Privacy Policy

Kyte is a social media management platform built for agencies. Because of this, several categories of people interact with our Service:

• Agencies — our direct customers, who create and pay for workspaces.
• Agency team members — individuals invited to a workspace.
• Clients— the agency's own customers, who may be invited to review content, complete brand onboarding, or join team chats.
• End users / audiences — the social media users whose public content, comments, messages, and aggregate audience data flow into the Service through connected social media accounts.

This Policy applies to all of the above. It does not govern the privacy practices of the third-party social media platforms you connect, which are governed by their own policies.

For some personal information, we act as a data controller — we decide why and how it is processed. This includes account registration data, billing data, and information we collect about how you use the Service.

For other personal information, we act as a data processor (service provider) acting on behalf of our customers. This includes content, brand information, and social media data that an agency uploads or connects to a workspace. In those cases, the agency (or its client) is the controller, and we process the data only to provide the Service and on the customer's instructions.

3.1 Information you provide directly

• Account and registration data: name, email address, password, company name, and user role.
• Brand and onboarding information: when an agency or its client completes brand onboarding, we collect details such as the services the company provides, its competitors, its differentiators, its pricing, words to use or avoid, brand assets, and similar context. This information is collected to provide context for creating and managing content within the workspace.
• Content you upload or create: captions, posts, media library assets, brand assets, comments, tasks, and messages within the Service.
• Communications: information you provide when you contact us for support or other inquiries.

3.2 Payment information

We use Stripe to process payments. Payment card details are collected and processed directly by Stripe under its own privacy policy. We do not store full payment card numbers on our systems. We retain limited billing records (such as plan, transaction history, and invoices) as required for accounting and tax purposes.

3.3 Information from connected social media platforms

When you connect a social media account, you authorize us (through the platform's authentication/OAuth process) to access certain information on your behalf. Depending on the platform and the permissions you grant, this may include:

• Profile information for the connected account;
• Posts and published content;
• Analytics and insights;
• Comments and direct messages (for community management through the social inbox);
• Audience and engagement data.

We access this information only to provide the Service to you — for example, to schedule and publish content, display analytics, and let you manage interactions. We describe how we handle this data in Section 5.

3.4 Usage and technical data

When you use the Service, we automatically collect technical information such as IP address, device and browser type, pages visited, features used, and timestamps. We may use a product analytics provider (such as PostHog) to understand which parts of the product are most used so we can improve it.

3.5 Cookies

We currently use essential cookies required for the Service to function (for example, to keep you logged in and to maintain security). We may also use limited analytics cookies to improve the product. See Section 12 for details.

We use personal information to:

• Provide, operate, and maintain the Service;
• Create and manage accounts and workspaces;
• Schedule, publish, and manage content across connected platforms;
• Provide analytics, reporting, and community-management features;
• Process payments and manage subscriptions;
• Provide customer support and respond to inquiries;
• Improve, secure, and develop the Service;
• Detect, prevent, and address fraud, abuse, and security issues;
• Comply with legal obligations and enforce our Terms of Service.

Legal bases (for users in the EEA/UK). Where applicable, we rely on: performance of a contract (to provide the Service); legitimate interests (to secure and improve the Service); consent (for non-essential cookies, where required); and compliance with legal obligations.

We treat data obtained through connected social media platforms with particular care, and in accordance with each platform's developer and platform terms.

• We use platform data solely to run, support, and maintain the features you requested — for example, to schedule and publish content, display analytics, and let you manage interactions.
• We do not sell platform data.
• We do not use platform data for advertising, and we do not use it to build independent profiles of individuals outside the Service.
• We only conduct analytics on platform data that has been aggregated and/or anonymized, so that it cannot be associated with a particular individual, browser, or device.
• We share platform data only with your consent or as required to provide the Service, and only with the service providers (subprocessors) listed in Section 6 that are necessary to operate the Service. We require those service providers (and their sub-providers) to protect the data and to delete it when required.
• We store access tokens securely and use them only to perform the actions you request.
• We delete platform data and associated access tokens when you disconnect the social media account, when your account is closed, or when retention is no longer necessary to provide the Service — whichever comes first — and we ensure our service providers do the same.

This Policy is not intended to supersede, modify, or be less protective than the terms and policies of any connected platform. If a platform's policies impose stricter requirements than this Policy, we comply with those requirements for that platform's data.

