KalloDraft — to be reviewed by a solicitor before Kallo is sold.
Privacy Policy
The short version. Kallo is a Mac app. Your videos, pictures, drafts and account settings stay on your Mac — we don’t receive a copy. When you connect TikTok, Instagram, YouTube or X, the access they give is stored on your Mac and used only to do what you approve. To write drafts, Kallo sends what it needs to the AI provider you choose, using your own account. A small server on getkallo.com swaps a platform’s sign-in code for access tokens and passes them to your Mac; it doesn’t store them. This website uses no cookies and no analytics.
1. Who we are
Kallo is operated by [OPERATOR LEGAL NAME], [ADDRESS] (“we”, “us”). We are the controller for the personal data described in section 3. You can reach us at [email protected]. This policy explains how Kallo — the macOS app and the website getkallo.com — handles personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. What stays on your Mac
Kallo does its work on your computer. The following is created and stored locally on your Mac, and is not sent to us:
- your businesses and accounts as you set them up in Kallo, including voice, look and brand notes;
- media you add (logos, photos, screenshots, footage) and everything Kallo makes (scripts, captions, images, voices, videos, slideshows);
- drafts, plans, schedules and your approval decisions;
- access tokens and basic profile details for platforms you connect (see section 4);
- post performance numbers Kallo reads back from your connected accounts so it can learn what works.
You control this data. Deleting Kallo’s data folder on your Mac deletes it. Some of it is sent directly from your Mac to services you choose — your connected platforms (section 4) and your AI provider (section 6) — but not to us.
3. What we hold
We hold only a small amount of personal data:
- Waitlist and beta account data — your email address and anything you choose to tell us (such as your name, business and the platforms you use), and whether you’ve been invited to the beta.
- Messages — emails you send to [email protected] and our replies, including any bug reports or files you attach.
- Technical data from our servers — when your browser or the Kallo app contacts getkallo.com, our hosting provider (Cloudflare) processes your IP address, the time, the page or endpoint requested and your browser or app version, to deliver the request and protect against abuse.
We do not receive your content, your media, your drafts or your platform passwords. We never see your passwords: you sign in on each platform’s own page.
4. Connected platforms
When you connect a platform, you sign in on that platform’s own page and choose what to allow. The platform then gives Kallo an access token (and usually a refresh token) for the permissions you approved. Kallo stores these on your Mac and uses them only to do what you ask, such as sending an approved video. Kallo asks only for the permissions it needs; the platform shows you the exact list when you connect.
TikTok
- Data received (via TikTok Login Kit): your TikTok
open_id(an ID unique to Kallo), display name and avatar image, and the access and refresh tokens for the permissions you granted. - What Kallo does with it: shows you which account is connected, and — only after you approve a draft — uploads the video from your Mac to TikTok using the TikTok Content Posting API, so it arrives in your TikTok drafts/inbox for you to finish and post.
Instagram (Meta)
- Data received (via Instagram Login / the Instagram API): your Instagram professional (business or creator) account ID, username and profile picture, and an access token for the permissions you granted.
- What Kallo does with it: shows which account is connected, and — only after you approve a draft — sends the video or images and caption to Instagram to create the post (for example a Reel). Where you allow it, Kallo also reads basic insights for your own posts so it can learn what works.
YouTube (Google)
- Data received (via Google sign-in and the YouTube Data API): your YouTube channel ID, channel name and thumbnail, and OAuth access and refresh tokens for the scopes you granted.
- What Kallo does with it: shows which channel is connected, and — only after you approve a draft — uploads the video to your channel as a Short using the YouTube Data API.
- Kallo’s use of Google data is limited as described in section 12. YouTube’s terms apply: YouTube Terms of Service, and Google’s privacy policy at policies.google.com/privacy.
X
- Data received (via X sign-in): your X user ID, @handle, name and profile picture, and access and refresh tokens for the permissions you granted.
- What Kallo does with it: shows which account is connected, and — only after you approve a draft — sends the post and its media to X.
Content you publish is then handled by that platform under its own privacy policy. We don’t sell platform data, use it for advertising, or share it with anyone else.
5. The token-exchange server
Some platforms require a secure server to complete sign-in, because the app’s “client secret” must not be shipped inside the app. So getkallo.com runs a small function that does one thing: it takes the one-time sign-in code the platform sends back after you approve, exchanges it with the platform for access tokens, and passes those tokens straight back to Kallo on your Mac. It does the same when a token needs refreshing.
It does not store your tokens, your code, your content or your profile. They pass through in memory for the length of that request. The only record is the standard technical data described in section 3, kept by our hosting provider for security.
