Privacy Policy

1. Who is responsible

This policy covers the marketing website, accounts and Kate services. ANDREOU INNOVATIONS LTD, registration number ΗΕ 482315, based in Nicosia, Cyprus, is the controller for account data, our own enquiries and platform operations. Provider details appear at the end of this page. Contact team@trykate.app about privacy.

For visitor messages on a customer’s business website, that business is normally the controller and we provide storage/hosting on its instructions. The business needs its own privacy notice and an appropriate data-processing agreement before collecting personal data. Our policy does not replace those obligations.

2. What information is collected

We collect information you provide during registration, brand setup, website editing, AI generation or enquiries, along with necessary technical information to operate and protect the service.

• Account: name, email, user identifier, sign-in provider and registration/access dates. Password authentication is handled through Firebase Authentication.
• Brand: business facts, services, audience, tone, colours and contact details you enter.
• Website: pages, copy, images, SEO, URLs, publishing history and domain-connection records.
• AI: your prompt, relevant brand/current draft, generated content and usage metadata such as counts and dates.
• Enquiries: name, email, optional business or phone details, message and assistance request. Visitor messages are stored for the relevant website owner.
• Technical information: request IP, browser/user agent, logs, timestamps and hashed abuse-rate-limit identifiers. A hashed identifier is not necessarily anonymous.

3. Purposes and legal bases

We use each category for relevant purposes. If you represent a business, the basis for your details may be our legitimate interest in managing that relationship rather than a contract with you personally.

• Accounts, trial, editor, requested AI, hosting and support: performance of a contract or requested pre-contract steps.
• Security, fraud/abuse prevention, operational logs and managing enquiries: legitimate interests in a reliable service, balanced against your rights.
• Tax records, lawful orders and compliance duties where applicable: legal obligation.
• Optional statistics and advertising tracking on the marketing website: prior consent, separate choices and a withdrawal option. Rejection does not restrict service use. Registration is not itself marketing consent.

4. Private brand and public website

Your brand is stored separately from the public site and is available to your account and authorised administration. A full street address is optional and its display is off initially. Without opt-in, that saved address field is excluded from AI context and contact blocks use the city/location.

Business contact details are intended for website use. Updating the brand does not automatically correct already published content: apply and save the relevant changes. Private details typed into other copy or a prompt can still be sent in an AI request. Public pages, images and contacts can be copied or indexed by others.

5. What is sent to AI

Separately from website generation, when you upload a Brand logo or photo and confirm the disclosure/publication rights, we send sanitized, resized image pixels to OpenAI for a safety check. Embedded metadata such as EXIF/GPS is removed. Only after approval do we store the image in Firebase and record its owner, URL, technical details and notice acknowledgement. Anyone with the URL can view it, even before website publication. Removing a Brand reference does not automatically delete the file or older drafts. Safety checks do not guarantee legality or publication rights. Do not upload identity documents, sensitive data, sexual content or known/suspected child-abuse material. A manually entered logo link is not checked by this upload flow.

When you request generation, we send the prompt and relevant brand/current draft to OpenAI for copy and structure. Optional image generation also sends image descriptions. If you separately opt into a team illustration and confirm the people's permission, we send the approved team photo to OpenAI to turn it into a cartoon. The original photo is retained; the illustration is a reviewable draft, not a guaranteed faithful likeness. We record the choice and permission acknowledgement. Merely completing a brand profile does not call AI. Do not include passwords, API keys, customer records or sensitive information.

Text calls use store:false, which is not a promise of zero retention. OpenAI does not use API data for training by default unless optional sharing is enabled. It may retain data for safety and abuse monitoring under its current settings and policies. Generated images are stored in our Storage when created.

Content generation is not intended to make automated decisions with legal or similarly significant effects about you. Trial/subscription access uses account dates and entitlements, not an AI assessment of your brand.

6. Providers and recipients

With your permission, Google Tag Manager loads Google Analytics 4 for statistics and Meta/Facebook Pixel for advertising measurement and personalization on trykate.app. Providers may receive technical request information, browser/device details, approximate location, cookie identifiers, visits and campaign data. Meta may associate information with its own accounts. Our code does not add passwords, AI prompts or form messages to tracking events. Provider settings and retention must be reviewed by the operator.

