Privacy policy

Kelpfold lets a person sign in with Google, connect their Instagram, Facebook Page, TikTok and YouTube accounts, and publish, schedule, answer messages and comments and read statistics from one place. A business can also connect its Meta ad accounts to see and manage its own ads. This page lists what the software stores, why, for how long, and how to have it removed.

What is stored

• Sign-in identity. From Google sign-in: your Google account identifier, email address and display name, plus a session record (a random token, stored only as a hash) while you are signed in.
• Connected-account tokens. The access (and refresh) tokens each provider gives us for an account you connect. They are encrypted at rest and never written to logs, screens or exports.
• Collected posts and metrics.Public details of the connected accounts' own posts, stories and videos (identifiers, captions only when personal-content collection is on, links, timestamps) and their statistics (counts, reach, views, demographics the provider reports in aggregate).
• Messages and comments. Only when the operator turned personal-content collection on: message and comment text and the names of the people who wrote them. When it is off, text and names are not stored.
• Opaque contact identifiers.Whatever the setting, the provider's opaque identifier of the person who wrote a message or comment (for example a Messenger or Instagram-scoped id) is kept, because a reply cannot be addressed without it. It is not a name.
• Provider call logs. A record of each request the software makes to a provider (which endpoint, status, timing) with secrets and personal content redacted.
• Uploads.Images and videos you upload for posts or as brand assets, kept on the operator's storage.
• TikTok accounts. Connecting a TikTok account goes through TikTok's own sign-in (Login Kit), which asks you to grant Kelpfold these permissions: user.info.basic (your TikTok identifier, display name and avatar), video.list (your own public videos and their counts), video.publish and video.upload (to post a video you composed here, or send it to your TikTok drafts). If the operator enables them, user.info.profile and user.info.stats add your bio, profile link, verified badge, username and follower, following, like and video counts. The access and refresh tokens TikTok issues are stored encrypted, like every other provider token. If the operator connects a TikTok for Business (advertiser) account, its token is stored the same way and its data is read from TikTok when you open it.
• Posts you compose (drafts, scheduled posts, their targets and results) and an audit log of actions taken in the workspace (who did what and when, without tokens or message text).
• Meta ad accounts. For each ad account you connect, Kelpfold reads from Meta and stores:
  • the ad account's details as Meta reports them (name, currency, time zone, status, amount spent, spending limit, the business it belongs to);
  • its campaigns, ad sets, ads and creatives as Meta reports them (names, statuses, budgets, schedules, targeting, and the ads' text, links and media);
  • daily statistics for the account and for each campaign, ad set and ad (spend, impressions, reach, clicks, results and similar totals): the last 90 days, then each new day;
  • the alerts you set up on those statistics and the notices they raised;
  • a record of what was created or changed from Kelpfold (in the audit log above).
  Statistics you look up for any other range are read from Meta at that moment and kept in the server's memory for at most 5 minutes. Audiences, pixels, Meta's automated rules and lead forms are read from Meta when you open them and are not stored.
• Leads. The answers people give in a Meta instant form are read from Meta only when you open them. They are not stored, not kept in a cache and not written to logs.
• Customer lists for audiences. When you upload a customer list to build an audience, its contact details are normalised and hashed (SHA-256) on the server before they are sent to Meta. Neither the list nor the hashes are stored.

Why

Only to provide the features above to the people who connected the accounts. Data is not sold and is not used for advertising or to train models.

Ads data is used only to show and manage the business's own ads in its own workspace. It is not used to target ads and is not combined across advertisers. Kelpfoldchanges something at Meta (creates, pauses, edits or funds ads) only after showing a preview and getting the user's confirmation, and only while “Allow ad writes” is on for that ad account. Everything it creates starts paused. The one exception is an alert that you set to pause: when its condition is met, it pauses that campaign, ad set or ad (with “Allow ad writes” on); it never starts an ad or raises spending.

Who sees it

Members of your workspace see the workspace's data. The operator runs the servers and the database. The providers you connect (Google, Meta, TikTok) receive the requests the software makes on your behalf. Other service providers, if any, are listed by the operator.

Cookies

Kelpfold sets no advertising or analytics cookies and runs no tracking scripts. It sets two first-party cookies, both httpOnly (not readable by page scripts): sd_session, the session cookie that keeps you signed in (it holds a random token; the server stores only its hash), and sd_oauth, which lives for at most 10 minutes during Google sign-in to tie the return from Google to the browser that started it. The pages load an icon font from Google Fonts, so your browser contacts Google's font servers when a page opens.

Where data is stored and international transfers

The data listed above is stored on the operator's server and storage. The providers you connect (Google, Meta, TikTok) receive the requests the software makes on your behalf and process them under their own terms; some of them may handle data outside the European Union.

Who is responsible (data controller)

The operator named in the box at the end of this page decides why and how this service processes personal data and is the data controller for it. A business that uses a workspace to manage its own accounts remains responsible for the content it publishes and the messages it sends.

Age

Kelpfold is a tool for businesses and creators and is not meant for children. Operators who connect ad accounts or use the ads features must be 18 or older. The software does not check ages itself.

How long it is kept

• Raw webhook deliveries are deleted 30 days after they were processed.
• Disconnecting an account deletes its stored tokens at once. The posts, metrics, conversations and comments collected for it stay until deletion is requested (below) or the workspace is removed.
• Disconnecting a Meta ad account also deletes at once everything Kelpfold stored for it: its details, campaigns, ad sets, ads, creatives, daily statistics, alerts and their notices, and its request log. Nothing changes at Meta. The audit log entries stay.
• Everything else is kept while the workspace exists. Backups made by the operator follow the operator's own backup retention.

Deleting your data

See data deletion. People who connected accounts through Facebook or Instagram can also remove the app in their Facebook settings; Meta then notifies this service, which deletes the accounts that person connected and everything collected for them.

Revoking TikTok access

You can withdraw Kelpfold's access at TikTok at any time in the TikTok app's settings (the list of apps with access to your account), or disconnect the account in the Accounts window here, which deletes its stored tokens at once and asks TikTok to revoke them on the terms described under data deletion.

Your rights and contact

You can ask the operator for access to, correction of, or deletion of your data using the contact at the top of this page.

Under the EU General Data Protection Regulation you have the right to access your personal data, to have it corrected, to have it deleted, to restrict or object to its processing, to receive it in a portable form, and to lodge a complaint with a data protection supervisory authority (in Italy, the Garante per la protezione dei dati personali, or the authority where you live or work).

Changes to this policy

When this policy changes, the new text is published on this page with a new date at the top.