Privacy policy

The controller under the GDPR is:

Valentin Weinert
Dr.-Rohmer-Weg 11
65719 Hofheim am Taunus
Germany
hello@kitefleet.app

We have not appointed a data protection officer, because the law does not require one for a business our size. Write to hello@kitefleet.app with any question about your data.

We use no analytics, advertising or tracking tools. Kitefleet sets one cookie, the session cookie that keeps you signed in, and stores your light or dark choice in your browser. Both are strictly necessary for a service you asked for (§ 25 (2) no. 2 TDDDG). Our fonts are served from our own domain.

When you open a page, our hosting provider Vercel processes your IP address, the time, the page requested and your browser's user agent to deliver the page and protect it against attacks. Cloudflare resolves our domain and serves media files. Legal basis: Art. 6 (1) (f) GDPR; our legitimate interest is a secure and stable website. These request logs are deleted automatically after a short period.

To sign up we need your email address. If you sign in with Google, Google sends us your name, email address and profile picture; we never see your Google password. If you sign in by email, we send you a one-time link. We also store your workspace, its members and their roles, your settings and notification choices, API keys you create (only as a hash), and a log of the paid work done for your workspace (AI text, images, rendering) so we can show usage and enforce plan limits.

Legal basis: Art. 6 (1) (b) GDPR, the contract with you.

To make posts we read your app's public store listing (name, description, icon, screenshots) from the App Store or Google Play, and store what you add: screenshots and screen recordings of your app, persona details and their reference images, your image library, and the posts we plan and build for you (hooks, slides, captions, schedule). AI personas are fictional characters; their faces are generated, not taken from real people.

Legal basis: Art. 6 (1) (b) GDPR.

Kitefleet writes and makes posts with AI models. We send them only what the task needs:

• Anthropic receives text: your app's listing, your niche, persona descriptions, post texts, and captions or on-image text of public TikTok posts we analyse.
• OpenAI receives image prompts and the reference images a slide needs (persona references, your app screens).
• Modal runs our renderer, which turns finished images and texts into slides and videos.

Under their API terms, Anthropic and OpenAI do not use this data to train their models. Legal basis: Art. 6 (1) (b) GDPR.

When you connect a TikTok account, you sign in on TikTok and choose what Kitefleet may do. We use TikTok's official Login Kit, Display API and Content Posting API, and receive only the data of the scopes you grant:

• user.info.basic: open ID, union ID, avatar and display name, to identify the account and show you which account a draft goes to.
• user.info.profile: username, bio, profile link and verified status, so you pick the right account and the niche analysis knows its voice.
• user.info.stats: follower, following, like and video counts, for the account's trend and warm-up progress.
• video.list: your public posts with their caption, cover, link, duration and view, like, comment and share counts, to learn which formats work and plan the next week.
• video.upload: sends finished slideshows and videos to the account's TikTok inbox as drafts, with title and caption.

We send a draft only when you approve it, or when you have switched on scheduled delivery for that account. We never publish anything on your behalf: you open the draft in TikTok, add a sound and post it yourself. Posts made with AI personas are marked as AI-generated. Access tokens are stored encrypted and used only by our servers.

We don't sell TikTok data, don't share it with anyone beyond the processors below, and don't use it for advertising or to profile people. To find questions about your app, we also read the public comments under the posts of your connected accounts.

Disconnecting. Disconnect an account in Kitefleet (Fleet → the account → Disconnect) or remove Kitefleet from the apps connected to your account in TikTok's settings. Either way, we revoke our access and immediately delete the account's tokens and the TikTok data we stored for it (profile, stats, post stats and comments). Posts we made for you stay in your workspace until you delete them.

Legal basis: Art. 6 (1) (b) GDPR. For the public comments: Art. 6 (1) (f) GDPR; our legitimate interest is answering people who ask about your app.

Our format hunt looks for formats that work in your niche. Through our data providers ScrapeCreators and Apify we read public TikTok posts and their public numbers: the author's handle and follower count, caption, text on the images, sound, view, like, comment, share and save counts, and frames of the post. We compare formats, not people, and never contact the authors.

If you wrote such a post: legal basis is Art. 6 (1) (f) GDPR, our legitimate interest is understanding which formats work on TikTok. The data comes from TikTok's public pages (Art. 14 (2) (f) GDPR). Images and frames are deleted after 60 days. You can object at any time (see below).

