Privacy Policy

1. Controller

Kaido Studios UG (haftungsbeschränkt)
Glasbläserhöfe 8a
21035 Hamburg
Germany
Represented by Jens Hagel, Managing Director
Email: kontakt@kaidostudios.de

We have not appointed a data protection officer, as we are not required to. For any privacy question, contact us at the address above.

2. In short

• From the connected platforms we read only what is needed to publish your posts and to show you where they go.
• We do not sell data, do not use it for advertising, and do not share it with anyone except the platform you publish to and the service providers listed below.
• The app runs on servers in Germany.
• When you disconnect an account, we stop using it immediately and delete the stored data within 30 days at the latest, or right away on request.

3. This website

These pages are delivered through Cloudflare Pages (Cloudflare, Inc., USA). Cloudflare processes your IP address, time, requested address and browser details to deliver the pages and to fend off attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and fast operation. The website sets no cookies, uses no analytics or advertising services and loads nothing from third parties (not even fonts).

4. Your account in the app

To sign you in we store your name, email address, a password (hashed only) and the organization you belong to. After sign-in the app sets a session cookie it cannot work without. The purpose is to provide the service; the legal basis is Art. 6(1)(b) GDPR (contract). We set up accounts ourselves; there is no public sign-up.

5. Connected platform accounts

When you connect an account, you sign in on the platform’s own page and give your consent there. We then store the following data:

Platform	What we read and store
TikTok	Your TikTok account’s open_id, display name and profile picture (scope user.info.basic), the creator settings TikTok returns before a post (allowed privacy levels, whether comments, Duet and Stitch are enabled, maximum video length), and the access and refresh tokens. The only permission used to post is video.publish.
YouTube	Channel ID, channel name and picture, and the access and refresh tokens.
Instagram	Account ID, user name and profile picture, and the access token.
Facebook	Page ID, page name and picture, and the page access token.
LinkedIn	Organization ID, page name and logo, and the access and refresh tokens.
Google Business Profile	Location ID, business name and picture, and the access and refresh tokens.

Why: to show in each post which account it goes to (name, picture), to offer only the settings your account allows, and to publish on your behalf at the scheduled time (tokens). The legal basis is Art. 6(1)(b) GDPR.

What we do not do: we do not read followers, messages, comments, analytics, or other videos and posts from your accounts. We publish only what you created and scheduled in Kaido Publish.

TikTok in particular

Kaido Publish uses the TikTok Login Kit and the Content Posting API with exactly two scopes: user.info.basic (open_id, display name, avatar) and video.publish (publishing videos). Before each post we query your account’s creator settings from TikTok so that only permitted options are offered. We use data received from TikTok solely to provide this function and do not share it with anyone.

6. Content you upload

We store videos, images and captions until they are published, and beyond that in your media library until you delete them. At the scheduled time we transfer them to the platform you chose; from then on, that platform’s privacy policy applies as well. If you use the optional AI writing assistant, the text you enter there is sent to OpenAI (OpenAI, L.L.C., USA) to generate a suggestion; nothing is sent to OpenAI otherwise.

7. Where the data is and who processes it

• Hetzner Online GmbH, Gunzenhausen, Germany — servers and database in the Nuremberg data centre, Germany.
• Cloudflare, Inc., USA — routes traffic to the app and to this website and protects against attacks.
• Resend, Inc., USA — sends the app’s system emails (e.g. password reset).
• OpenAI, L.L.C., USA — only when you use the AI writing assistant (section 6).

They process the data as processors under Art. 28 GDPR, only on our instructions. Transfers to the USA rely on the EU-U.S. Data Privacy Framework or on EU Standard Contractual Clauses.

8. How long we keep data

Data	Retention
Account data	until your account ends, then deleted within 30 days
Profile data and tokens of a platform account (including TikTok)	until you disconnect it; then no longer used and deleted within 30 days at the latest, or right away on request
Uploaded media and posts	until you delete them or your account ends; deleted files are removed from the server within 30 days, unless a post that is still scheduled uses them
Server logs (IP address, time, address)	14 days
Encrypted backups	12 months at most; deleted data disappears as each backup expires

9. Disconnecting and requesting deletion

• In Kaido Publish: channel menu → “Delete”. From that moment on we publish nothing more to that account.
• At the platform: you can also revoke access there at any time:
  • TikTok: TikTok app → Settings and privacy → Security and permissions → Apps and services permissions
  • YouTube: Google account → Security → Third-party connections
  • Instagram: Meta Business settings → Integrations, or Instagram → Settings → Website permissions
  • Facebook: Facebook → Settings → Business integrations
  • LinkedIn: LinkedIn → Settings → Data privacy → Permitted services
  • Google Business Profile: Google account → Security → Third-party connections
• Request deletion: email kontakt@kaidostudios.de with the subject “Privacy”. We delete the data related to your account and confirm it, within one month at the latest.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You may also lodge a complaint with a data protection supervisory authority, for example the Hamburg Commissioner for Data Protection and Freedom of Information.

11. Changes

If what we process changes, we update this policy and the date above. German version.