Privacy Policy
Last updated: 14 October 2026
1. Roles: who decides what
Kadaleo is operated by the sole trader identified at the end of this page. Kadaleo has two roles.
- Controller. For our own account and login data, billing and tax records, security, support, product telemetry, and our own marketing and prospect outreach, Kadaleo decides why and how personal data is used.
- Processor. For the data of a business customer's own customers (CRM contacts, conversations, bookings, website enquiries, payment details and consent records), Kadaleo acts on the business's documented instructions under our Data Processing Agreement. The business is the controller of that data and is responsible for its own privacy notice and lawful basis.
- Connected platforms. Meta (Instagram, Facebook, Threads, WhatsApp and Messenger), TikTok, Pinterest, X, Telegram and Google (including YouTube) are generally independent controllers of the data in their own services. For WhatsApp Business messaging, Meta processes messages under the WhatsApp Business Data Processing Terms.
If you are a customer of a business that uses Kadaleo, ask that business first. We forward the requests we receive and help the business answer them.
2. Data we collect, by source
We collect only what each part of the Service needs.
| Source | Data |
|---|---|
| You and your team | Name, email address, a one-way hash of your password or your Google sign-in identity, business details you enter (name, address, phone, opening hours, services, prices, photos, social handles), and your team members' names, emails and roles. |
| Billing | Plan, invoices, billing country, the VAT or tax number you enter, and payment status. Card details are entered on Stripe's pages and Kadaleo does not receive card numbers. |
| Your customers (we process it for you) | Contact details, messages and conversations on the channels you connect, bookings, enquiries from your website forms, invoices and payment status, and WhatsApp and email consent records. |
| Accounts you connect | Account identifiers, names and handles, profile pictures, follower counts, posts, comments, messages and insights, as described under Connected platforms. Access tokens are stored encrypted. |
| Visitors to a website Kadaleo hosts for a business | Form and booking submissions, and technical request data (such as IP address and page requested) in server logs. The business is the controller of what its visitors submit. |
| Visitors to kadaleo.com | Technical request data (such as IP address and page requested) in server logs, and your cookie choice, which stays in your browser. We do not load advertising or analytics trackers on kadaleo.com. |
| Support | What you write in a support case, the page you attach, and technical diagnostics for that case. |
| Operation of the Service | Short-lived technical event records for troubleshooting, counts and costs of AI usage per business, which paid features an account tried to use without a plan, and which account e-mails we sent. |
| Prospects and business contacts | Business name and one public contact email from the business's own website or the public company register, and the Google place identifier, used for our own outreach (see Business contacts and prospects). |
3. Why we use data, legal bases and how long we keep it
Legal bases are those of Article 6 of the GDPR. For data we process on behalf of a business, the business chooses the basis.
| Purpose | Legal basis | How long |
|---|---|---|
| Account and service delivery | Contract | While the account is open, then the closure schedule below |
| Billing, invoices and tax records | Legal obligation | 10 years after the end of the year the record belongs to (Portuguese tax and accounting rules), or longer where the law requires |
| Security, abuse prevention and product telemetry | Legitimate interests | Telemetry 7 days; server access logs (IP address masked) 30 days; error reports up to 90 days; the operator audit log 3 years from the event, its detail payloads 12 months |
| Support cases | Contract and legitimate interests | While the account is open; deleted with the account when it is closed (see How to delete your data below) |
| Consent records (WhatsApp, email) | Legal obligation and legitimate interests (proof of consent) | While the consent is used and up to 5 years after |
| Our own prospect outreach | Legitimate interests, and only towards companies and other legal persons (see Business contacts and prospects) | Replies 180 days and sent messages 365 days, then the text is removed; the record of who asked us to stop is kept as long as it is needed |
| AI quality checks | On the business's instructions for its customers' data; legitimate interests for Kadaleo's own data | Same as the underlying data |
| Notices about your account, trial, plan and payments | Contract; for a contact person at a company, legitimate interests | While the account is open; the record of which notice we sent is deleted with the account |
| Tips and offers about Kadaleo for account owners (at most two e-mails during the trial) | Legitimate interests, under the existing-customer rule of article 13.º-A(3) of Lei n.º 41/2004: you can refuse when you sign up and unsubscribe in every message | Until you unsubscribe or close the account; the record of a refusal is a one-way hash of the address, kept after the account closes so that we do not write again |
| Product analytics: how many accounts reach each step from sign-up to a paid plan, and which paid features an account tried to use without a plan | Legitimate interests | Paid features an account tried to use: 12 months. The admin page shows only counts per weekly sign-up cohort |
Account closure. When the owner closes an account (Settings, Close account), AI replies and automatic sending stop at once. The data stays available for export for 30 days, during which the closure can be cancelled. It is then deleted, and it leaves our rolling backups within 35 days after deletion, so the whole cycle ends within about 65 days. Invoices and tax records are kept for the legal period. A request to erase your personal data under the GDPR does not have to wait for an account closure: write to legal@kadaleo.com and we act on it within one month.
