---
title: "Privacy Policy · Kairo Post"
description: "What Kairo Post collects, why, who we share it with, how long we keep it and the rights you have."
url: https://kairopost.com/legal/privacy
---

Legal

On this page

# Privacy Policy

Last updated 21 October 2026

We collect what we need to run your workspace and publish on your behalf, and nothing more. We don't sell personal data, and we only share limited data with X to measure our own ads on X if you accept cookies, we don't use your content to train AI models, and we only send content to an AI provider when you or an automation you authorized asks for it. You can access, export or delete your data at any time.

## 1. Who we are

Kairo Post (“Kairo Post”, “we”, “us”, “our”) provides a publishing workspace for X at kairopost.com and app.kairopost.com. Kairo Post is operated by Janzay LLC, a Wyoming limited liability company, 30 N Gould St, Ste R, Sheridan, WY 82801, USA. For the personal data described in this policy, Janzay LLC is the **controller**: we decide why and how it is processed. Where you use Kairo Post on behalf of an organization and upload personal data about other people (for example teammates or clients), your organization decides why that data is processed and we process it on its instructions.

You can reach us about anything in this policy at [support@kairopost.com](mailto:support@kairopost.com?subject=Privacy%20request), or by post at Janzay LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, USA.

## 2. Scope

This policy covers our marketing website, the Kairo Post app, our API, our emails and our support. It does not cover X, our payment provider or other third party services, which have their own privacy policies, even when you reach them through Kairo Post.

## 3. What we collect

### Information you give us

- **Account details:** your name, email address and password. Passwords are stored only as a salted hash, never in readable form.
- **Security settings:** two step sign in settings and backup codes (stored encrypted), trusted devices and sessions.
- **Workspace information:** workspace names, the teammates you invite, their roles and which accounts they can access.
- **Content:** drafts, threads, polls, templates, revisions, comments, approvals, brand voice settings, writing examples, knowledge documents, research sources and media you upload.
- **Support messages:** anything you send us by email or in the app.

### Information from connected services

- **X accounts:** when an account owner authorizes Kairo Post on x.com we receive the account's handle, X user ID, profile details, the permissions granted and OAuth tokens. See section 5.
- **Payments:** our payment provider tells us that a purchase or subscription happened, its status, the plan and the amount. We never receive your full card number.
- **Copilot browser extension:** if you install Kairo Post Copilot, the posts you click on, replies you load on your own posts and text you choose to send from any website. See section 6.
- **Sign in providers:** if you choose to sign in with Google or GitHub, we receive your name, email address and an account identifier from that provider.

### Information collected automatically

- **Security records:** sign in attempts and their result, approximate device and browser type, IP address and coarse location derived from it, and active sessions.
- **Usage and audit records:** actions taken in your workspace, such as publishing, approvals, billing and permission changes, and the credit ledger.
- **Diagnostics:** error reports and performance data from the app and our servers. We configure error reporting to leave out user details, cookies and request headers.
- **Website analytics:** on our marketing website, PostHog records the pages you view, the links and buttons you use, how far you scroll on a blog post, page speed, errors, the page you came from, and your browser and device type. Before you make a choice in the cookie banner, and if you reject, it counts visits without cookies (see the [Cookie Policy](https://kairopost.com/legal/cookies) ). If you accept, it also uses a random visitor identifier in a cookie and records about 3 in 10 visits (mouse movement, clicks, scrolling and what the page showed), with everything typed into form fields hidden in your browser. We send identifiers and counts, never your name, email address or what you type into our forms; for the contact form we only record which topic you picked.
- **Ad measurement, only if you accept:** we advertise Kairo Post on X. If you accept cookies, X's pixel on our website tells X about your visit and when you click “Add to Chrome”, and our servers tell X when you sign up, start a checkout or pay (with the amount). We send X's click identifier from the ad, if you came from one, and a one way SHA-256 code of your email address so X can match it to an X account; never your name, the address itself or anything you write. If you reject, or your browser sends Global Privacy Control, none of this happens.
- **App analytics:** in the app, PostHog records which features you use (for example that a draft was created, a post was published or a design was exported), page views, clicks, page speed and errors, with sizes and counts as ranges. It never receives what you write: posts, threads, articles, messages, AI prompts and answers, brand sources and other people's X posts stay out, and in recordings they are hidden in your browser. Until you accept in the cookie banner, app use is counted without cookies and without your account id; after you accept, it is linked to your random account id (never your name or email) and sessions are recorded with that content hidden. Our servers also send PostHog account, publishing and billing events (such as sign up, a published post or a payment amount) with your account id and no content, to measure and run the service, and AI usage records (model, tokens, cost, timing, errors) without prompt or answer text. When you delete your account, we ask PostHog to delete these records too.

We don't collect special category data (such as health, religion or biometrics) and ask you not to put it in your content unless you intend to publish it.

