Privacy Policy

Controller

Kuro Studio, Lukas Wirth

Address

Hirschberger Str. 24, 90559 Burgthann, Germany

Email

legal@kurostudio.io

Phone

+49 (0) 151 23476125

This policy explains how Lukas Wirth, trading as Kuro Studio, processes personal data for Kuro Engage. We are the controller for our website, account and team administration, contracts, billing, support, security, product analysis and advertising. For members acting for a company, our legitimate interest in administering that business relationship is the basis where the individual is not personally party to the contract.

For campaign content, connected-account credentials and audience interactions we process on a business customer’s documented instructions, that customer is the controller and we are its processor. Our Data Processing Agreement applies: /dpa. The customer decides campaign purposes, message wording, recipients and the legal basis. Meta operates Instagram under its own platform terms and privacy policy; connecting an account does not turn Meta into our general subprocessor.

• Account data such as email address, login status, passkey metadata, workspace membership, role, invite code, and referral attribution.
• Workspace data such as workspace name, connected social accounts, campaign settings, keywords, linked assets, and team roles.
• Instagram and Meta integration data such as connected account identifiers, Instagram user IDs, comment IDs, message status, opt-out records and encrypted Meta access tokens. Commenter IDs, usernames and comment text are stored only for comments that match an active campaign keyword and start a message flow. Separate webhook diagnostics contain only event type, event and post identifiers, timestamps and processing status, without message or comment text, usernames, sender or recipient identifiers or email addresses.
• Lead and campaign data such as email addresses and phone numbers submitted through a campaign, the person's Instagram display name and whether they follow the connected account, read from Instagram when they submit a contact in the conversation, source campaign, source event, delivery status, and timestamps.
• Billing data such as your plan, billing interval, subscription and payment status, invoices, the billing address and VAT identification number you enter at checkout, the customer and subscription identifiers assigned by our payment provider, and the payment events that provider sends us. We never receive or store full card numbers.
• With analytics consent: a session identifier and permitted product events; authenticated first-party events can be associated with account and workspace identifiers. PostHog uses a separate pseudonymous browser identifier. Advertising receives only sanitized website and conversion signals. Network connections expose metadata, including an IP address, to the receiving provider.
• Technical data such as browser and device information from the user agent, referrer, request timestamps, log entries, error diagnostics, and security events. When an asset link is opened, we record the time, the user agent and referrer, and the campaign whose message contained the link, taken from the link's campaign parameter; we do not store who opened the link. When someone subscribes to the newsletter or waitlist, we record the user agent and referrer as a record of that consent.
• Communication data from email, support, legal inquiries, and product feedback.

Our application database does not store IP addresses for form rate limiting. The application uses them transiently in memory. Hosting, authentication and bot protection providers receive network metadata when requests reach their services; their processing is separate from that application database rule.

To prevent repeated free trials, we retain pseudonymous checks derived from the account identifier and confirmed email address, with consumption and expiry dates. They do not contain the original email address and remain personal data because they can be matched with additional information.

Service email records contain the relevant account and workspace references, notice type, delivery state and timestamps to prevent duplicate service notices and resolve delivery failures.

Security audit records for sign-in method changes, membership and ownership changes, workspace and account deletion, operator holds and overrides: actor and subject user identifiers, workspace identifier, event type, request identifier and a short allow-listed set of technical attributes. They contain no email addresses, credentials or message content.

• Website delivery, account access, workspace administration and performance of our contract: Art. 6(1)(b) GDPR where you are the contracting individual; otherwise Art. 6(1)(f) GDPR, our interest in providing the business service to authorized users.
• Payments, subscriptions and customer support: Art. 6(1)(b) GDPR; for business contacts, Art. 6(1)(f) GDPR. Accounting, tax and legally required disclosures: Art. 6(1)(c) GDPR with the applicable statutory obligation.
• Security, necessary error diagnostics, service reliability, fraud prevention, trial eligibility and enforcement or defence of claims: Art. 6(1)(f) GDPR. We balance these interests against the impact on individuals and minimize the recorded data.
• Optional product analysis, session recordings and advertising: Art. 6(1)(a) GDPR and, where information is stored on or accessed from your device, Section 25(1) TDDDG. Refusal does not restrict the contracted service.
• Newsletter and waitlist messages: your separate consent under Art. 6(1)(a) GDPR and the applicable electronic-marketing rules. Necessary service notices are part of operating your account, not a newsletter.
• Campaign audience processing: the customer determines its legal basis; our authority to process on its instructions is the DPA under Art. 28 GDPR. A keyword request for a specific reply is not blanket permission for unrelated advertising.

