This Privacy Policy explains how Kitvela Studio collects, uses, encrypts, and protects information across our web studio, mobile application, brand kit engine, and connected publishing workflows.
1. Information we collect
When you use Kitvela Studio, we collect only the information required to operate your workspaces, generate brand-consistent creatives, and publish content you schedule or approve:
- Account and workspace profile: your name, email address, authentication credentials, role permissions (Owner, Admin, Editor, Viewer), and mobile push notification tokens.
- Brand kits, personal brand, and creative assets: uploaded logos, color palettes, typography, reference images, video clips, personal brand positioning inputs, and generated banners, illustrations, and vertical shorts.
- Connected social and email credentials: OAuth 2.0 access and refresh tokens, account identifiers, and page or channel names when you connect LinkedIn, X, Facebook Pages, Instagram (Feed and Reels), YouTube Shorts, WhatsApp Cloud API, or SMTP and Gmail.
- Billing and operational telemetry: subscription plan tier, credit balance and usage ledger, audit logs, and payment metadata processed via Stripe (we never store raw payment card numbers).
2. How we use your information
We use collected data to operate Kitvela Studio, render and composite your brand kits, banners, illustrations, and vertical shorts, route team approval workflows, execute scheduled social and email dispatches, prevent abuse, and send account or transactional notifications.
3. Connected social channels and encrypted credentials
When you connect a publishing channel in Kitvela Studio, OAuth tokens, refresh tokens, and SMTP secrets are encrypted at rest using AES-256-GCM before storage. Credentials are decrypted only at the moment of a user-initiated connection test or an approved or scheduled publish dispatch through our isolated publishing service. Kitvela Studio never reads private direct messages or publishes to any social account without your explicit action.
4. Google and YouTube API Services disclosure (Limited Use)
Kitvela Studio's use and transfer to any other application of information received from Google APIs (including YouTube Data API v3 scopes youtube.upload and youtube.readonly, and Google OAuth userinfo and Gmail scopes) will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used strictly to upload vertical videos you explicitly publish to your YouTube channel or send emails you trigger, is never sold to third parties or advertising networks, and is never used to train generalized artificial intelligence or machine learning models.
5. Artificial intelligence processing and Bring-Your-Own-Key (BYOK)
To generate copy, image prompts, illustrations, and video scripts, Kitvela Studio sends only the relevant brief and brand kit context to configured artificial intelligence inference providers (or uses your workspace's encrypted Bring-Your-Own-Key API credentials when configured). Your uploaded brand kits, proprietary assets, and generated creatives are isolated to your workspace and are never used to train public foundation models.
6. Data sharing and subprocessors
We do not sell or rent personal data. We share data only with essential infrastructure subprocessors (cloud hosting, Stripe for payment processing, transactional email delivery, artificial intelligence inference services, and the social platforms you explicitly target when publishing) under strict confidentiality and data protection obligations.
7. Data retention and deletion
You can delete individual brand kits, jobs, assets, or connected channel tokens at any time from your workspace. Deleting a workspace or your account permanently removes your personal data, brand kits, and encrypted OAuth credentials from active storage within a reasonable period, except where retention is required by billing or tax law.