Privacy Policy

1. Introduction

Keiro ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

2. Information We Collect

2.1 Information You Provide

• Account Information: Email address, name, password
• Business Information: Business name, type, description
• Content: Images, text, and other content you create or upload
• Social Media Credentials: Access tokens for connected platforms (Instagram, TikTok)

2.2 Automatically Collected Information

• Usage Data: Features used, pages visited, time spent
• Device Information: Browser type, operating system, IP address
• Log Data: Error logs, performance metrics

3. How We Use Your Information

We use the collected information to:

• Provide and maintain the Service
• Generate AI-powered content suggestions
• Publish content to your connected social media accounts
• Improve and personalize your experience
• Communicate with you about the Service
• Detect and prevent fraud or abuse
• Comply with legal obligations

3.1 Aggregated & Anonymized Data — Insights & Model Improvement

We build and use an aggregated, anonymized dataset of performance signals (for example, which content formats, timings, hooks or angles perform well within a business sector) to produce benchmarks and to train and improve our AI language and vision models and recommendations for all users. Once data is irreversibly aggregated and anonymized, it no longer identifies you or your business and is therefore not personal data; we may use it without additional consent. We apply k-anonymity: no insight is ever produced or served from a sector segment containing fewer than ten (10) distinct businesses. Anonymized/aggregated data is never sold with identifying information.

Content license (model improvement). To operate and continuously improve the Service, you grant KeiroAI a non-exclusive, worldwide, royalty-free license to process the content generated through or provided to the Service and its associated performance data, including to train and improve our AI models — used in aggregated and/or anonymized form. This license is limited to operating and improving the Service and survives in respect of already-anonymized data.

Your controls. For any data that still identifies you, you keep your GDPR rights (access, deletion, portability) and can object to identifiable processing by contacting contact@keiroai.com. Exercising these rights does not affect your use of the Service. Note that data already irreversibly anonymized cannot be individually withdrawn, as it can no longer be linked back to you.

4. Third-Party Services

We integrate with third-party services to provide our functionality:

4.1 Authentication

• Supabase: User authentication and database services

4.2 AI Services

• Anthropic Claude: AI content generation

4.3 Social Media Platforms

• Instagram (Meta): Content publishing and analytics
• TikTok: Content publishing and analytics
• LinkedIn: Content publishing and analytics

4.4 Google Services — Gmail & Business Profile (Limited Use)

Keiro lets you optionally connect your Google account so our assistant can operate two features on your behalf. These integrations access Google user data only after you explicitly grant consent on Google’s OAuth screen, and only the minimum scopes required:

• Gmail — so our assistant can send prospecting and follow-up emails from your own Gmail address, on your behalf. Emails are sent only after you review or configure them in the Keiro app. We do not read, label, archive or delete your mailbox — we request no read access.
  • gmail.send — send emails from your address, on your behalf.
  • userinfo.email / userinfo.profile — identify the connected mailbox (name and email shown in the app).
• Google Business Profile (business.manage) — so our assistant can read the reviews on your business listing and post replies that you have approved or configured.

Limited Use. Keiro’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide and improve the user-facing features described above.
• We do not sell Google user data, and we do not use it for advertising.
• We do not use Google user data to train, develop, or improve generalized artificial-intelligence or machine-learning models. Any AI generation is performed per-request to serve your feature and is not used to train models.
• We do not allow humans to read Google user data except: (a) with your explicit consent, (b) for security purposes (e.g. investigating abuse), (c) to comply with applicable law, or (d) where the data has been aggregated and anonymized for internal operations.
• We do not transfer Google user data to third parties except as necessary to provide or improve these features, to comply with applicable law, or as part of a merger or acquisition with prior notice to you.
• You can revoke Keiro’s access at any time from your account settings or from your Google Account permissions. Tokens are stored encrypted and deleted on disconnection.

These services have their own privacy policies. We encourage you to review them.

5. Data Storage and Security

We implement industry-standard security measures to protect your data:

• Encrypted data transmission (HTTPS/TLS)
• Secure database access controls
• Regular security audits and updates
• Access restricted to authorized personnel only

However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

6. Social Media Data

When you connect your social media accounts:

• We access only the data necessary to provide the Service
• We cache images and content to improve performance
• We store access tokens securely and encrypt them
• You can revoke access at any time through your account settings or the social platform

7. Data Retention

We retain your data:

• As long as your account is active
• As necessary to provide the Service
• To comply with legal obligations
• For up to 30 days after account deletion for backup purposes

8. Your Rights (GDPR)

If you are in the European Economic Area, you have the right to:

• Access: Request copies of your personal data
• Rectification: Correct inaccurate data
• Erasure: Request deletion of your data
• Restriction: Limit how we use your data
• Portability: Receive your data in a structured format
• Object: Object to certain data processing
• Withdraw Consent: Withdraw previously given consent

9. Cookies and Tracking

We use cookies and similar technologies to:

• Maintain your session
• Remember your preferences
• Analyze Service usage
• Improve performance

You can control cookies through your browser settings.

10. Children's Privacy

Our Service is not intended for users under 18 years of age. We do not knowingly collect information from children. If we discover we have collected data from a child, we will delete it immediately.

11. International Data Transfers

Your data may be transferred to and processed in countries other than your own. We ensure adequate safeguards are in place to protect your data in accordance with this Privacy Policy.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last updated" date
• Sending an email notification (for material changes)

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, contact us at:

14. Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection authority.