Privacy Policy

1. Information we collect

Depending on how the Service is used, we collect:

• Account information — name, email, business/account details, and billing information provided at signup or through our payment processor, Stripe.
• Customer Data — the contact records, call recordings and transcripts, SMS and email content, chat conversations, and website/landing-page analytics that a Customer's use of the Service generates or imports (including, where the KLCT WordPress plugin is installed and its optional settings are enabled, a logged-in WordPress visitor's name and email, or WooCommerce order history, order count, and cart total).
• Usage and device data — log data, IP address, browser and device information, and interactions with klctai.com and the application, including through cookies and similar technologies.
• Integration data — data exchanged with third-party services a Customer connects, such as a CRM, calendar, or ad platform.

2. How we use information

We use information to:

• Provide, operate, secure, and support the Service, including AI-generated calls, messages, and recommendations;
• Process payments and manage subscriptions and usage-based billing;
• Communicate with Customers about the Service, including support and service-related notices;
• Monitor, troubleshoot, and improve the Service's performance and reliability; and
• Comply with legal obligations and enforce our Terms of Service.

Operating AI features may require sending relevant portions of Customer Data to third-party AI providers (see Section 3) so they can generate a response, transcript, or summary. We do not sell personal information.

3. Third-party service providers

We use the following categories of third-party providers (subprocessors) to operate the Service. Each processes data on our behalf, under its own terms and security commitments, only as needed to provide its part of the Service:

• Voice and AI — Vapi.ai and OpenAI, for AI-generated calls, replies, and content;
• Telephony and messaging — Twilio, for SMS and voice delivery;
• Payments — Stripe, for subscription billing and payment processing;
• CRM and scheduling — HubSpot, Salesforce, Calendly, and Monday.com, where a Customer connects them;
• Social and advertising — Meta (Facebook, Instagram, and Meta Ads), where a Customer connects their accounts to publish content, manage ads, or receive messages in the Service;
• Social video — TikTok, where a Customer connects their account to publish videos and photo posts (see "TikTok" under Section 7);
• Google — Google Ads, Analytics, and Merchant Center, where a Customer connects them (see Section 8);
• Video — Daily.co, for video calling features; and
• Infrastructure — cloud hosting, storage, and real-time messaging providers used to run and secure the Service.

4. Cookies

klctai.com uses cookies and similar technologies for essential site functionality and to understand aggregate site usage. The KLCT application uses cookies to keep you signed in and to remember account preferences. You can control cookies through your browser settings; disabling them may affect parts of the Service.

5. Data retention

We retain Customer Data for as long as a Customer's account is active and as needed to provide the Service, plus a reasonable period afterward to comply with legal, tax, or audit obligations and to resolve disputes. A Customer can request deletion of their Customer Data as described in Section 7, subject to those same obligations.

6. Security

We use administrative, technical, and physical safeguards designed to protect information against unauthorized access, use, or disclosure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Your rights and choices

Depending on your location, you may have rights to access, correct, delete, or receive a copy of your personal information, or to object to or restrict certain processing. To exercise these rights, or if you are an End User with a question about a specific business's use of the Service, contact us at support@klctai.com; we will route the request appropriately, including to the relevant Customer where they control the data.

Deleting your Facebook and Instagram data

When a Customer connects Facebook, Instagram, WhatsApp Business, or Meta Ads, we receive data from Meta on their behalf: access tokens, the Pages, ad accounts, and profile details they authorize, content published through the Service and its results, ad performance, and messages sent to them on Instagram and WhatsApp. You can have this Meta data deleted at any time. This deletes your Meta data only; it does not delete your KLCT account, which stays exactly as it is.

We delete:

• your Meta connections and the access tokens we hold for them;
• Instagram and WhatsApp conversations received through the Service, and any media downloaded from Meta;
• post identifiers, links, and results, and daily ad performance, that Meta returned to us; and
• Instagram handles, user IDs, and profile pictures saved on contacts.

Posts and ad campaigns you drafted in the Service keep their own text and images, without the identifiers and results Meta attached. Campaigns already running on Meta keep running there until you pause them in Meta Ads Manager. Everything else in your account, including billing records we are required to keep, is not affected.

The full details, and the steps for each of the three ways to ask, are at klctai.com/data-deletion. In short: remove KLCT in Facebook (Settings & privacy → Settings → Apps and Websites) and request deletion, delete it yourself as an account admin under Integrations → Delete my Meta data, or email privacy@klctai.com. Each deletion gets a confirmation code you can use to check its status.

TikTok

KLCT lets businesses connect a TikTok account so KLCT's Social Autopilot can publish the videos and photo posts they create and approve in KLCT.

