Privacy policy

English translation provided for convenience. The French version is the legally binding one.

This policy describes how Klaivo (“we”) collects and processes your personal data when you use the klaivo.co website and application, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.

1. Data controller

The data controller is Ahmed Daouda, sole proprietor (EI) and publisher of Klaivo, 128 Rue de la Boétie, 75008 Paris, France. Contact: klaivo.co@gmail.com.

2. Data collected

• Account: email address, first/last name (or nickname), password (encrypted) or Google identifier if signing in with Google.
• Created content: briefs, prompts, generation parameters, uploaded product images, generated videos and audio.
• Credits & billing: credit balance, operation history, subscribed plan. Payment data (card) is processed directly by Stripe; we do not store it.
• Product pages submitted to Url to Ad: the page address, its text and its images, to write your ad.
• Contact messages: name, email address and content of the message sent through the contact form.
• Technical data: connection logs, IP address, browser type, for security and proper operation. The IP address is also used to limit the number of free analyses per day, against abuse.

3. Purposes and legal bases

• Provide the ad generation service (performance of the contract).
• Manage your account, credits and billing (performance of the contract).
• Ensure security, prevent fraud and abuse (legitimate interest).
• Respond to your support requests (legitimate interest).
• Comply with our legal and accounting obligations (legal obligation).

4. Processors and recipients

We use providers that process certain data on our behalf:

• Supabase — database hosting, authentication and storage (European Union).
• Hetzner Online GmbH — application server hosting (Germany, EU).
• Stripe — payment and billing processing.
• Google (Gemini API) — generation of scripts, voiceovers and music from your briefs.
• Google (Sign-In) — signing in with your Google account, including the one-click sign-in offered on our public pages.
• muapi.ai — video generation from your prompts and product images.
• Firecrawl — reading some product pages submitted to Url to Ad (receives the page address).
• Resend — delivering contact-form messages to our mailbox.

Some of these providers may be located outside the European Union (notably in the United States). In that case, transfers are governed by appropriate safeguards (European Commission standard contractual clauses or equivalent mechanisms).

5. Retention period

• Account data and content: for the lifetime of the account, then deleted within a reasonable time after it is closed. Deleting a project also erases the product photos attached to it.
• Contact messages: for as long as needed to handle your request and follow up on it.
• Billing data: kept for the applicable legal period (up to 10 years for accounting records).
• Technical logs: limited duration for security purposes.

6. Your rights

Under the GDPR, you have the following rights:

• Right of access, rectification and erasure.
• Right to restriction of and objection to processing.
• Right to data portability.
• Right to set directives regarding the fate of your data after your death.

To exercise these rights, write to klaivo.co@gmail.com. We reply within one month. You may also lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr).

7. Cookies

We use cookies strictly necessary for the service to work, in particular for authentication (Supabase session). These cookies do not require consent. No advertising cookie is set without your agreement.

On our home, pricing and use-case pages, we load Google's sign-in service to offer one-click sign-in (“Google One Tap”) to visitors who are not signed in. If you are signed in to Google, Google may know that you visited the page. Klaivo receives no data unless you choose to sign in; you can close the prompt, and Google then shows it less often.

We measure site traffic with Umami, hosted on our own server: it sets no cookie, does not track visitors across sites, and its statistics are anonymous.

8. Security

We implement appropriate technical and organizational measures to protect your data (password encryption, restricted access, per-user data isolation).

9. Changes

This policy may be updated. The date of the last update appears at the top of the page.