Legal
Privacy Policy
Last updated: 26 October 2026
On this page
1. Controller
Klaket is the controller of personal data on Klaket (klaket.io). For any privacy question or to exercise your rights, write to klaket.support@gmail.com.
2. Data we process
Account data: name, email, password (stored only in hashed form), language and plan; if you sign in with Google, the name and email of your Google account. Payments: handled by Link/Stripe — we never see or store your card details, only the subscription status and a customer ID. Content: product photos and descriptions, ideas, scripts, and the generated videos, images, posts and landing pages. Your own personas and influencers: the photo you upload, the name you give them and an automatically generated description of their appearance; the photo is checked automatically to refuse minors, public figures and nudity. Purchases through Hotmart: Hotmart handles the payment and sends us the buyer's name and email, the plan, the payment status and, if any, the name of the affiliate who referred the purchase. Leads received on your landing pages (processed on the customer's behalf, see section 4). Technical and security data: IP address, a random browser identifier (in a cookie and local storage) and a technical device signature (for example screen size, time zone, language and browser characteristics) — all stored only in an irreversibly hashed form — and error logs.
3. Why we use data and on what basis
To provide the service you asked for — account, generating content, saving your work, sending service emails (welcome, payments, password recovery) — based on performance of the contract. For invoicing and tax obligations, based on legal obligation. To prevent fraud and abuse (for example, multiple accounts to get free credits), keep the service secure and fix errors, based on our legitimate interest. To automatically check the photos of people you upload (and refuse minors, public figures and nudity), based on our legitimate interest; having the right to use the likeness of anyone in your photos is your responsibility. We do not sell your data, do not use it for advertising and do not use it to train AI models.
4. Landing page leads
Data submitted by visitors through our customers' landing page forms belongs to those customers, who are the controllers. Klaket processes it only as a processor, to store it, show it and email it to the customer, and deletes it when the customer deletes it or their account. To exercise your rights over that data, contact the business you gave it to.
5. Connecting AI assistants (Claude)
If you connect Klaket to an AI assistant, such as Claude (Anthropic), you authorize that assistant to use your Klaket account through Klaket's tools, with the consent you give on the «Authorize» screen. The assistant sends us only what each request needs (for example, the video idea, the chosen product, the options and, if you provide them, links to product photos) and receives the result: the status of the creation, your credits, your products and the images, videos, posts and pages created. It never receives your password or payment details, and Klaket does not receive your conversations with the assistant. What you write to the assistant is processed by the company that provides it (for Claude, Anthropic) under its own privacy policy. Access tokens are stored only in hashed form: each is valid for 1 hour and is renewed automatically for up to 60 days. Post images shown in the assistant use private links that expire after 7 days. You can disconnect an assistant at any time in «Settings»; all of them are disconnected when you change your password or delete your account.
6. Klaket for Shopify
If you install the Klaket app in your Shopify store, Shopify sends us your store's name, domain and plan and the store's contact email (kept only in an irreversibly hashed form, to prevent abuse of free credits), and gives the app access only to what it needs: reading your products (title, description, type and photos) to create videos and posts, and adding a video you choose to a product's media. The app does not access customer or order data and never changes your products' title, description, price or photos. We keep a copy of the products you use (with up to 3 photos) and an encrypted access token. Plans and payments are handled by Shopify: we only receive the plan you chose. When you uninstall the app, access ends immediately and, 48 hours later, when Shopify asks us to, we delete the store's Klaket account and its content (copies of product photos, videos and posts). Videos you added to product pages stay in your store. To prevent free credits from being claimed again, after deletion we keep only the store's ID and myshopify domain and the owner's email in irreversibly hashed form, for up to 24 months.
7. Providers (processors)
To operate, Klaket relies on trusted providers, which process data only to provide the service and are bound to protect it: website and database hosting; artificial intelligence models to generate images, video, voice, captions and text, and file storage; payments and invoicing; email delivery; and authentication, only if you choose to sign in with Google. You can ask for the list of these providers by writing to klaket.support@gmail.com.
8. Transfers outside the EU
Some of these providers are in the United States. In those cases, transfers rely on the safeguards provided by the GDPR, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
9. How long we keep data
Account data and your content are kept while your account exists. When you delete your account, we immediately delete from our database the account, projects, products, posts, landing pages, leads, your own personas and credits; generated files are no longer linked to you and remain at unique, non-public addresses in the provider's storage until the provider deletes them. To prevent abuse of free credits, even after an account is deleted we keep only the irreversibly hashed versions of the email, browser identifier, device signature and IP used to receive them, for 24 months; the hashed email of a deleted account is kept to prevent a new account from being created with it. Invoices are kept by Link/Stripe for the period required by tax law. Password recovery requests expire after 1 hour and sessions after 30 days.
10. Cookies
We only use cookies necessary for the service to work and stay secure: kl_session (keeps you signed in, 30 days), kl_oauth (secures Google sign-in, 10 minutes), kl_locale (remembers your language, 1 year), kl_dev and kl_did (identify the browser to prevent abuse of free credits, 2 years), kl_fp (hashed device signature, for the same purpose, 30 days), kl_ref (remembers a friend's invite code, 30 days), kl_goal (remembers the revenue calculator value, 30 days), kl_from (remembers which site you came from on your first visit — just the domain — and the campaign, so we know where sign-ups come from, 90 days) and kl_tz (your browser's time zone and language, so we know which country sign-ups are from, 30 days). We do not use third-party advertising or analytics cookies.
11. Security
We use encrypted connections (HTTPS), passwords are stored with strong hashing, access to data is restricted, and uploaded photos are stripped of metadata (including GPS location) before being stored.
12. Your rights
You can request access, rectification, erasure, restriction, objection and portability of your data, and withdraw consent at any time, by writing to klaket.support@gmail.com. You can delete your account yourself under “Settings”. You also have the right to lodge a complaint with a supervisory authority, such as the one in your country (in Portugal, the CNPD).
13. Minors
Klaket is intended for people aged 18 and over and does not knowingly collect data from minors.
14. Changes
If we change this policy in a material way, we will let you know by email or on the platform before the changes apply.