Privacy Policy

1. What this Privacy Policy covers

This Policy covers information that identifies, relates to, or can reasonably be associated with you (“Personal Information”) that we process in connection with the Services. It does not govern independent companies, Hosts, Brands, or services we do not own or control, including social networks and payment providers. Their own policies may also apply.

We use information to provide and improve Kalo, manage accounts, connect Creators with opportunities, facilitate events and Deals, process transactions, communicate with you, and understand use of the Services.

The Services are not directed to children under 13, and we do not knowingly collect their Personal Information. If we learn that a child under 13 has provided it, we will take steps to delete it as required by law. Please contact support@joinkalo.com if you believe this has happened.

2. Changes to this Privacy Policy

Our Services and practices may change. We will update the date above when we revise this Policy and provide notice of material changes through the website, email, or another appropriate means as required by applicable law. Where a change requires consent, we will seek it. A policy update does not remove privacy rights you have under applicable law.

3. Information we collect

A. Information you provide

Information can also come from a Host or Brand that invites you, manages a guest list, reviews an application, or communicates with you. Only provide information about other people if you have the necessary permission and lawful basis. A location you enter or select may be used for discovery, matching, invitations, and event arrangements.

B. Verification and connected social accounts

We collect verification requests, codes, outcomes, and related account identifiers. Instagram verification can involve a code you send to Kalo’s Instagram account. We process the verification message and sender information received through Meta’s integration to check the account claim. Social connections may also involve provider tokens, permissions, expiration information, and account-linking records.

When you choose TikTok verification, TikTok presents an authorization flow. Kalo requests these three permissions and retrieves the following fields from TikTok’s user-info API:

We store those fields, a verification result, authorization tokens, granted scopes, expiration information, and verification-request records. The permissions can cover additional fields at TikTok, but this verification request retrieves Open ID, username, and follower count. We do not request TikTok video-list or publishing permissions in this verification flow.

C. Public social information and analysis

Separately from OAuth verification, we obtain information about public social profiles and posts through Kalo’s creator analytics technology and services. Creator and audience reports may include profile information, audience statistics, content categories, brands, mentions, hashtags, and engagement information. Public-post analytics for Instagram and TikTok may include post URLs, captions, media, publication details, account identifiers, and available views, likes, comments, shares, saves, or other engagement metrics. Available fields differ by platform and post.

This public-post analysis does not depend on TikTok’s verification permissions. Removing TikTok authorization does not itself remove public posts or information already stored by Kalo. Contact us about deletion or other privacy requests.

Our creator-analysis workflow sends structured creator and audience information from stored reports to Google’s Gemini service. This can include social identifiers, profile information, audience and engagement statistics, content and brand-affinity information, and the stored TikTok identifier. We store resulting analyses, such as creator scores, categories, brand-fit assessments, and pricing estimates, to support discovery and evaluation. Analyses are estimates and inferences and may be inaccurate; you may contact us to question or request correction of information about you.

D. Information collected automatically

Our Services and their providers process technical information such as IP address, browser and device information, requests, timestamps, navigation, interactions, and errors. Cookies and similar browser storage support sessions, account access, security, and application functionality.

We use Sentry for error monitoring and session replay. Where enabled, sampled sessions and sessions associated with errors can include replay data about page state and interactions, alongside diagnostic and technical information. This helps us understand and troubleshoot problems with the Services. Cloudflare Turnstile also processes browser and request signals to help protect signup and verification from abuse.

You can manage cookies and browser storage using your browser’s controls. Blocking or clearing them may prevent login or affect other features.

4. How we use and share Personal Information

A. Providing and improving the Services

We use Personal Information to create and manage accounts, verify account claims, evaluate applications, find relevant Creators and opportunities, administer guest lists and Deals, review work, process payments, communicate with users, maintain security, troubleshoot, and improve the Services. We may use aggregate or de-identified information for analysis and improvement in accordance with applicable law.

B. Profiles, participation, and contact sharing

Profile information, social handles, images, creator analytics, and information you submit for an opportunity may be available to relevant Hosts, Brands, organization members, and other users through the Services. Publicly displayed information may also be available to visitors. Guest-list visibility and chat access depend on the particular event, Deal, and your role.

When you apply for or participate in an event or Deal, we share information needed to review the application and manage participation, including relevant profile details, answers, contact information, and submissions. Brands can export approved Deal applicants’ names, Instagram handles, follower counts, email addresses, and application-question answers. Hosts may access guest and contact information for event administration and communications. Messages and files are shared with the participants who have access to the relevant conversation or workflow.

Recipients can retain copies or exports outside Kalo. Their handling of those copies is subject to their own obligations and applicable law. Deleting your Kalo account does not automatically retrieve or delete information held by others.