Preview accounts. A preview account with no plan and no activity for 12 months may be deleted 30 days after we notify the account email.
4. Who receives data
We do not sell personal data. We use the providers below to run the Service and give each only what it needs. The Role column shows whether a provider processes data for us (and, for a business's customer data, as a sub-processor under our Data Processing Agreement) or acts as an independent controller for its own purposes.
| Recipient | What we use it for | Data it receives | Role |
|---|---|---|---|
| Contabo GmbH (Germany) | Servers and database that run Kadaleo. | All data stored in Kadaleo. Server region: European Union (Contabo “Hub Europe” region). | Processor for Kadaleo; sub-processor for a business's customer data |
| Cloudflare | Website delivery, DNS and protection; object storage (R2) for photos and videos; database backups (every 30 minutes, kept up to 35 days). | Web traffic data such as IP address and requested page; uploaded photos and videos; database backups. | Processor for Kadaleo; sub-processor for a business's customer data |
| Anthropic | AI replies to your customers, Business Coach and content generation. | Conversation text and the business details needed to answer or write. | Processor for Kadaleo; sub-processor for a business's customer data |
| OpenAI | AI replies, only if we configure an OpenAI model for AI replies. | Conversation text, only if an OpenAI model is configured for AI replies; nothing otherwise. | Processor for Kadaleo; sub-processor for a business's customer data |
| fal.ai | Image and video generation. Some models are run by their developer (for example Black Forest Labs), which then receives the prompt and any starting picture. | Image and video prompts from which personal data has been removed and, for a clip made from a picture, a picture Kadaleo generated; never a photo uploaded by a business. Kadaleo asks fal not to keep a history of these requests. | Processor for Kadaleo's own data under fal's data processing addendum (Standard Contractual Clauses, Module 2); not a sub-processor, because it is not engaged to process Customer Personal Data (see the Data Processing Agreement, Transfers) |
| Typesafe | Short AI classification steps: language of a message, which service a message is about, column mapping on imports, comment routing, booking matching. | Short excerpts: the customer's message, the business's service names, and spreadsheet column names with sample values. | Processor for Kadaleo; sub-processor for a business's customer data |
| Stripe | Kadaleo subscription billing, and payments for the business's own customers through Stripe Connect. | Billing and tax details; payment and invoice details of the business's customers. Card numbers go to Stripe, not to Kadaleo. | Processor for Kadaleo's billing, and independent controller for its own payment, fraud and legal duties; for a business's own sales, under that business's Stripe agreement |
| Resend | Sending and receiving email. | Email content and email addresses. | Processor for Kadaleo; sub-processor for a business's customer data |
| Twilio | WhatsApp messaging for businesses that connect WhatsApp through Kadaleo. | WhatsApp messages and phone numbers. | Processor for Kadaleo; sub-processor for a business's customer data; independent controller for its own security, abuse-prevention and service-improvement purposes |
| Sentry | Error monitoring. In the browser only with your consent; on the server always, without cookies, IP addresses or request bodies. | Technical error reports: error details, page address with sign-in tokens removed, browser type, release. | Processor for Kadaleo; sub-processor for a business's customer data |
| Places API: finding the owner's own listing during website setup and suggesting address completions while the owner types (suggestions are not stored), and Kadaleo's own search for prospects (only the place identifier is kept); Sign in with Google; Calendar, Search Console and YouTube when you connect them. | A business name or Maps link you provide; your Google email address and name when you sign in with Google; the data listed under Google user data when you connect a service. | Independent controller for Sign in with Google, the Places API and the Google services you connect | |
| Porkbun | Domain search and registration. | The domain you search for and, when you buy, the registrant details of the business. | Independent controller, as domain registrar, for the registrant details |
| OpenStreetMap Foundation (Nominatim, Overpass) | Finding businesses of the same trade near a business, for the competitor overview in website setup (data © OpenStreetMap contributors, ODbL). Competitors' own public websites are then read. | The business's confirmed address or town and its trade; no personal data of customers. | Independent controller of its own services |
We also disclose data when the law requires it. If the business is ever transferred, data may pass to the new owner as the law allows; a customer's contract transfers only with that customer's consent, as the Terms explain.