The page at getkallo.com/oauth/callback simply hands the sign-in code back to the Kallo app on your Mac; it runs in your browser and does not send the code anywhere else.
6. AI providers
Kallo uses an AI provider that you choose and connect with your own account — for example your own Anthropic (Claude) or OpenAI subscription or API key. To plan and write drafts, Kallo sends that provider what it needs directly from your Mac: typically your brand and account notes, recent drafts and results, your instructions, and sometimes images or screenshots you’ve chosen to use. If you switch on optional image or voice services, the text or picture needed for that step is sent to the service you set up.
Those providers process the data under their own terms and privacy policies, which apply to your account with them (for example Anthropic’s privacy policy and OpenAI’s privacy policy). We don’t receive this data. Please don’t put sensitive personal data about other people into Kallo unless you have a lawful reason to.
7. Purposes and lawful bases
| What we do | Data | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| Keep a waitlist and invite you to the beta | Email, what you tell us | Consent — you can withdraw any time |
| Provide beta access and support, and reply to you | Beta account data, messages | Contract (providing Kallo), or legitimate interests in answering enquiries |
| Complete platform sign-in (token exchange) | Sign-in code and tokens, in transit only | Contract — it’s needed to connect the account you asked us to connect |
| Keep our website and servers secure | Technical data | Legitimate interests in security and preventing abuse |
| Comply with law and handle disputes | Any of the above, as needed | Legal obligation; legitimate interests |
We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects. We don’t sell personal data.
8. How long we keep data
- Waitlist data: until you join the beta, ask us to remove you, or we close the waitlist.
- Beta account data and messages: while you use Kallo, then up to 24 months after our last contact, unless we need it longer for a legal claim.
- Token-exchange data: not stored — only held in memory during the request.
- Technical data: kept by our hosting provider for a short period in line with its standard log retention.
- Data on your Mac: until you delete it. Removing Kallo’s data folder deletes it.
9. International transfers
Our website and token-exchange server run on Cloudflare’s global network, and our email may be handled by providers outside the UK. Where personal data we control leaves the UK, we rely on UK adequacy regulations (including the UK–US “data bridge” for certified US companies) or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Data you send from your Mac to platforms and AI providers goes to them under your own agreements with them.
10. Your rights
Under UK GDPR you have the right to: access your personal data; have it corrected; have it erased; restrict or object to our processing; receive it in a portable format; and withdraw consent at any time (without affecting what we did before). To use any of these rights, email [email protected]. We will reply within one month, and may need to confirm your identity first. See also Data deletion.
11. Revoking platform access
You can disconnect any platform inside Kallo at any time; this deletes its tokens from your Mac. You can also revoke Kallo’s access from the platform itself:
- TikTok: in the TikTok app, Profile → Menu (☰) → Settings and privacy → Security and permissions → Apps and services permissions → Kallo → Remove access.
- Instagram: Settings and activity → Website permissions → Apps and websites → Kallo → Remove.
- YouTube / Google: go to myaccount.google.com/connections → Kallo → Delete all connections you have with Kallo.
- X: x.com/settings/connected_apps (Settings and privacy → Security and account access → Apps and sessions → Connected apps) → Kallo → Revoke app permissions.
Menu names can change slightly between app versions. Full steps are on the data deletion page.
12. Google API data
Kallo’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In practice: Kallo uses YouTube data only to show you which channel is connected and to upload videos you have approved. We don’t transfer it to anyone except as needed to provide that feature, for security, or to comply with law; we don’t use it for advertising; we don’t use it to train AI models; and no human reads it unless you ask us to for support, it’s needed for security or the law requires it.
13. Children
Kallo is a tool for businesses and is not directed at children. You must be 18 or over to use it. Children under 13 are not allowed to use Kallo, and we do not knowingly collect personal data from them. If you believe a child has given us personal data, email us and we will delete it.
14. Security
Connections between Kallo, our server and the platforms use HTTPS. Because your content and tokens live on your Mac, its security matters: keep macOS up to date, use a login password and turn on FileVault disk encryption. No system is perfectly secure; if we become aware of a breach affecting data we hold, we will act promptly and notify you and the ICO where the law requires.
15. Cookies and this website
getkallo.com sets no cookies, runs no analytics or advertising trackers, and serves its fonts itself (so visiting doesn’t contact Google Fonts). The waitlist button opens an email in your own email app; nothing is submitted to a server.
16. Changes
We’ll update this policy as Kallo changes — for example when it leaves beta — and change the date at the top. For significant changes we’ll tell you in the app or by email.
17. Contact and complaints
Controller: [OPERATOR LEGAL NAME], [ADDRESS]. Email: [email protected].
If you’re unhappy with how we handle your data, please tell us first. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint, or call 0303 123 1113.