We do not sell personal information. We share information only as follows:

• With service providers (subprocessors) who process data on our behalf to operate the Service: Amazon Web Services (AWS) — application hosting, database, and media storage (Canada); Supabase — authentication identity provider; Stripe — payment processing; Resend — transactional email delivery; Canva — design integration (when you connect or use it); Google Drive — file integration (when you connect or use it); Google Calendar — calendar integration (when you connect or use it); PostHog — product analytics (where used).
• Within your workspace — with team members and, where invited, clients, according to the permissions set in the workspace.
• With connected social media platforms — as needed to publish and manage content you direct us to.
• For legal reasons — to comply with applicable law, legal process, or enforceable governmental requests, or to protect the rights, property, or safety of Kyte, our users, or others.
• In a business transfer — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

Our database and primary infrastructure are hosted in Canada on AWS (ca-central-1); Supabase provides authentication services. Some service providers may process limited data outside your country. Where we transfer personal data internationally, we take steps to ensure it is protected in accordance with applicable law (for example, by relying on adequacy decisions or appropriate contractual safeguards such as Standard Contractual Clauses).

We retain personal information for as long as it is needed to provide the Service and for the purposes described in this Policy. Specifically:

• Active accounts: we retain account and content data for the life of the account.
• After cancellation or closure: we provide a 30-day grace period during which you may reactivate or export your data; after that, we delete account and content data within 90 days.
• Social media platform data: deleted promptly when you disconnect the relevant account or close your account.
• Financial and billing records: retained as long as required by applicable Canadian tax and accounting law (typically six to seven years).
• Backups: purged on a rolling cycle.

When we delete personal information, we also require our service providers (and their sub-providers) to delete it without undue delay, except where it has been aggregated or anonymized so that it can no longer be associated with an individual. We may retain limited information where necessary to comply with legal obligations, resolve disputes, or enforce our agreements.

We maintain administrative, physical, and technical safeguards designed to protect personal information and to meet or exceed industry standards appropriate to the sensitivity of the data. We rely on the security infrastructure of our providers, AWS and Supabase, including encryption in transit and at rest and access controls managed through those platforms. We require our service providers to maintain comparable protections. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Depending on where you live, you may have rights regarding your personal information, including the right to access, correct, delete, restrict, or object to processing, and the right to data portability. Where processing is based on consent, you may withdraw it at any time.

• EEA/UK (GDPR): the rights described above, plus the right to lodge a complaint with a supervisory authority.
• California (CCPA/CPRA):the rights to know, delete, correct, and opt out of "sale" or "sharing" of personal information. We do not sell personal information. We will not discriminate against you for exercising your rights.
• Canada (PIPEDA / Québec Law 25):the rights to access and correct your personal information and to file a complaint with the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec.
• Brazil (LGPD) and other jurisdictions: equivalent rights as provided by applicable law.

Where we act as a processor on behalf of an agency or client, please direct requests to that customer; we will assist them in responding. You may also withdraw consent or limit our processing at any time — for example, by disconnecting a social media account, adjusting your settings, or closing your account. Withdrawing consent does not affect processing already carried out. To exercise your rights, contact us at hello@kytesocial.ai. We may need to verify your identity before responding.

All users may request deletion of their data, regardless of where they live. You may request deletion of your personal information, including data obtained from connected social media platforms, by:

• Disconnecting the relevant social media account within the Service, and/or
• Deleting your account from your account settings, and/or
• Emailing hello@kytesocial.aiwith the subject line "Data Deletion Request."

Upon a verified request, we will delete the relevant personal information — and ensure our service providers delete it — in accordance with Section 8, except where retention is required by law. For step-by-step instructions, see our Data Deletion page.

We currently use:

• Essential cookies — necessary for the Service to function (authentication, security, and session management). These cannot be disabled.
• Analytics cookies — where used (for example, PostHog), to understand product usage and improve the Service.

You can control cookies through your browser settings. Disabling essential cookies may prevent the Service from working properly.

The Service is intended for business use and is not directed to anyone under 18 years of age. We do not knowingly collect personal information from individuals under 18. If you believe a minor has provided us with personal information, contact us and we will delete it.

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

Adverb Marketing Inc. (d/b/a Kyte Social)
1800, boulevard Le Corbusier, suite 124, Laval, Québec, H7S 2K1, Canada
Email: hello@kytesocial.ai