5. Transfers outside the EEA
Most of the providers above are based in the United States or process data there or in other countries outside the European Economic Area: Cloudflare, Anthropic, OpenAI, fal.ai and the model developers it passes requests to, Typesafe, Stripe, Resend, Twilio, Sentry, Google and Porkbun. For those transfers we rely on an adequacy decision, including the EU-US Data Privacy Framework where the recipient and the service are certified, or on the EU Standard Contractual Clauses in the provider's data processing terms, with supplementary measures where needed. You can ask for a copy of the safeguards that apply at legal@kadaleo.com.
6. Google User Data
If you connect a Google account, Kadaleo requests the narrowest permissions that make the feature work:
- calendar.freebusy — reads only when your calendar is busy, as start and end times. We never read event titles, descriptions, guests or any other calendar content.
- calendar.events.owned — creates, updates and deletes only the booking events our own scheduling flow puts on a calendar you own. No other event is touched.
- userinfo.email — shows you which Google account is connected, so you can tell whose calendar is linked and disconnect it.
- webmasters (Search Console) — reads search performance for sites you have already verified, and shows it in your dashboard. It also submits the sitemap of the website Kadaleo hosts for you, so Google can find its pages.
- youtube.upload — uploads a video to your YouTube channel only when you publish or schedule it in Kadaleo.
- youtube.readonly — reads your channel's ID, name, handle, picture and subscriber count, to show which channel is connected.
- openid, email, profile (Sign in with Google): reads your Google email address and name to sign you in. No other Google data is requested for sign-in.
Kadaleo's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.
Google user data is processed only to deliver the feature you asked for. It is never sold, never used for advertising, and never sent to any AI or machine-learning provider — not to create, train or improve any model, and not for any other purpose. You can disconnect a Google account at any time from your dashboard, or revoke access at myaccount.google.com/permissions; we then delete the stored tokens. If we ever request access to new Google data, we update this policy before we do.
7. YouTube
If you connect a YouTube channel, Kadaleo uses YouTube API Services to publish the videos you create or approve in Kadaleo to that channel. By using Kadaleo's YouTube features you agree to be bound by the YouTube Terms of Service. Google's own handling of your data is described in the Google Privacy Policy.
- What we access: through youtube.upload, the ability to upload a video to your channel; through youtube.readonly, your channel's ID, name, handle, picture and subscriber count.
- How we use it: a video is uploaded only when you publish or schedule it, with the title, description, visibility and made-for-kids answer you chose for that post. Channel details are shown in your dashboard so you can see which channel is connected.
- What we store: the channel ID, name and handle, the subscriber count, a copy of the channel picture, the IDs of the videos Kadaleo uploaded, and the access tokens, encrypted.
- How long: channel details are refreshed at least every 30 days, and anything we cannot refresh within 30 days is deleted.
- Sharing: YouTube data is not shared with anyone, not sold, not used for advertising and never sent to any AI provider.
- Deletion on request: write to legal@kadaleo.com and we delete your YouTube data within 7 days. Deleting data in Kadaleo does not delete the videos we uploaded for you; they stay on YouTube until you remove them there.