Stripe sells your subscription as merchant of record (“Sold through Link”): it processes your payment details, calculates and pays sales tax and VAT, sends receipts and invoices, and handles refunds and disputes. Stripe is an independent controller for this; its own privacy policy applies. We never see your full card details. Stripe tells us your plan, subscription status, billing country and invoices. Legal basis: Art. 6 (1) (b) GDPR, and Art. 6 (1) (c) GDPR for records tax law requires.

We send sign-in links, invitations and the notifications you choose in Settings (posts ready for review, delivered drafts, finished hunts) through Resend. If you turn on browser notifications, your browser's push service (for example Google, Apple or Mozilla) delivers them. When you write to us, we use your message to answer it. Legal basis: Art. 6 (1) (b) GDPR, or (f) for messages not about a contract; our legitimate interest is answering you.

When you open an original TikTok post inside the app, TikTok's official player loads from tiktok.com and TikTok receives your IP address and browser data. It loads only when you open such a post. Legal basis: Art. 6 (1) (b) GDPR.

These service providers process data on our behalf under data processing agreements (Art. 28 GDPR). Where data leaves the EU, the transfer rests on the EU–US Data Privacy Framework for certified companies, otherwise on standard contractual clauses (Art. 46 (2) (c) GDPR).

• Vercel Inc. (USA): hosting of the website and the app; our servers run in Frankfurt, Germany.
• Neon (Databricks, Inc., USA): the database, stored in Frankfurt, Germany.
• Cloudflare, Inc. (USA): DNS and file storage (R2) for images, slides and videos, kept in the EU.
• Anthropic Ireland, Limited (Ireland): AI text models. Anthropic can process data in the USA, including through Anthropic, PBC.
• OpenAI Ireland Ltd. (Ireland): AI image models; onward transfers to the USA by OpenAI.
• Modal Labs, Inc. (USA): rendering slides and videos.
• Web Scraping Guy LLC (ScrapeCreators, USA) and Apify Technologies s.r.o. (Czech Republic): reading public TikTok data.
• Resend (Plus Five Five, Inc., USA): sending emails.

These receive data as independent controllers under their own terms:

• Stripe (Stripe, Inc. and its European entities): payments as merchant of record.
• Google Ireland Limited: only if you sign in with Google.
• TikTok (for the EEA: TikTok Technology Limited, Ireland): the drafts we upload to your inbox and the requests we make for your account.

We pass data to authorities only where the law requires it.

• Your account and workspace: until you delete them (Settings → General). Deleting a workspace locks it at once, ends its plan without a further charge, revokes its TikTok access, and deletes its data and every file it stored. Deleting your account removes you from every workspace. Database backups roll over within 30 days.
• After a deletion we keep only a note that the workspace was deleted (its id, its Stripe customer id and the dates) and a record of who already had a trial (workspace, Stripe customer, a fingerprint of the card or a hash of the Link email), so the trial stays once per customer. Legal basis: Art. 6 (1) (c) and (f) GDPR; our legitimate interest is proving the deletion and preventing trial abuse.
• TikTok tokens and TikTok data: until you disconnect the account (see above).
• Copies of a post made for delivery: deleted once TikTok has fetched them. Render intermediates: 30 days. Images and frames from public posts: 60 days.
• Sign-in links: 10 minutes. Sessions: until you sign out or they expire.
• Invoices and receipts: issued and kept by Stripe as merchant of record. Our own bookkeeping (Stripe's payout statements): up to 10 years as tax and commercial law require (§ 147 AO, § 257 HGB), blocked for any other use.
• Support emails: 6 months after the case is closed.

You have the right to:

• access your data (Art. 15 GDPR),
• have it corrected (Art. 16) or deleted (Art. 17),
• restrict its processing (Art. 18),
• receive it in a machine-readable format (Art. 20),
• withdraw a consent at any time, with effect for the future (Art. 7 (3)),
• lodge a complaint with a supervisory authority (Art. 77), for example ours: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Wiesbaden.

Write to hello@kitefleet.app. We answer within one month.

Where we process your data based on Art. 6 (1) (f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). We then stop, unless we can show compelling legitimate grounds that override your interests, or the processing serves legal claims. Write to hello@kitefleet.app.

No law requires it. Without an email address we can't create your account, and without a connected TikTok account we can't deliver drafts.

When we change how we process data, we update this page and its date. If a change affects you, we tell you by email before it applies.