kitio.aiPrivacy Policy
What personal data we collect, why, who sees it and how to exercise your rights.
Last updated
This policy explains what personal data kitio.ai collects, why, who sees it, and what rights you have. kitio.ai is run by kitio.ai ("we", "us"), and we are the controller of the data described here.
1. What we collect
When you sign in. We sign you in with Google. We receive your name, email address and profile picture from Google, and we keep a record of your account and sessions. We do not receive your Google password.
When you submit a tool or book an ad. The details you enter: the tool's name, tagline, description, website, category, pricing, tags, features, maker name, logo, screenshots, and the ad text and logo for sponsor slots. Most of this is shown publicly on the site once approved. We also keep the submission's status, plan and launch dates.
When you pay. Payments are handled by Dodo Payments, our merchant of record. You enter card or wallet details on their checkout page, and we never see or store them. We receive your email address, a checkout and payment ID, the amount, the status, and the subscription ID for sponsor slots. Dodo Payments handles the data it collects under its own privacy policy.
When you use the site. We count page views and outbound clicks on tool pages so makers can see how their listing performs. For each visit we store the type (view or click), the page and placement, the referring website, your country, and whether you used a desktop, mobile or tablet device. We do not store your IP address or user agent. To count unique visitors we keep a one-way hash of those two values and the date. It resets every day and cannot be used to follow you across days or to identify you. We do not count bots or prefetch requests.
Site analytics. We use PostHog to understand how people use the site as a whole: which pages are visited, where visitors come from, which buttons and links are clicked, and how far people get through submitting a tool or booking an ad. PostHog receives the page address, the referring website, your browser and device type, and your approximate location from your IP address. It sets a first-party cookie and a local storage entry with a random ID, so it can tell new visitors from returning ones. We do not record your screen or what you type into forms, and we do not use PostHog for advertising.
When you email us. Your message and your email address.
2. Cookies and local storage
We use two strictly necessary cookies: one to keep you signed in and one short-lived signed copy of your session that makes pages faster. We also use a first-party analytics cookie from PostHog (named ph_..._posthog) that holds a random ID, so we can count unique and returning visitors. It is not shared with other sites. We do not use advertising or cross-site tracking cookies.
Your browser's local storage keeps your saved tools and any unfinished submission or ad form, so you do not lose your work across the sign-in and payment redirects. It stays on your device, and we clear the draft when you finish. You can clear local storage in your browser settings at any time.
3. Why we use your data
| Purpose | Data | Basis |
|---|---|---|
| Sign you in and run your account | Name, email, profile picture | Contract |
| Review, publish and edit your listing or ad | Submission details | Contract |
| Take payment, issue refunds, send receipts | Email, payment and subscription IDs | Contract, legal obligation |
| Email you about your payment, review result and listing | Email, submission details | Contract |
| Show makers their analytics | Anonymous view and click counts | Legitimate interest |
| Understand and improve how the site is used | Page views, clicks, referrer, device, approximate location | Legitimate interest |
| Keep the site secure and prevent abuse | Request data, rate limits | Legitimate interest |
| Answer your questions | Your message | Legitimate interest |
We send only service emails: payment received, listing live, ad live, rejected with a refund, and subscription cancelled or ended. We do not send marketing email.
4. Who we share it with
We do not sell your personal data. We share it only with the services that help us run the site, and only what each needs:
- Dodo Payments, to take payments and issue refunds.
- Google, to sign you in.
- Cloudflare, to send our service emails.
- PostHog, to measure how the site is used (see section 1).
- Our hosting and database providers, to run the site.
- Authorities, when the law requires it.
Your public listing, including your tool's details and your maker name if you entered one, is visible to everyone and may be indexed by search engines.
5. How long we keep it
- Account data: until you ask us to delete your account.
- Submissions and ads: while the listing or ad exists, and afterwards as needed for records.
- Payment records: as long as tax and accounting law requires, which is often several years.
- Analytics: counts are kept so makers can see history. They do not identify you. Site analytics events in PostHog are kept as long as our PostHog plan retains them, and we delete them on request.
- Emails to us: up to 24 months.
6. Your rights
Depending on where you live, including under the GDPR, the UK GDPR and the California Consumer Privacy Act, you may have the right to:
- access the data we hold about you and get a copy;
- correct data that is wrong;
- delete your data and account;
- object to or restrict some processing;
- withdraw consent where we rely on it;
- complain to your data protection authority.
To use any of these, email [email protected] from the address on your account. We reply within 30 days. We may need to keep some data, for example payment records, because the law requires it.
7. Security
Traffic to the site uses HTTPS. Uploaded images are re-encoded before they are stored, access to the admin tools is limited to named staff, and payment details never reach our servers. No system is perfectly secure, so we cannot guarantee absolute security. If a breach affects you, we will tell you as the law requires.
8. International transfers
Our providers may process data in countries other than yours, including the United States. Where required, we rely on safeguards such as standard contractual clauses.
9. Children
The site is not for children under 16 and we do not knowingly collect their data. If you think a child has given us data, email us and we will delete it.
10. Changes
We may update this policy. The date at the top shows the latest version. If a change is material we will tell signed-in users by email or a notice on the site.
11. Contact
kitio.ai. Email [email protected], or use the contact page.