Kadapt Ltd (UK) is the data controller. Contact: [email protected]. UK GDPR applies because we’re a UK company; US state privacy laws (CCPA/CPRA, and similar laws in Colorado, Connecticut, Virginia, Utah, and other states) apply to covered US residents. Effective 2026-07-13 (provisional).
| Category | Examples | Source |
|---|---|---|
| Account | name, email, business name, timezone/working hours | you |
| Brand & uploads | listing photos, logos, headshots, brand docs, website content we scrape at your request | you |
| Generated content | stills, videos, scripts, captions, voiceover | created by the service |
| Usage & analytics | pages/features used, generation counts, device/browser, approximate location | GA4 + our logs |
| Billing | handled by Stripe — we never hold full card numbers; we see customer/subscription status and card fingerprint (trial-abuse control) | Stripe |
| Comms | support messages, chat with the agent, push subscription endpoints, self-reported performance (“how did the reel do?”) | you |
| Affiliate | referral attribution (who referred whom, commissionable events) — tracked first-party via a kadapt_ref cookie |
us / Stripe |
Contract (provide the service, generate content, bill you); legitimate interests (product improvement, fraud/abuse prevention, proactive in-app suggestions); consent (marketing emails, analytics cookies, showcasing your content); legal obligation (tax, accounting).
| Processor | Role | Data | Location |
|---|---|---|---|
| Cloudflare (R2, Pages) | storage & hosting | uploads, generated media, backups | global network (US entity) |
| OpenRouter → model providers (currently ByteDance/Seedance, Anthropic, DeepSeek, Google) | AI generation | your prompts and uploaded photos are sent to the model provider to generate content | US / provider-dependent |
| ElevenLabs | voiceover synthesis | voiceover script text (never your photos) | US |
| Stripe | payments, tax | billing data, card fingerprint | US/global |
| Resend | transactional email | email address, message content | US |
| Google (GA4) | analytics | usage events, device data | US/global |
| Meta Platforms (Meta pixel) | advertising measurement & retargeting | usage events, device data, IP address | US/global — not loaded for UK/EU visitors |
| VPS provider (Hetzner/OVH) | app hosting & database | account + application data | EU |
Please note in particular: content you upload is processed by third-party AI model providers under their terms; we configure no-training/limited-retention options where the provider offers them.
We’re a UK company; our customers are mostly in the US and most processors are US-based. Transfers out of the UK rely on the UK International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses, adequacy where available, and processor data-processing agreements.
| Cookie/tech | Type | Purpose | Consent? |
|---|---|---|---|
| Session/auth (first-party) | essential | keep you signed in | no (strictly necessary) |
GA4 (_ga etc.) |
analytics | usage measurement | yes — the “Analytics” choice in our cookie banner. Nothing is loaded until you accept |
Meta pixel (_fbp) |
advertising | measuring ad performance and building retargeting audiences | yes — the “Advertising” choice in our cookie banner. Nothing is loaded until you accept |
TikTok pixel (_ttp) and kadapt_ttclid |
advertising | measuring TikTok ad performance and tying an ad click to a signup | yes — the “Advertising” choice, same as the Meta pixel |
kadapt_ref (first-party) |
attribution | 60-day partner/referral attribution window — set only when you arrive via a ?ref= link |
yes |
kadapt_p (first-party) |
attribution | 60-day campaign attribution token — set only when you arrive via an email link carrying a ?p= parameter |
yes |
| Stripe (checkout) | essential | payment/fraud prevention | no (necessary for payment) |
| Web Push subscription | not a cookie | notifications — the browser permission prompt is the consent | browser-level |
How the choice works. If you are in the UK, the EEA or Switzerland, we ask before anything optional loads. Until you choose, no analytics or advertising script is fetched at all — not loaded-but-idle, simply not there. Rejecting is one click, in the same place and the same size as accepting. Outside those regions the optional cookies are on by default and you can still turn them off at any time.
Changing your mind. Use Cookie settings, also linked in the footer of every page. Turning something off takes effect immediately and reloads the page so anything already running stops. We re-ask after 12 months. Clearing your browser storage also clears the choice, and we will ask again.
If Kadapt Ltd is acquired or its assets sold, customer data transfers with the business under the same commitments; we’ll notify you.