You can disconnect your channel at any time in Social media → Accounts: we revoke Kadaleo's access with Google and delete the stored tokens, subscriber count and channel picture straight away. You can also revoke Kadaleo's access at any time in your Google security settings at https://security.google.com/settings/security/permissions. For any question or complaint about how we handle YouTube data, write to legal@kadaleo.com.
8. Connected platforms
When you connect an account, we ask the platform for the permissions listed here and store the account's identifiers and access tokens (tokens encrypted). Each platform is an independent controller of the data in its own service. You can revoke access at any time: disconnect the account in Kadaleo (Social media, Accounts) or remove Kadaleo in the platform's own settings.
- Meta (Instagram, Facebook, Threads, Messenger, WhatsApp): Instagram business profile, posts, insights, comments and direct messages; Facebook Page details, posts, comments and Messenger conversations, including Pages managed through Meta Business Suite; Threads profile, posts, replies and insights. We use them to publish the posts you approve, show insights, bring comments and messages into your Inbox, and send the AI replies you switch on. When you connect WhatsApp, Meta's sign-in window loads in your browser. WhatsApp messages are sent and received through Twilio or, where your number stays with your own WhatsApp Business account, through Meta's WhatsApp Cloud API.
- TikTok: your profile name and username, follower count, your videos and their statistics, and permission to upload the videos you approve. If you also connect TikTok comments: the comments on your videos (the commenter's username and the text), so you can read, answer and hide them in Kadaleo, and the replies you send, written by the AI only if you switch AI replies on. Disconnecting in Kadaleo also revokes our TikTok access, for publishing and for comments.
- Pinterest: your profile, boards and pins, and permission to create pins on the boards you choose.
- X: your account identity and permission to post, including media, on your behalf.
- Telegram: messages sent to the Kadaleo bot or to a bot you connect, and the channels where you add the bot, so that Kadaleo can publish posts and reply.
- Google and YouTube: see Google user data and YouTube above.
Posts already published stay on the platform after you disconnect, and the platform keeps its own copies under its own policy. The publishing history (what was posted and when) stays in your Kadaleo account until the account is closed or you ask us to delete it.
9. AI
Kadaleo uses AI to draft replies, write posts, answer questions as Business Coach, and generate images and video. The providers are listed in the recipients table.
- We do not train AI models, our own or anyone else's, on customer or end-customer data. Our AI providers' API terms do not let them use our data to train their models. For image and video generation through fal.ai we use only models that fal does not exclude from that commitment; some of them are run by their developer (for example Black Forest Labs), which then receives the prompt and any starting picture.
- When a business reports a problem with AI replies, we may run the conversations concerned through the listed providers again to investigate and fix it, on that business's behalf. We do not reuse customers' conversations for our own general testing or development; for that we use made-up or anonymised examples. This is not training.
- You choose where AI replies are used: automated replies can be switched on or off per channel, social posts are published only after your approval, and you can take over any conversation (human handover).
- Kadaleo itself tells people they are talking to an AI assistant: in the first message of a conversation on every channel except email (and again after 30 days), in a footer on every AI email, and on public comment replies the assistant posts by itself. The business cannot turn this notice off or remove it.
- Google user data never reaches an AI provider, as stated in the Google user data section.
- AI output can be wrong and is not professional advice. As between you and Kadaleo, you own the output to the extent the law allows.
10. How to delete your data
You can delete your data at any time. The steps are the same for every connected platform. A page with the same steps is at kadaleo.com/data-deletion.
- To delete everything a business holds in Kadaleo, its owner closes the account in Settings under Close account. AI replies and sending stop at once, the data can be exported and the closure cancelled for 30 days, and then everything is deleted; it leaves our rolling backups within 35 more days. Invoices and tax records are kept for the legal period. You can also ask us to erase your personal data without closing an account, as in the email step below.
- Disconnect the account in Kadaleo (Social media, Accounts). Its access tokens are deleted at once.
- Remove Kadaleo in the platform's own settings, for example Facebook or Instagram Business Integrations, or the third-party access page of your Google account.