## 4. How we use it and why

Where the GDPR or UK GDPR applies, we must have a legal basis for each use. This table sets out what we do and the basis we rely on.

| What we do | Legal basis |
| --- | --- |
| Create and secure your account, run your workspace, publish, schedule, edit and delete posts you or your automations are authorized to act on | Performance of our contract with you |
| Quote, hold and settle credits, take payment through our payment provider, keep invoices and billing records | Contract; legal obligation for tax and accounting records |
| Send service emails such as verification, invitations, publishing results, billing notices, trial reminders and security alerts | Contract; legitimate interests in keeping you informed and your account safe |
| Detect and prevent fraud, abuse, credential stuffing and violations of our Acceptable Use Policy; keep audit trails | Legitimate interests in protecting our customers, our service and X; legal obligation where applicable |
| Diagnose errors, measure reliability and plan capacity | Legitimate interests in running a reliable service |
| Count website visits without cookies, to see which pages work and where the site breaks | Legitimate interests in understanding and improving our website |
| Analytics cookies and recordings of some visits on our website | Consent, which you can withdraw at any time with “Cookie settings” at the bottom of every page |
| Measure our ads on X (X's pixel and Conversion API) | Consent, which you can withdraw at any time with “Cookie settings” on our website or in the app |
| Record the scope of an automation you authorize, and send content to an AI provider when you request it | Contract; your consent where we ask for it, which you can withdraw at any time |
| Send product news, if you opt in | Consent, which you can withdraw from any such email |
| Respond to lawful requests and defend legal claims | Legal obligation; legitimate interests |

Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time (see section 11).

**We do not sell personal data and we do not use your content to train AI models. The only sharing for advertising is the X ad measurement described in section 3, and only if you accept it in the cookie banner.**

## 5. Data from X

Kairo Post connects to X only through the official X API, with permission granted by the account owner on x.com. Access tokens are encrypted at rest, refreshed automatically, and never shown to users or sent to the browser. We never ask for or receive X passwords.

We use data obtained from X (such as your posts, mentions and metrics) only to provide the features you use, and we handle it in line with X's Developer Agreement and Policy. We don't sell it, and we don't use it to build profiles of people who are not our customers. An account owner can revoke access at any time from Kairo Post or from X's connected apps settings. Content you publish to X becomes public under X's own terms and privacy policy.

When a post we keep a copy of (for example a mention or a reply to you) is deleted or made private on X, or its author's account is deactivated or suspended, we remove our copy. We check this with X every day, so removed posts disappear from Kairo Post within 24 hours. For an edited post, we drop the old text until we read the new version from X.

### Direct messages (DM Concierge)

If you turn on the DM Concierge for an X account, X delivers the X Chat messages that other people send to that account. X Chat messages are end to end encrypted. Kairo Post receives and keeps only X's encrypted copy, which we cannot read, plus the details needed to run your inbox: who wrote and when, labels, assignments, team notes and costs.

- **Messages are unlocked only on your device** , with your X Chat PIN. We never ask for, receive or store your X Chat PIN or your private encryption keys.
- **AI drafts stay on your device.** When you ask for an AI draft, the text of that conversation and your reply guide are sent from your device, through our servers, to our AI provider, to write the draft. Kairo Post doesn't store the conversation text, and it isn't used to train AI models. To make repeated drafts cheaper, the AI provider may keep the fixed part of a request (our safety instructions and your reply guide, never the conversation alone) in a short-lived cache, usually for a few minutes.
- **Your reply guide.** The AI writes drafts only from the reply guide you write: about your business, your voice, how to handle messages, the facts it may use and example replies. We store it encrypted to write your drafts. You can change it at any time, and it is deleted with your DM Concierge data.
- **Nothing is sent without you.** A reply is sent only when someone on your team clicks Send. You can only reply to people who wrote to you first.
- **You stay in control.** Turning the DM Concierge off stops delivery from X at once. You can delete the history immediately, and it is deleted when you disconnect the X account.

The people who write to you are not our customers. We process their messages only to provide the inbox you use, on your instructions, and you are responsible for how you use what they send you.

## 6. Copilot browser extension

Kairo Post Copilot is an optional extension for Chrome and other Chromium browsers (such as Edge, Brave and Arc). It shows a side panel next to X and other websites and helps you write your own replies and posts with your Kairo Post workspace. **It never posts, replies, likes, reposts, follows or bookmarks for you.** Every action on X is your own click on X.

### What it reads on your device

On x.com, the extension reads the posts that are visible on your screen to show its helper icons and, if you keep it switched on, a mark on posts where a reply has a good chance (we call this Scroll Radar). That calculation happens on your device. **Posts you don't click are not sent to us, not stored by us and not logged.** The short list of marked posts is kept in your browser's temporary storage for up to two hours.

