Privacy Policy

Kitor is operated by Unex Technologies ("we", "us"). We are the controller of the personal data described in this policy within the meaning of the EU and UK General Data Protection Regulation (GDPR).

• Email: privacy@kitor.app
• Postal address: Alexandria, Virginia, United States

Kitor is a private, invitation-only application: an account is only created for people we have allow-listed. There is no public sign-up, no advertising, and no data broker on either side.

Everything below comes from an account or mailbox that you connect, from what you type into the app, or, for video licensing, from what a brand types in when it buys a license from you. We never collect data from accounts you have not connected.

• Your own account. Email address, sign-in and two-factor status, workspace settings, the automations, rate card and voice samples you write, invitations you send to teammates, and a security audit log (what changed, when, from which IP address and browser).
• Instagram and Facebook Page data (Meta APIs). When you connect an Instagram professional account and its linked Facebook Page: your account and Page ids, username, profile picture, follower and insight metrics (reach, views, engagement, audience demographics), your recent posts, the comments left on them, and the direct messages sent to your account, including who sent them (their Instagram-scoped id, username and name) and whether they follow you. Threads: profile id, handle and insights.
• Mailbox content (Gmail, Microsoft 365, IMAP). When you connect a mailbox for your inbox or for brand outreach: the emails in the conversations you handle through Kitor (sender, subject, body, attachments you choose to store), the replies it drafts for you, and delivery statistics for what you send.
• YouTube and TikTok statistics. Channel or profile ids, handles, subscriber and follower counts, views, watch time, engagement and top content for your media kit. For content coaching, also each video's own numbers, and on YouTube its audience retention curve, traffic sources and published captions.
• Video transcripts (content coaching). A timed transcript of what you say in each of your videos, taken from its published YouTube captions, from your reel's audio transcribed on Kitor's own servers, or from a file or script you add yourself. Video and audio files are transcribed and then discarded; only the transcript, the video's numbers and the coaching report are kept.
• Video licensing. When you license one of your videos to a brand: the video and its link, the terms (how it may be used, for how long, where, whether exclusively, the fee and currency), and the brand's company name, contact name, email, website and intended use, plus the name they type to sign and the time, IP address and browser they signed from. Originals you upload so a brand can download them are kept while the video is listed. Card details go straight to Stripe; we never see or store them.
• Lead and company data. When you run brand research, Kitor reads public web pages and public company records to find brands, their business contact addresses and the context for a pitch. Each address is verified for deliverability before a campaign can use it.
• Access tokens. The OAuth tokens each platform issues so Kitor can act on your behalf. They are encrypted before they are stored and are never shown in the app or written to logs.
• Technical data. Server logs (IP address, user agent, timestamps, the request made), rate-limit counters and error reports, kept to run and secure the service.

Under the GDPR we need a legal basis for each purpose. These are ours:

• Running your workspace (contract, Art. 6(1)(b)). Signing you in, keeping your settings, your media kit, your deal pipeline and your inbox, coaching your videos, and sending the notifications you asked for. This is what you invited us to do when you accepted your invitation.
• Video licensing (contract, Art. 6(1)(b), and legitimate interest, Art. 6(1)(f)). Selling and delivering a license is part of your workspace. For the brand, its details are needed to enter the license it is buying from you; the license is between the brand and you, and Unex Technologies is not a party to it. The signing record (name, time, IP address, browser) and the agreement's fingerprint are kept so either side can prove what was agreed.
• Connecting a platform (consent, Art. 6(1)(a)). Instagram, Facebook, Threads, YouTube, TikTok, Gmail and Microsoft 365 are only read when you connect them through the platform's own consent screen, and only within the permissions you grant there. You can withdraw that consent at any time by disconnecting in Settings or in the platform's app permissions.
• Handling your audience's comments and messages (legitimate interest, Art. 6(1)(f)). The people who comment on your posts or message you are not our customers. We process what they send you because you, the account owner, configured automations that answer them (keyword replies, follow checks, story and mention flows, the AI default reply), and because a creator answering their own audience is what those people expect. Nothing is sent that you did not set up, the processing stays inside your account, and Emergency stop halts all of it. Where a person objects, we stop processing their messages in your workspace.
• Brand outreach (legitimate interest, Art. 6(1)(f)). Finding brands, drafting pitches in your voice and sending them from the mailboxes you connected. Outreach only targets business contact addresses, every email carries an unsubscribe link, and suppressed addresses are never contacted again.
• Security and abuse prevention (legitimate interest, Art. 6(1)(f), and legal obligation, Art. 6(1)(c)). Sign-in alerts, the audit log, rate limits, webhook signature checks and incident response.