Information we receive from TikTok

When you connect TikTok through TikTok Login Kit, and only with your permission, KLCT receives:

• Your basic profile information (user.info.basic): your TikTok open ID, display name and avatar, used to show which account is connected.
• Permission to post content to your account (video.publishand video.upload): used only to publish, or send to your TikTok drafts, the content you scheduled in KLCT.
• Your TikTok posting options (who can view, whether comments, Duets and Stitches are allowed, and the maximum video length): read before each post so KLCT respects your choices.
• Statistics for the posts KLCT published (video.list): likes, comments, shares and views, shown in your KLCT reports.

How we use and protect it

KLCT uses TikTok data only to publish the content you chose and to show you how it performed. We never post without your approval or schedule.

We do not sell TikTok data, share it with advertisers, or use it to train AI models.

Access and refresh tokens are stored encrypted and are used only to call TikTok on your behalf.

Disconnecting and deleting your data

You can disconnect TikTok at any time in KLCT under Integrations. When you disconnect, KLCT revokes its access with TikTok and stops all posting. You can also remove KLCT's access from your TikTok app settings (Settings and privacy → Security → Manage app permissions). To have your TikTok data deleted from KLCT, follow the steps at klctai.com/data-deletion or email hello@getklctai.com.

8. Google user data

When you connect a Google service, KLCT accesses only the data needed for the features you turn on:

• Google Ads: we create and manage campaigns you approve (budgets, campaigns, ad groups, keywords, ads, conversion actions), and read their performance (impressions, clicks, conversions, cost, keyword and search-term statistics) to report results to you and improve your ads.
• Google Analytics: read-only. We read sessions, users and conversions for the property you select and show them in KLCT. We never change anything in Google Analytics.
• Google Merchant Center: read-only use. We read your product status to show feed health and to link your Shopping campaigns. We never change your products.

How we use AI with this data

KLCT uses AI to write and improve ad text for you. To do that, your own Google Ads performance results (for example which keywords and ads converted) may be sent to the AI services we use (Anthropic, OpenAI and Google Gemini, through their paid business APIs) or to models we host ourselves. These providers process the data only to return results to KLCT and do not use it to train their models. Google Analytics and Merchant Center data is never sent to AI services.

Aggregated statistics

KLCT keeps anonymized, aggregated statistics of how ad-copy features perform (for example, whether question headlines get more clicks), including across customers, to rank new ad drafts. These statistics contain no account identifiers or personal data, are never sold or shared with third parties, and are never used to train AI or machine-learning models.

Limited Use

KLCT's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising unrelated to your account, or use raw or derived Google user data to develop, improve or train generalized AI or machine-learning models.

Your control

You can disconnect any Google service at any time from Settings → Integrations in KLCT, or from your Google Account's third-party access page. When you disconnect, we stop accessing your Google data and delete the stored access tokens and the selected account.

KLCT for Gmail (Chrome extension)

The KLCT for Gmail extension works inside the Gmail page in your browser. It does not use the Gmail API and cannot read your mailbox on its own. It handles only the messages you write or open while it is installed and connected to your KLCT account:

• Contact lookup: when you open a thread, the extension sends the other person's email address to KLCT to show their contact record beside the thread.
• Emails you send: when logging is on for an email (you can switch it off per email), the extension adds a private KLCT address in Bcc. KLCT receives that copy (recipients, subject and message) and saves it on the recipient's contact record. Addresses on your own team and role addresses such as noreply@ are skipped.
• Replies you open: when you open a message from someone who is already a contact in your KLCT account, the extension sends that message's text (without the quoted earlier messages) to KLCT, which saves it with the email it answers. Messages from anyone who is not already a contact are never sent to KLCT; only their address is looked up.

The extension keeps only its connection token and your settings in your browser's extension storage. Email content saved in KLCT is visible only to your KLCT account's users and is handled under this policy like any other customer data. It is sent to an AI service only when you use an AI feature on it in KLCT (the same providers and terms as above, never used to train their models). We do not sell this data, use it for advertising, or share it except as described in this policy. You can disconnect the extension at any time from its toolbar menu or from Integrations in KLCT, which revokes its access immediately, and you can uninstall it from Chrome at any time.

9. International data transfers

We and our service providers may process and store information in countries other than where you are located. Where required, we use appropriate safeguards for such transfers.

10. Children's privacy

The Service is intended for business use and is not directed to children. We do not knowingly collect personal information from children under 16.

11. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice.

12. Contact us

Questions about this Privacy Policy can be sent to support@klctai.com.