### What it sends to Kairo Post, and only when you act

- the post you click the Copilot icon on (or open Copilot on), with up to five posts above it in the thread and the post it quotes;
- text, a page address or an image you select or right-click on any website and choose to send to Kairo Post;
- the profile you open Copilot on, when you ask to see your private notes about that person;
- the drafts you create and the changes you make to them;
- counts with no content, for example how many marked posts you opened or skipped. These counts contain no post text, usernames or post IDs.

### What it never does

- It does not read your direct messages or X Chat.
- It does not read your X password or X cookies, and it does not collect your browsing history.
- It does not run in the background on other websites. It only reads a page you right-click and send.
- It does not sell data or use it for advertising.

### How we use it

Only to provide the features you use: writing drafts, sorting the replies to your posts, saving items to your Brand brain or swipe file, showing your private notes and history, and improving your own drafts with the edits you made before. When you ask for a draft, the clicked content and your instructions are sent to our AI provider only to write that draft (see section 7). **Content from X is never used to train or fine tune any AI model.** You can switch off learning, or reset what Copilot learned, in Settings → Copilot.

### Sign in and your controls

The extension connects to your workspace only after you approve it on kairopost.com. It holds a short lived access token (15 minutes) and a refresh token on your device; we store only a fingerprint (hash) of the refresh token. You can disconnect any device in Settings → Copilot → Devices, turn the on page icons off, and uninstall the extension at any time, which deletes everything it stored on your device.

### Chrome Web Store User Data Policy (Limited Use)

The use of information received from Kairo Post Copilot adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use this information only to provide and improve the extension's single purpose: helping you write and organise your own X replies and posts in your Kairo Post workspace. We do not sell it, use it for advertising, use it to determine creditworthiness or for lending, or allow humans to read it, except with your permission, for security purposes, to comply with the law, or when it has been aggregated and anonymised. We do not use it to train AI models.

## 7. AI and search providers

Some features draft text or lay out designs with AI models, or search the web for research. Content is sent to these providers only when you, or an automation you authorized, request that work, and only the material needed for it, such as selected research excerpts, writing examples or a prompt. For DM Concierge drafts, that is the conversation you ask a draft for and your reply guide (see section 5). For Copilot drafts, that is the post you clicked, its visible thread and your instructions (see section 6). Web searches send the search query, not your account details.

The providers we use are listed on our [subprocessors page](https://kairopost.com/legal/subprocessors). AI output can be inaccurate, so review drafts before publishing.

Separately, recordings of website and app visits (only made if you accepted analytics cookies, with form fields and your content hidden) may be reviewed by PostHog's Replay Vision, which uses Google's Gemini models, to find broken pages and confusing steps. This never includes your workspace content.

## 8. Who we share it with

- **Service providers** who host, store, email, monitor and process data for us under written contracts that limit their use of it. They are listed on our [subprocessors page](https://kairopost.com/legal/subprocessors) .
- **X** , when we publish, read or delete content on your behalf, and, only if you accept cookies, to measure our ads on X (section 3).
- **Our payment provider** , named at checkout, which runs checkout and subscriptions and acts as an independent controller for payment data under its own privacy policy.
- **Your workspace** : teammates and clients you give access to can see the content and activity their role allows.
- **Authorities and others where the law requires it** , to respond to valid legal process, or to protect the rights, safety and property of our users, the public or Kairo Post.
- **A buyer or successor** if Kairo Post is involved in a merger, acquisition or sale of assets, under protections at least as strong as this policy. We will tell you before your data becomes subject to a different policy.

## 9. International transfers

Our providers may process data in the United States and other countries outside the UK, the EEA and Switzerland. When we transfer personal data from those regions, we rely on an adequacy decision (including the EU US Data Privacy Framework and its UK and Swiss extensions where the recipient is certified) or on the European Commission's Standard Contractual Clauses with the UK Addendum, together with additional safeguards where needed. You can ask us for a copy of the relevant safeguards at [support@kairopost.com](mailto:support@kairopost.com?subject=Privacy%20request).

Website and app analytics are stored in PostHog's EU region.