- Email legal@kadaleo.com with the subject Data deletion. We confirm within 7 days and delete within 30 days. YouTube data is deleted within 7 days.
- What we keep: invoices and tax records for the legal period, and the records we need to honour a request to stop messaging you. Posts already published stay on the platform.
Deleting data in Kadaleo does not delete anything on Meta, TikTok, Google, YouTube or the other platforms. Delete it there as well if you want it removed.
11. Your rights and how to use them
You have the right to:
- access your personal data
- have it corrected
- have it erased
- restrict its use
- object to its use
- receive it in a portable format
- withdraw consent at any time
- not be subject to a decision based solely on automated processing that has legal or similarly significant effects, where Article 22 of the GDPR applies
Write to legal@kadaleo.com. The owner of a business account can also download all the account's data in Settings under Export your data, and delete it by closing the account in Settings under Close account (30 days to export or cancel). We reply within one month, which the law lets us extend by two further months in some cases, and we may ask you to prove your identity. If you are a customer of a business that uses Kadaleo, contact that business; we forward requests and help it answer them. You can also complain to the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt, or to the authority of your own country.
12. Children
Kadaleo accounts are for adults acting for a business, and kadaleo.com is not directed at anyone under 16. A business may hold data about its own customers who are minors, for example a booking a parent makes for a child; we process it on the business's behalf, and the business is responsible for it.
13. Security
We protect data with the measures below. No system is perfectly secure.
- Traffic between your browser and Kadaleo uses HTTPS.
- Passwords are stored as one-way hashes.
- Access and refresh tokens for connected accounts, and the tokens of bots you connect, are encrypted before they are stored.
- Card numbers are entered on Stripe's pages; Kadaleo does not receive them.
- Access inside a business account follows team roles, and access by Kadaleo operators is limited by role and recorded in an audit log.
- Error reports are scrubbed of access tokens and of sign-in and payment links before they are sent to our error-monitoring provider.
- Database backups are made every 30 minutes and kept for 2 days; one copy a day is kept for 35 days. All are stored in a private storage bucket.
If you suspect a security problem, write to legal@kadaleo.com. If a personal data breach affects you, we notify you and the authorities as the law requires.
14. Business contacts and prospects
For our own outreach we look up local businesses through Google Places, which returns public business information; from Google we keep only the place identifier, and the business's name and details come from its own website or, for a business without a website, the public company database nif.pt. We read a public contact email address from the same sources. A business found not to be a company is reduced to the identifier and the reason, so we do not look it up again. A public address is not consent. We write by email only to companies and other legal persons, never to sole traders or other individuals unless they asked us to, and before each campaign we check the addresses against the list of legal persons that object to unsolicited direct marketing (article 13.º-B of Lei n.º 41/2004), kept by the Direção-Geral do Consumidor and updated monthly and against our own list of people who asked us to stop. We do this on the basis of our legitimate interests. Every message says where we found the address and carries a one-click unsubscribe link, and we keep a record so that we do not write again. Replies are removed after 180 days and sent messages after 365 days; the record of who asked us to stop is kept as long as it is needed. You can object at any time by writing to legal@kadaleo.com.
15. Cookies and similar technologies
We use a small number of cookies and browser storage entries to keep you signed in, remember your language and your cookie choice, and run the dashboard. Only with your consent do we also switch on browser error monitoring. Server-side error reports carry no cookies, IP addresses or request bodies, and access tokens and sign-in and payment links are removed from them; an error message can still contain a fragment of the data being processed. We run them on the basis of our legitimate interests. The full list, with names and durations, is in the Cookie policy. You can change your choice at any time with Cookie settings in the footer.
16. Changes to this policy and effective date
This policy takes effect on 14 October 2026 (version 2026-10-14). If we make a material change, we tell account owners by email or in the dashboard before it applies, and we update the date at the top of this page.
Who we are and how to contact us
Kadaleo is a trade name of Daniyar Urazov, sole trader, NIF 311834230, Caminho do Amparo, 9000-705 Funchal, Madeira, Portugal. Contact: legal@kadaleo.com.
Privacy, data protection and legal requests: legal@kadaleo.com. General questions: info@kadaleo.com.