Users sign in with magic links and may use passkeys. Authentication is provided through Supabase. We process login data to create sessions, prevent unauthorized access, and keep workspace data isolated.

Where access to the product runs through invites, we store invite codes and referral attribution so we can see who joined through whom and manage access. Referral attribution links workspaces to each other, not private individuals.

Cloudflare Turnstile helps protect magic-link requests and reviewer sign-in against automated abuse. Challenge and network/browser information is assessed by Cloudflare; Supabase validates the challenge result. This necessary protection serves account security under Art. 6(1)(f) GDPR and the applicable necessary-access exception in Section 25(2) TDDDG. It is not used for advertising.

When a connected Instagram account receives a comment that matches an active campaign keyword, Kuro Engage processes the relevant webhook data and sends a private reply or direct message through the official Meta API. Commenter IDs, usernames and comment text are stored only for such matching comments. A comment that does not match keeps only its comment ID, the post it belongs to and the processing outcome as a technical record. A comment under a connected account without an active campaign leaves no campaign record. Minimal delivery diagnostics for comments without a campaign are normally deleted right after processing; retained diagnostics contain no content and follow section 11. For matching comments, comment IDs and delivery records prevent duplicate messages and provide operational evidence.

Meta access tokens are held in encrypted storage, are readable only by server-side processes, and are never exposed to workspace users. Customers are responsible for campaign wording, asset links, audience targeting, and ensuring that their use of Instagram automation is lawful and compliant with Meta's platform terms.

Deleting a campaign stops new matches and removes it from the campaign list. Conversations already started can finish. Its campaign data, leads and history remain while the workspace exists. Disconnecting Instagram retains these records. Permanently removing an Instagram account deletes its campaigns and comment and message history, including its minimal webhook diagnostics, but retains captured leads with the source information needed for a later erasure request.

If you requested an automated reply from a business on Instagram, that business controls the campaign data. Meta delivers to us every comment written under a connected account. We store your Instagram identifier, username and comment only if your comment matches a campaign keyword and starts the requested flow, together with the message state and, if you submit them in the conversation, your email address or phone number. When you submit one, we also store your Instagram display name and whether you follow the business's account, as Instagram reports them at that moment. For other comments we keep neither your identifier, username nor text. We process the stored data to provide the requested flow and prevent duplicate delivery. Information supplied by Meta is the source of this data.

A campaign keyword requests that campaign’s response. It does not by itself permit unrelated follow-up marketing. The business must provide its own privacy information and obtain any additional permission needed for further messages or email marketing.

Reply STOP, UNSUBSCRIBE or CANCEL to suppress further unrequested automated sends from that connected account. START or SUBSCRIBE releases the suppression. A new campaign keyword comment is treated as a fresh request and releases the suppression for the new flow. Such a reply is recorded from any sender, even if no comment of yours was stored, solely to honor your choice on a suppression list; the operational event record of it contains no Instagram identifier. Technical delivery windows may prevent a confirmation, but do not undo the suppression. You may also restrict or block the account in Instagram.

Contact the campaign business to exercise your rights, or write to legal@kurostudio.io with the connected business account and enough information to locate your interaction. We route requests concerning customer data to that business and assist with its instructions; we do not require an identity document as a matter of course.

Meta’s app-data deletion callback removes the associated campaign, message, lead and minimal webhook records, including leads retained after permanent removal of the connected account. It concerns data identifiable through a connected Meta app/account and is not a universal deletion mechanism for every commenter. A rights request to the business or to our contact above remains available.

Paid subscriptions are processed by Stripe. When you start checkout, you enter your billing details directly with Stripe. Stripe processes your payment details as its own controller under its own privacy policy; we never receive full card numbers.

We store the customer and subscription identifiers Stripe assigns, your plan and billing status, and the payment events Stripe sends us. Those event records include the payload Stripe transmits, which we keep so that billing state can be reconciled and audited. We use this data to provide the paid service, issue invoices, and meet our accounting and tax obligations.