## 10. How long we keep it

| Data | How long |
| --- | --- |
| Account and workspace content | While your account is open. Deleted when you delete it, or after you close your account, apart from what we must keep below. |
| Temporary data such as import previews, unsaved generated drafts and export files | Usually removed within 1 to 7 days |
| Sign in evidence, rate limit and security records | Usually 1 to 90 days, longer only while needed to investigate abuse or a security incident |
| DM Concierge messages (X's encrypted copy) and inbox details | For the period you choose (30, 90 or 365 days), then deleted automatically; straight away if you delete the history or disconnect the X account. AI draft text stays on your device and is removed from it after 30 days. |
| DM Concierge reply guide | Until you change it, or until the X account's DM Concierge data or the workspace is deleted |
| X access tokens | Until the account is disconnected or access is revoked, then deleted |
| Copilot: posts you clicked and text you sent from a website | 30 days, unless you save the item to your swipe file or Brand brain |
| Replies to your own posts (read through X's official API when you refresh them) | The reply text and author are removed after 30 days; the status you set (for example “sent”) stays with your workspace |
| Copilot: counts with no content | 180 days |
| Copilot: your saved items, private notes, drafts and learned preferences | Until you delete or reset them, or the workspace is deleted |
| Copilot: connected devices and sign in tokens | Access tokens expire after 15 minutes; refresh tokens after 30 days or when you disconnect the device |
| Billing records, invoices and the credit ledger | As long as tax, accounting and anti fraud laws require, generally six to ten years |
| Audit records of access and billing changes | For the life of the workspace and as long as needed to resolve disputes |
| Backups | Overwritten on a rolling schedule; deleted data leaves backups as they expire |

## 11. Your rights

Depending on where you live, you may have the right to:

- access the personal data we hold about you and get a copy of it;
- correct data that is inaccurate or incomplete;
- delete your data (the “right to be forgotten”);
- receive your data in a portable, machine readable format;
- object to processing based on legitimate interests, and to direct marketing at any time;
- restrict processing while a concern is being resolved;
- withdraw consent at any time, without affecting processing that already happened.

You can export content and close your account from the app's settings, or email [support@kairopost.com](mailto:support@kairopost.com?subject=Privacy%20request). We will reply within one month (or the period your local law sets), and may ask you to confirm your identity first. We don't charge for requests unless they are clearly unfounded or excessive. If we process data on behalf of your organization, we will pass your request to it.

## 12. US state privacy rights

If you live in California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon or another US state with a comprehensive privacy law, you have the right to know what personal information we collect, use and disclose; to access, correct and delete it; and to opt out of its sale, sharing for targeted advertising, and profiling with significant effects.

In the past 12 months we have collected the categories described in section 3: identifiers, customer records, commercial information (plans and purchases), internet activity within our service, approximate location from IP addresses, and the content you create. We disclose them for business purposes only to the recipients in section 8. **We do not sell personal information. We share it for cross context behavioural advertising only through the X ad measurement in section 3, only after you accept it in the cookie banner, and we do not use or disclose sensitive personal information** other than as needed to provide the service (for example, your account password). We honour Global Privacy Control signals as an opt out request: with it, X's pixel never loads and nothing is sent to X. Choosing Reject in the cookie banner opts you out too.

You may use an authorized agent to make a request, and we will not discriminate against you for exercising any of these rights. If we decline a request, you can appeal by replying to our decision; if we still decline, you may contact your state attorney general.

## 13. Security

We use encryption in transit and for sensitive data at rest, strict isolation between workspaces, role based access, two step sign in, audit trails and least privilege access for our own staff. No system is perfectly secure, so if we become aware of a breach that affects your personal data we will notify you and the relevant authorities as the law requires.

## 14. Cookies

Our marketing website uses PostHog for product analytics: without cookies until you choose, and with cookies and recordings of some visits only if you accept in the cookie banner. To opt out, choose Reject, or open “Cookie settings” at the bottom of any page and change your choice; if your browser sends Global Privacy Control, PostHog doesn't load at all. The website loads X's ad measurement pixel only if you accept, and never if your browser sends Global Privacy Control. The website loads no other advertising scripts. The app uses strictly necessary cookies to keep you signed in and secure, and asks the same PostHog question: until you accept it counts use without cookies and without your account id; after you accept it links use to your account id (never your name or email) and records sessions with what you type and your content hidden. The Copilot extension uses no cookies; it keeps its sign in and settings in the browser's own extension storage on your device. See our [Cookie Policy](https://kairopost.com/legal/cookies).

## 15. Children

Kairo Post is for people aged 18 and over. We don't knowingly collect personal data from anyone younger. If you believe a child has given us personal data, contact us and we will delete it.

## 16. Automated decisions

Some features rank stories, suggest drafts or flag content for review automatically. None of these make decisions that produce legal or similarly significant effects about you. Automated abuse checks may temporarily limit an action; you can always ask a person to review it at [support@kairopost.com](mailto:support@kairopost.com?subject=Privacy%20request).

## 17. Changes to this policy

We will post any changes on this page and update the date at the top. For material changes, we will tell workspace owners by email or in the app before the change takes effect.

## 18. Contact and complaints

Questions, requests and complaints go to [support@kairopost.com](mailto:support@kairopost.com?subject=Privacy%20request), or by post to Janzay LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, USA. We will do our best to resolve any concern. You also have the right to complain to a data protection authority, such as the one where you live or work, the UK Information Commissioner's Office (ico.org.uk), or your EU supervisory authority.