# Privacy Policy

> For the complete documentation index, see [llms.txt](https://getkleos.ai/llms.txt)

Last updated November 7, 2026

This Privacy Policy explains how New Odyssey (“we”, “us”) collects and uses personal data in connection with Kleos (the “Service”) and this website.

## 1. Data we collect

- **Account data:** your email address, name (if provided), workspace and role, and sign-in timestamps.
- **Billing data:** plan, subscription status and invoices. Card details are collected and stored by Stripe; we do not store full card numbers.
- **Customer Content:** product information, brand kits, knowledge sources, outreach contacts you add, prompts and generated outputs.
- **Usage data:** feature usage and metered consumption (for allowances and billing), audit events and technical logs (IP address, browser, timestamps).
- **Visit data:** how you arrived at this site and whether you engaged with it, kept in our own visitor log (see [section 8](#visitor-log)).

## 2. How we use it

- To provide, secure and support the Service, including sign-in emails and service notifications.
- To meter usage, bill subscriptions and extra usage, and prevent abuse.
- To maintain audit trails of approvals and publications.
- To improve the Service using aggregated, de-identified usage information.

We do not sell personal data and do not use Customer Content to train our own foundation models.

## 3. Processors and sharing

We share data only with service providers acting on our instructions, including: Anthropic (AI writing and analysis), OpenAI (AI generation, image and speech processing), Stripe (payments), Resend (transactional email), Render (application hosting and databases), Cloudflare (DNS, networking and media storage) search-data providers such as DataForSEO (keyword, search-result and AI-assistant answer data — we send search terms and tracked questions, not your personal data) and Exa (web research on your brand’s public website and market — we send your domain and research queries, not your personal data). Content sent to AI providers is processed under their API data-usage terms. Businesses that need one can read our [Data Processing Addendum](https://getkleos.ai/dpa).

## 3a. Connected accounts (integrations)

If you choose to connect a third-party account, Kleos accesses only what is needed to publish the content you approve or to show your performance data. We store access tokens encrypted (AES-256-GCM), use them only for the actions you request, and never sell or share data obtained from these platforms.

- **LinkedIn:** your basic profile (name, email, profile ID) and, if you grant it, the company pages you administer — to publish approved posts as you or your page.
- **Facebook & Instagram (Meta):** the Facebook Pages you manage and their linked Instagram Business/Creator accounts — to publish approved posts and images. We read page names and IDs; we do not read your personal feed, messages or friends.
- **Google:** depending on what you connect — Google Business Profile locations (to publish updates), Search Console search performance (clicks, impressions, queries) and Google Analytics 4 reports (sessions and key events by landing page). Access is read-only except publishing Business Profile updates you approve.
- **X, Threads, Pinterest:** your account ID, username and (for Pinterest) boards — to publish approved posts and pins.
- **YouTube, TikTok:** your channel or creator profile (ID, name, posting options) — to upload approved videos Kleos rendered. Google data is handled under the Limited Use terms below.
- **Webflow, WordPress, Shopify, Wix, HubSpot, Ghost:** your sites, blogs or CMS collections (and, for Wix, site members you choose as the post author) — to publish approved articles. Self-hosted WordPress and Ghost connections use an application password or Admin API key you create and can revoke at any time.
- **Mailchimp, Kit, Klaviyo, ActiveCampaign, beehiiv, HubSpot email:** your account, list/audience or publication names and sender defaults — to create, schedule or send approved newsletters. Kleos reads list names and IDs only; we do not export or copy your subscriber lists.

**Google API Services:** Kleos’s use and transfer of information received from Google APIs to any other app will adhere to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Data from Google APIs is not used to develop, improve or train generalised AI or machine-learning models.

**Revoking access:** disconnect any integration under Settings → Integrations, which deletes the stored tokens immediately. You can also revoke Kleos in each platform’s settings (for example LinkedIn → Settings → Data privacy → Permitted services; Facebook → Settings → Business integrations; Google → myaccount.google.com/permissions). See [Data deletion](https://getkleos.ai/data-deletion) to delete all data Kleos holds about you.

## 4. International transfers

Our providers may process data in the United States and other countries. Where required, we rely on appropriate safeguards such as standard contractual clauses.