C. Providers that help operate Kalo

The providers involved depend on the features you use and which integrations are enabled. Providers may also process information under their own terms and privacy policies, including when you use their services directly. Information may be processed in the United States and other countries where Kalo or its providers operate, subject to applicable data-protection requirements.

D. Business transfers

Personal Information may be disclosed or transferred in connection with a merger, acquisition, financing, sale of assets, reorganization, bankruptcy, or similar business transaction, subject to applicable law.

E. Legal obligations and protecting rights

We may access, preserve, or disclose information when reasonably necessary to comply with legal obligations or valid legal process, enforce our Terms, investigate misuse, resolve disputes, or protect the rights, property, and safety of Kalo, users, or others.

Where applicable law requires a legal basis, our processing may rely on performing a contract with you, complying with legal obligations, legitimate interests in operating and protecting the Services, or consent for a particular use. The applicable basis depends on the information, purpose, and law that applies to you.

5. Security

We use measures intended to protect Personal Information and access to the Services. No system or transmission method is completely secure, and we cannot guarantee that unauthorized access, loss, or misuse will never occur. Protect your account credentials and verification codes, and contact support if you suspect unauthorized use. We will meet any security and incident-notification obligations that apply under law.

6. Access, retention, and account deletion

You can update information through the profile features available to you or request access, correction, or deletion by emailing support@joinkalo.com. Include enough information for us to locate your account and understand your request. We may need to verify your identity or authority before responding; do not send passwords or full payment credentials.

We retain information for the purposes for which it is processed, including providing the Services, maintaining transactions and business records, resolving disputes, preventing abuse, and meeting legal obligations. Retention depends on the type of information, the relationship and activity involved, operational needs, and applicable law. Token expiration or the end of a verification request does not by itself mean every associated record has been deleted.

The current account-deletion operation removes linked authentication-account and session records and replaces the user email and profile email and phone number with generated values. This is partial anonymization, not complete erasure of every record. Other profile information, including names, images and social identifiers, may remain, along with verification records, applications, messages, submissions, analytics, and transaction records. Remaining information can still identify you.

Contact us if you want to exercise a broader deletion or other privacy right. We will assess the request under applicable law, including any retention exceptions. Backups and information already shared with other users or providers may remain subject to their retention processes and legal obligations. We do not promise immediate erasure from every system or suppression from future public data sources simply because an account is closed.

7. California residents and other privacy rights

Depending on where you live and which laws apply to Kalo’s processing, you may have rights to:

• Know about and access the Personal Information we process.
• Obtain a copy of your information, including in a portable format where required.
• Correct inaccurate information or request deletion.
• Object to or restrict certain processing, or withdraw consent where processing relies on it.
• Opt out of sale, sharing for cross-context behavioral advertising, or certain profiling, and limit use of sensitive information where applicable.
• Appeal a decision on a request, or complain to the relevant privacy regulator, where applicable.
• Exercise applicable privacy rights without unlawful discrimination.

California residents may also request information about disclosures for third parties’ direct marketing under California’s Shine the Light law. We do not sell Personal Information or share it for cross-context behavioral advertising. The service-related disclosures described above still occur, including sharing with a Brand or Host in connection with your participation.

Email support@joinkalo.com to make a request or appeal. Where the law allows an authorized agent to act for you, we may request evidence of that authority and any identity verification the law permits. We will respond within the applicable legal timeframe, subject to lawful exceptions and extensions.

8. Your choices

You can decline to provide optional information, though some information is needed for particular features. You can manage browser cookies, update available profile fields, and contact support about your account or privacy preferences.

To withdraw TikTok authorization, use TikTok’s controls for managing connected-app permissions. TikTok explains those controls in its connected-app guidance. Revocation affects authorization at TikTok; contact Kalo separately to request deletion of stored TikTok information or correction of the connection or verification state. Public-post analytics and previously shared records are distinct from OAuth authorization, as explained above.

For promotional emails, follow the unsubscribe instructions where provided or contact support. For SMS, reply STOP to the sending number; reply HELP or contact support for assistance. Opting out of promotional communications does not necessarily stop account, transaction, or other communications permitted or required by law. Hosts and Brands may also hold your information independently; contact them about their own communications and copies.

9. Contact us

For questions, concerns, or requests about this Policy or your Personal Information, contact:

10. Third-party marketing

We do not provide your Personal Information to third parties for their unrelated direct marketing. Sharing information with a Host or Brand to review your application, coordinate an event or Deal, or contact you about your participation is part of the Services described in this Policy. Those recipients have their own responsibilities under applicable privacy and communications laws.