We do not use your data, or your audience's, to train AI models, to profile anyone for advertising, or for anything unrelated to running your workspace. We make no decisions about you by automated means that have legal or similarly significant effects.

To draft a reply, classify a message, write a pitch or coach a video, Kitor sends the relevant text (a comment, a DM, an email thread, a brand's public page, a video's transcript and its numbers) to Anthropic's API together with the voice samples and instructions you provided. Only what is needed for that one task is sent; tokens and credentials never are. Audio is transcribed on Kitor's own servers with an open-source model, so no audio or video file is sent to Anthropic or anyone else. Anthropic processes it as our processor under its commercial API terms, which do not allow training on customer data. In Settings → Autonomy you choose, per action, whether AI output is sent automatically, held as a draft for your review, or turned off.

We do not sell personal data and we do not share it with data brokers, advertisers or other customers. The only parties that process it on our behalf, or that receive it because you connected them, are:

• Amazon Web Services (region us-east-1, United States (N. Virginia)): hosting: application servers, database, queues, file storage, encrypted backups, and the notification and license emails we send.
• Anthropic : AI processor for drafting and classifying text (comments, messages, emails, pitches) and for coaching your videos from their transcripts.
• Meta Platforms : Instagram, Facebook Page and Threads APIs for the accounts you connect.
• Google : Gmail and YouTube APIs for the accounts you connect.
• Microsoft : Microsoft 365 / Outlook mailboxes you connect.
• TikTok : TikTok account statistics you connect.
• Cloudflare : hosts this website and sits in front of the app as DNS, firewall and secure tunnel, so all traffic to both passes through it, including IP addresses.
• Telegram : notification bot, only if you enable it in Settings.
• Stripe : payments for video licenses, through your own connected Stripe account; card details go to Stripe directly and we never hold the money.

Teammates you invite to your workspace see what the workspace holds. When you license a video, the brand receives the signed agreement and a private link to download the video. Each license has a code, and anyone who has it can check the license on its public page: who holds it, for which video, where and until when, but never the fee or anyone's email. We will disclose data if the law requires it, and we will tell you when we are allowed to.

Kitor is hosted by Amazon Web Services in United States (N. Virginia) (us-east-1). If you or your audience are in the European Economic Area, the United Kingdom or Switzerland, personal data is therefore transferred outside those areas. We rely on the safeguards the GDPR provides for this: the European Commission's Standard Contractual Clauses (and the UK Addendum) in our agreements with Amazon Web Services, Anthropic and Cloudflare, and, where a provider is certified under the EU-U.S. Data Privacy Framework, that certification. The platforms you connect (Meta, Google, Microsoft, TikTok, and Stripe for licensing) transfer data under their own terms, which you accepted when you opened those accounts. A copy of the safeguards we rely on is available on request.

• Connected-account data, tokens, follower records and media-kit snapshots: until you disconnect that account or delete your workspace. Disconnecting deletes the tokens immediately.
• Instagram automation event logs (which flow ran, when, and delivery latency): purged automatically after 400 days.
• Mailbox content, leads and campaign history: until you delete them or disconnect the mailbox.
• Video transcripts, video numbers and coaching reports: until you disconnect that platform or delete your workspace.
• Licenses and their signed agreements: for the life of your workspace, so either side can prove what was agreed. Originals uploaded for licensing: while the video is listed.
• Email deliverability checks on lead addresses: a verdict expires after at most 30 days and is re-checked before it is used again.
• Security audit log: kept for the life of the workspace; it is append-only so that it can be trusted.
• Server logs: 30 days.
• Database backups: rolling 14 days, encrypted, then overwritten. Deleted data can persist in a backup for that long.

• Access tokens and mailbox credentials are encrypted at rest with AES-256-GCM before they reach the database, in a table no signed-in user can read.
• All traffic uses TLS. The database is split into least-privilege roles with row-level security so one workspace can never read another's data.
• Sign-in is restricted to allow-listed people, with two-factor authentication and alerts on sign-ins from a new location.
• Webhooks from Meta are verified with a signature before anything is processed.

