We will verify your identity before acting and respond within the timeframe required by the applicable law. These rights may be subject to legal exceptions and limits.

9. Security

We use reasonable technical and organisational measures (including encrypted transport, access controls, and reputable infrastructure providers) to protect personal data. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

10. Cookies and Similar Technologies

We use cookies/local storage that are strictly necessary to keep you signed in and to remember preferences (such as your theme). If we enable analytics, we will use additional cookies and update this Policy and provide any required notice or choices.

11. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

12. Changes to This Policy

We may update this Policy from time to time. We will post the new effective date and, for material changes, notify you (for example by email or in-app).

13. Contact

For privacy questions or to exercise your rights, contact our data protection contact at support@kloti.co.