Where a tracked promotion code is redeemed, we record the code and discount identifiers, the workspace and subscription association, redemption time and any partner identifier and name assigned to that code. Partner attribution is stored as a snapshot at redemption and is used for reporting; later changes to a code do not rewrite that snapshot. Partner payouts are handled manually. Partner links and automatic payouts are not implemented.

Supabase

Supabase Pte. Ltd., Singapore: authentication, database, file and encrypted credential storage. Receives account, team, campaign, audience and lead records and files as our infrastructure processor, including as subprocessor for customer data. Core project data is hosted in our selected EU region; support, service metadata and subprocessors can involve other countries.

Vercel

Vercel Inc., United States: hosting, application execution and content delivery. Processes request and connection metadata and application data in transit and runtime as processor, including as subprocessor for customer campaigns. The application runtime uses Frankfurt. Global edge delivery, support and service operations are not limited to that runtime region.

Meta Platforms (Instagram)

Meta Platforms Ireland Limited, Ireland: account connection, Instagram APIs, webhooks and message delivery. Receives connected account and recipient identifiers, comments, message content and delivery data. Meta operates its platform under its own terms and privacy policy, with international processing including the United States. This platform relationship is distinct from Meta Pixel advertising.

Stripe

Stripe Payments Europe, Limited, Ireland: checkout, payment processing, subscriptions and invoices. Receives billing/contact details, payment information, subscription data and necessary transaction metadata. We receive subscription state, provider identifiers and billing events, not full card numbers. Stripe acts as an independent controller for regulated payment and fraud-prevention activities and as processor where its contracted service so provides. International group processing can include the United States.

Resend

Resend, Inc., United States: processor for authentication, transactional, newsletter and waitlist email. Receives recipient addresses, message contents and delivery metadata, including trial start/end and payment grace service notices. It does not send campaign lead emails through this integration. Processing and its infrastructure may be outside the EEA.

Cloudflare

Cloudflare, Inc., United States: necessary bot protection for authentication. Receives network/browser metadata, challenge interactions and validation tokens. Cloudflare acts as processor in providing the challenge service and as controller for the purposes specified in its Turnstile privacy policy, including improving bot detection. Global processing may occur; customer campaign contents are not supplied. Cloudflare also provides authoritative DNS for our domain. DNS-only routing exposes DNS query and resolver metadata to its DNS service; website HTTP traffic is served by Vercel rather than proxied through Cloudflare.

Sentry

Functional Software, Inc. (Sentry), United States: processor for restricted error and performance diagnostics, including sanitized error types, stack locations, timing, release and environment information and network metadata. Filters exclude account details, message/campaign content, request bodies and arbitrary breadcrumbs. Sentry replay is disabled. Diagnostics serve our platform security and reliability, not customer campaign analysis or advertising; international processing may occur.

Better Stack

Better Stack, Inc., United States: availability and job-completion monitoring. Receives health results, empty completion heartbeats and connection metadata, rather than customer campaign contents or account records. Acts as processor for our monitoring data; international infrastructure and support processing may occur.

Google Tag Manager and Google Analytics 4

Google Ireland Limited, Ireland: with analytics consent, GTM delivers GA4 tags for website measurement and permitted registration/trial signals. Google receives pseudonymous browser identifiers, sanitized website categories, event and device information and network metadata. Google processes analytics data under its applicable data-processing terms; group processing may include the United States. We use Basic Consent Mode: no Google tags or measurement pings are sent before the relevant consent.

Google Ads

Google Ireland Limited, Ireland: with advertising consent, conversion measurement and advertising attribution on the public website and successful registration/trial start. Receives pseudonymous browser/ad identifiers, permitted conversion events and network metadata, potentially including US processing. Google’s applicable advertising terms govern its processor/controller roles. No enhanced conversions, customer email addresses, workspace identifiers or campaign/lead contents are sent.

Meta Pixel

Meta Platforms Ireland Limited, Ireland: with advertising consent, public-website and registration/trial conversion measurement and attribution. Receives browser identifiers, permitted events, coarse device information and network metadata; international processing can include the United States. For collection and transmission through the Pixel, Meta and we are joint controllers under Meta’s Controller Addendum; Meta is responsible for its subsequent processing. We provide the consent choice; Meta provides information about its processing and you may exercise rights against either controller. Advanced matching and server-side Conversions API are not used.