No system is perfectly secure. If we learn of a breach affecting your data we will notify you, and where required the supervisory authority, without undue delay.

If the GDPR or a similar law applies to you, you have the right to:

• access the personal data we hold about you and receive a copy;
• rectification of data that is inaccurate or incomplete;
• erasure ("right to be forgotten"), including of your whole workspace;
• restriction of processing while a request is being handled;
• portability: a machine-readable export of the data you gave us;
• object to processing based on legitimate interest, including as a member of a creator's audience whose messages an automation answered;
• withdraw consent at any time, without affecting what was done before;
• complain to a data protection supervisory authority, in particular in the EU or UK country where you live or work.

Write to privacy@kitor.app. We may ask you to confirm which account you own. We answer within one month; if a request is complex we may take up to two more months and will tell you why. Exercising these rights is free.

• Disconnect an account in the app. Settings → Instagram → Disconnect (tokens deleted at once); Settings → Channels for YouTube, TikTok, Threads and your Facebook Page; Settings → Mailboxes for email accounts.
• Remove Kitor from Facebook or Instagram. Facebook → Settings → Apps and websites (or Instagram → Settings → Apps and websites) → remove Kitor. Meta then calls our deletion endpoint automatically; we disconnect every matching account, wipe its tokens and delete its follower records and snapshots. You receive a confirmation code you can check at https://app.kitor.app/data-deletion.
• Email us. Write to privacy@kitor.app from the address on your account to have your workspace and everything in it deleted.

The full set of routes, including for accounts you can no longer sign in to, is on the data deletion page.

Through Meta's Instagram Graph API, Messaging API and Threads API, Kitor receives the data listed above for the Instagram professional account, Facebook Page and Threads profile you connect: profile fields, media, comments, direct messages, insights and the webhooks that announce new comments and messages. It is used only for the features you configure, is kept only as long as you stay connected, and is deleted as described here. Kitor follows the Meta Platform Terms and Developer Policies and never uses Meta data for advertising, for building profiles of your audience, or outside your workspace.

Kitor never asks for your Instagram or Facebook password, never scrapes Instagram, and never uses browser automation or any unofficial API to reach it. Every action runs through the official APIs named above, using only the OAuth token issued when you connect your account, and only within the permissions you granted on Meta's own consent screen.

You can revoke Kitor's access at any time in your Facebook or Instagram settings under Apps and websites. Meta then sends us a deauthorization or data-deletion callback and we act on it automatically; the data deletion page lets you check the result with the confirmation code Meta shows you.

Kitor's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can read the policy at developers.google.com.

In practice: Gmail data is used only to show, draft and send email inside your own workspace, and YouTube data only for your media kit and for coaching your own videos (their numbers and published captions; the transcript and numbers go to Anthropic to write the coaching report, as described under AI processing). Neither is used for advertising, neither is sold, and neither is read by a human at Unex Technologies except with your permission for support, for security, or as the law requires. You can revoke access at any time at myaccount.google.com → Security → Third-party access.

Kitor uses YouTube API Services. By connecting YouTube you agree to the YouTube Terms of Service, and Google's use of your data is covered by the Google Privacy Policy.

Kitor is a business tool for adults. It is not directed at anyone under 18 and we do not knowingly hold an account for anyone under 18. If you believe we do, email us and we will delete it.

Kitor sets only strictly necessary cookies: the encrypted session cookie that keeps you signed in and a short-lived one used while you sign in. Your light or dark theme choice is kept in your browser's local storage. There are no advertising, analytics or tracking cookies, no third-party scripts and no fingerprinting, on this site or in the app. Because everything we store in your browser is necessary to provide the service you asked for, no cookie banner or consent is required under the ePrivacy rules. Opens and clicks on outreach emails you send, and opens of emails Kitor sends for you one to one (you can turn this off in Settings), are recorded through Kitor's own tracking link, with the recipient's IP address discarded.

If we change this policy in a way that matters, we will update the effective date above and tell signed-in users inside the app before it takes effect. Earlier versions are available on request.

Unex Technologies · privacy@kitor.app · Alexandria, Virginia, United States