Google/Firebase provide authentication, database, file storage and hosting; OpenAI provides requested AI generation. Authorised staff and support providers may access data when necessary for service, security or legal duties. A website’s visitor messages are made available to that website’s owner.

Stripe processes payments and card details on its own secure pages. We receive customer, subscription and invoice identifiers, access dates, payment/cancellation status and payment events — not full card numbers or CVC. Twilio SendGrid receives your verified email, name and transactional trial/subscription notification content. It also processes contact-form names, email addresses, optional phone/business details and messages to notify the Kate team or the website owner’s selected delivery and CC recipients. Those private delivery settings are not published or sent to AI. These messages are not newsletters or marketing emails. We store a delivery queue, attempts and status for reliable sending.

Selling personal data is not a platform feature. Disclosure may be necessary for a lawful order or to protect rights.

7. International processing

Providers or support personnel may process data outside the European Economic Area. European hosting does not guarantee that all authentication, AI or support processing stays exclusively in the EU. Actual locations depend on provider configuration and contracts.

Where required, transfers need an appropriate lawful mechanism, such as an adequacy decision or standard contractual clauses with necessary assessments/additional measures. Contact the team for information about the mechanisms that apply.

8. Cookies, local storage and external resources

The admin uses browser storage for sign-in and language preference. The local demo stores its brand, website and trial start in that browser. Marketing language is determined by the URL. Clearing local data in browser settings does not delete a real account or server records.

On the marketing website, cookie choices are stored under kate:marketing-consent:v1 in your browser for up to 180 days. Optional statistics and advertising are off initially. Because they share a tag container, it loads only if you allow both categories until separate checks for every tag are verified. Accept, reject and separate choices are available in the banner; change them through Cookie settings in the footer. This integration does not load tracking on localhost, admin or customer websites.

If you withdraw permission after tracking loads, the page reloads to stop loaded scripts and we remove known Google Analytics/Meta cookies accessible to this website. This does not delete previously transmitted data or cookies on other domains. Provider cookie lifetimes depend on their settings. Refusal or withdrawal does not prevent use of Kate.

Google Fonts also load from external servers, to which browsers send requests with technical information. External images added by website owners can make requests to their providers. We do not claim every external resource has no privacy impact.

9. Retention and deletion

Account, brand and website records are retained while the account remains open and they are needed for the service. Trial/subscription expiry is not account closure or automatic deletion. Request closure/deletion by email; we assess what can be removed and what must remain for legal duties or specific claims.

Enquiries and correspondence are retained as needed to respond, manage the relevant relationship or address a specific dispute. Logs and security identifiers are retained only while justified for operations, investigation or lawful retention. Backups may retain data until their replacement cycle and are not intended for routine active use.

There is not yet automated cleanup with a guaranteed day count for every collection. Exact periods and procedures must be finalised by the operator before commercial launch. Ask for the applicable period for a particular category; permanent retention or deletion of all independent third-party copies is not promised.

10. Your rights

Under the GDPR where applicable, you may request access, correction, deletion, restriction, objection and portability. If processing relies on consent, you may withdraw it without affecting prior lawful processing. Statutory exceptions and limitations apply.

Email team@trykate.app from your account address and describe the request. Proportionate identity verification may be needed; never send passwords or more information than necessary. We respond within applicable legal deadlines. For a message submitted to another business’s website, contact that business first; we can assist under its lawful instructions.

You may complain to a competent supervisory authority, particularly where you live, work or the alleged infringement occurred. In Cyprus this is the Office of the Commissioner for Personal Data Protection. Contacting us does not waive your complaint rights.

11. Security and required information

The application uses authenticated requests, ownership checks, server-side entitlements and access rules for accounts/brands. Production operation requires HTTPS, restricted administrative access and proper provider settings. No system guarantees absolute security.

Core account and required business fields are needed for the relevant service. Without them, the corresponding features cannot be completed; optional fields such as a full street address or social links may remain blank.

12. Children

Account creation is intended for people aged 18 or over. If you believe a child created an account or provided information without the necessary lawful basis, contact us so we can investigate and take appropriate action.

13. Policy updates

The date and version appear at the top. Material processing changes require an updated notice and notification or consent where applicable. A text change does not itself authorise a new processing purpose.