PostHog

PostHog, Inc., United States: processor for optional product analysis and masked session recordings hosted in PostHog EU Cloud. Receives a separate pseudonymous browser identifier, explicitly allowed interaction events, sanitized page categories and device/network metadata. No general autocapture or customer campaign/lead contents are sent. Limited recordings are described below. EU hosting does not exclude international support or subprocessor access.

Provider privacy information is linked with each entry. Our current customer-data subprocessors and their processing scope are listed separately: /subprocessors. Legal obligations may require disclosure to authorities; professional advisers may receive the information needed for their duties under confidentiality obligations.

Necessary storage and access support login sessions, security, language/theme choices and proof of your privacy choice. They rely on the applicable exception in Section 25(2) TDDDG; associated personal-data processing follows the bases above. Optional cookies and similar local/session storage are controlled by the same privacy settings. They are off by default, and rejecting them is as accessible as accepting them.

Analytics enables permitted first-party product events, GA4 website measurement and PostHog product analysis, including a 10% sample of eligible sessions for replay. Recording masks text, inputs and images in the browser before transmission. Authentication, campaign editing, leads, assets and team-detail areas are excluded. Network bodies, console contents and sensitive URL parameters are not recorded. Replay is not needed to use the product.

Advertising enables Google Ads and Meta Pixel on the public website and for successful signup/trial signals. No campaign or lead contents, email addresses, workspace names or internal account/workspace identifiers are passed to advertising tools. Google tags are delivered through GTM only with the consent required for each purpose. We do not send pre-consent behaviour later.

Use Privacy settings in the footer or account menu to change or withdraw consent at any time. Withdrawal stops future optional collection and removes controllable provider identifiers; it does not retroactively make earlier processing unlawful or delete data already held by a provider. Ask us for erasure if needed. We retain a versioned choice for up to 180 days and ask again after expiry or a material purpose/provider change. Your newsletter choice is separate.

• Account and workspace data is kept while the account or workspace is active. After a paid subscription ends, we keep the workspace data for 30 days so it can be exported or the subscription resumed, then delete it automatically.
• Campaign, message and lead records remain while the workspace exists, including after a campaign is deleted. Leads also remain after an Instagram account is permanently removed; that removal deletes its campaign and comment and message history. Commenter identifiers, usernames and comment text exist only for comments that matched a campaign.
• Meta webhook diagnostics are minimized per connected account and contain no comment or message content, usernames, sender or recipient identifiers or email addresses. Unparseable deliveries and deliveries that cannot be assigned to a connected account are not stored. Irrelevant comment diagnostics are normally deleted right after processing. Other diagnostics become due for deletion after 90 days and are removed earlier with the connected account, workspace or user account, or through Meta app-data deletion. Stripe billing webhook records are a separate exception: they remain for financial reconciliation and abuse prevention for up to 90 days, including after workspace or account deletion. A daily cleanup job removes expired records; delayed or incomplete runs can delay physical deletion.
• Support and legal correspondence is kept as long as needed to resolve the request and document the interaction.
• Invoices, accounting records, and other documents subject to commercial or tax retention duties are kept for the legally required period, which can be up to ten years. During that time the data is restricted to that purpose.

Meta app-data deletion erases the associated Instagram campaign, message, lead and minimal webhook records. Workspace deletion and user account deletion erase the relevant customer data. Statutory or financial records are excepted, including Stripe invoices and billing webhook records retained for up to 90 days. The specific pseudonymous security, trial and backup exceptions described below also remain applicable.

Operational logs

Ordinary operational records: 30 days. Security records are kept separately for 365 days. Cleanup failures can delay physical deletion.

Product analytics

Our first-party raw events: 12 months, implemented as 365 days. PostHog and Google analytics retention depends on the contracted service and configured analysis window; an analysis window is not a promise of physical deletion. We handle erasure requests with the relevant provider. PostHog recordings are retained for up to 30 days.

Background job history

Finished background job records are deleted after 90 days. Records still referenced by a continuation are kept until the dependent record can be pruned.

Asset link click details

The user agent and referrer are cleared after 90 days. The open record, with its time and campaign reference, remains for the open count while the asset or workspace exists; the campaign reference is removed when the campaign itself is erased. No recipient identity is stored.

Asset files

Files of deleted assets, and earlier file versions replaced by a new upload, are removed from live storage by a daily automatic cleanup: a replaced version at the first run at least 24 hours after the replacement, the file of a deleted asset at the first run after deletion once the file is at least 24 hours old. Each run handles a bounded batch, so a backlog or a failed run can delay removal. Copies remain in backups until rotation as described under Backups. Deleting a workspace removes its files immediately.