## 5. Retention

We retain account and Customer Content for as long as your workspace is active. When a workspace owner deletes a workspace it is locked at once and can be restored for 30 days; after that everything it held is deleted, including stored files. We keep only what we must for legal, tax or security reasons: invoices and payment records, and an activity log with personal details removed. Backups held by our hosting provider expire on its standard schedule.

## 6. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict or port your personal data, and to object to certain processing. Workspace owners and admins can export everything in a workspace themselves, workspace owners can delete the workspace, and anyone can delete their own account, all under Your data in the app. Contact us to exercise other rights. You may also complain to your local data-protection authority.

## 7. Security

We use encryption in transit, hashed single-use sign-in tokens, role-based access control, tenant isolation and audit logging. No system is perfectly secure; please contact us if you believe your account has been compromised.

## 8. Cookies, the visitor log and ads measurement

The Service uses strictly necessary cookies for sign-in sessions and preferences. This marketing site and the app’s sign-up, sign-in, onboarding and checkout-return pages also use advertising tools from three ad networks, X, Reddit and Meta (Facebook and Instagram), described below. One choice covers all three.

**Ads measurement (X, Reddit and Meta).** To see which of our ads on X, Reddit, Facebook and Instagram bring people to Kleos, we use each network’s ad pixel on this site and on those app pages, and each network’s server-side conversions API. Each pixel is that network’s script: it tells the network when you visit those pages and sets its cookies, including first-party ones on our domain (Reddit’s _rdt_uuid; Meta’s _fbp and _fbc). We keep the click identifier each network adds to an ad’s link in a first-party cookie: X’s twclid in kl_twclid and Reddit’s rdt_cid in kl_rdt_cid (30 days each), and Meta’s fbclid in _fbc, with a browser identifier in _fbp (90 days each, as Meta’s pixel keeps them). Your choice is kept in kl_ads (12 months).

**What we send them.** We tell the networks about three events only: when you sign up, when you start a free trial, and when you buy the lifetime license (with the amount and currency you paid). For each, we send every network we advertise on: the click identifier from its own ads (if you came from one); a hashed (SHA-256) copy of your email address; and your browser’s user agent and, for sign-up, your IP address (X receives these two only for sign-up; Reddit receives your IP address hashed). Meta also receives the _fbc and _fbp identifiers. Because Meta needs the browser’s user agent with every event, we keep the user agent of the browser you signed up in, with these click identifiers, alongside your account, and only if you may be measured.

**Your choice.** Visitors from the UK, the European Union, the rest of the European Economic Area and Switzerland are asked first: no pixel loads and nothing is sent to any network unless you accept. Elsewhere they are on unless your browser sends a Global Privacy Control or Do Not Track signal, or you turn them off with “Your privacy choices” in this site’s footer, which also works as an opt-out of “sharing” under California law. Turning them off also removes the click identifiers above from your browser. Each network’s own use of this data is covered by its privacy policy (X, Reddit and Meta).

**Visitor log.** To see which channels bring people to Kleos, the first page you open in each browser session on this site (or on the app’s sign-up and sign-in pages) records a visit in our own database: the page’s path (not its query string), the referring website’s domain, any campaign (UTM) tags in the link, which ad network a paid click came from (never the click identifier itself) and the type of device (phone, tablet or computer). After 5 seconds on a page with real scrolling, clicking or typing, the visit is marked as engaged. A random visitor ID is kept in a first-party cookie (kleos_visitor, 90 days) so that, if you sign up, the visit is linked to your account. We don’t store your IP address, your browser’s details or a fingerprint, no third party receives any of it, and nothing is recorded when your browser sends a Do Not Track or Global Privacy Control signal. AI crawlers’ page fetches are counted per day, apart from visitors, and other bots are ignored. A visit that never leads to an account is deleted after 13 months without a return.

## 9. Changes

We will post updates to this policy here and, for material changes, notify workspace owners.

## Contact

For privacy questions or requests, email [support@getkleos.ai](mailto:support@getkleos.ai).

Businesses that need a data processing agreement can read our [Data Processing Addendum](https://getkleos.ai/dpa).