Trial ledger

Trial consumption digests are retained for 365 days from consumption, including after account or workspace deletion. Expired entries stop restricting trial eligibility immediately and are removed by a daily cleanup job. To request release of these records, contact legal@kurostudio.io.

Backups

Database backup rotation normally covers 14 days. File archives and provider backups follow their separate rotation cycles. Deleted live data may remain in protected backups until rotation and is not used for ordinary operations. A restoration must reapply subsequent erasures before the restored data returns to normal use.

Service email delivery records

Records of trial and payment grace service notices become due for deletion 90 days after the send is claimed. The lifecycle email job removes expired records when it runs; skipped or failed runs can delay physical deletion. These records are removed earlier when the associated account or workspace is deleted.

Security audit trail

Security and administrative audit records: 365 days after the event. Identifying references are removed on account deletion where possible; necessary pseudonymous evidence can remain for that period.

Message delivery queue

Recipient identifiers and message payloads are cleared when a queued send settles. Settled delivery records become due for deletion after 30 days and are removed by the send retry job. Records with pending delivery effects, including the data needed to complete those effects, remain until those effects finish. Records are removed when the connected account or workspace is deleted.

Newsletter and waitlist

Unconfirmed subscriptions become due for deletion after 30 days from signup or the most recent confirmation resend, whichever is later. For confirmed subscriptions, the confirmation timestamp and consent version remain as evidence of consent; user agent and referrer are cleared after 30 days from confirmation. On unsubscribe we immediately keep only the email address, list, unsubscribed status and unsubscribe timestamp as a suppression record, invalidate the link token and remove the other signup details. The suppression record remains to honor the opt-out. The daily cleanup applies the same rules to existing subscriptions; delayed or incomplete runs can delay physical cleanup.

Retention beyond these periods is limited to an applicable legal duty, an unresolved legal claim or an agreed switching/return process. Advertising identifiers and provider records follow the relevant provider’s documented lifespan and your choice or erasure request. We do not promise that clearing browser storage deletes provider records.

We use TLS encryption, role-based workspace access, Supabase Row Level Security, encrypted storage for sensitive Meta tokens, least-privilege service access, and operational logging. No security measure is perfect, but security and workspace isolation are core design requirements for the product.

Subject to the applicable conditions, you may obtain access and a copy, correction, erasure, restriction and portability of your personal data. You may withdraw consent at any time for the future. Where we rely on legitimate interests, you may object for reasons relating to your situation; you may object to direct marketing at any time without giving reasons.

Contact legal@kurostudio.io. We verify identity proportionately, preferably through an existing account or interaction, without routinely asking for an ID copy. We respond within one month under GDPR; where legally permitted, complex requests may be extended by up to two further months with notice and reasons. For customer campaign data we route the request to the relevant controller and assist it. Where needed, we pass an authorized erasure request to a provider, including PostHog, Google or Meta.

You may complain to the authority where you live, work or believe a breach occurred. Our local supervisory authority is the Bavarian State Office for Data Protection Supervision (BayLDA): https://www.lda.bayern.de. We do not use your data for solely automated decisions that produce legal or similarly significant effects within Art. 22 GDPR. Required account and contract details are needed to provide the service; optional analysis and advertising are not.

Providers established in the EU can also use international infrastructure, affiliates or support. EU hosting alone does not rule out a transfer. Where GDPR requires transfer safeguards, we use an applicable adequacy decision for the recipient or contractual safeguards, normally the European Commission’s Standard Contractual Clauses with any required supplementary measures. The EU-US Data Privacy Framework applies only to a recipient and processing covered by its current certification. Information on the applicable safeguard and a copy, subject to necessary redactions, is available from legal@kurostudio.io.

Where UK or Swiss data protection law applies to a transfer, the corresponding UK or Swiss adequacy rules and contractual adaptations apply, including the UK Addendum where required. Regional mandatory rights remain available. Offering the service internationally is not a representation that every local industry, marketing or data-residency requirement is met.

The current edition shows its version and dates. We inform you about material processing changes through appropriate channels and obtain a fresh optional consent where required. A privacy notice is information, not acceptance of a contract. Customer subprocessor changes follow the separate DPA notice and objection procedure.