Privacy Policy

This policy explains what information Kitestring (“Kitestring,” “we,” “us”) collects when you use kitestring.app (the “Service”), how we use it, who we share it with, and the choices you have. The short version: we collect what we need to run your ads for you, we don’t sell your data, and we don’t use your data for advertising of our own.

1. Information we collect

Account information

Your email address and authentication credentials. If you sign in with Google or Apple, we receive your email (and, for Apple users who choose “Hide My Email,” a relay address) from that provider; we never see your Google or Apple password.

Connected-account data

When you connect accounts, we collect and store:

• Store data (Shopify or Etsy): your shop domain, an access token, and product catalog information — titles, descriptions, prices, images, and product URLs.
• Ad account data (Meta): your ad account ID, Facebook Page ID, and an access token.

Campaign data

Campaigns you create in Kitestring — the product advertised, ad copy, objective, budget, spend caps — and daily performance metrics for those campaigns reported by Meta (spend, revenue, orders, reach, clicks).

Technical data

Authentication cookies needed to keep you signed in, and standard server logs (IP address, browser type, pages requested) used for security and debugging. We do not currently use analytics or advertising cookies. If that changes, we will update this policy first.

2. How we use information

• To provide the Service: sync your products, draft ad copy, create and manage campaigns in your ad account, show you performance, and generate plain-English suggestions.
• To secure the Service and prevent abuse.
• To communicate with you about your account (confirmation emails, password resets, important service notices).
• To comply with legal obligations.

We do not sell your personal information, and we do not use it for third-party advertising or profiling.

3. AI processing

To draft ad copy, we send your product’s title, description, and price to Anthropic, our AI provider, through its API. Under Anthropic’s commercial terms, API data is not used to train their models. We do not send your email address or credentials to the AI provider.

4. Who we share information with

We share information only with:

• Service providers that host and power Kitestring: Supabase (database and authentication), Render (hosting), and Anthropic (AI copy drafting). Each processes data only to provide its service to us.
• Platforms you connect, at your direction: when you launch or manage a campaign, we transmit your ad content, product images and URLs, budget, and instructions to Meta; we read products from Shopify or Etsy. What those platforms do with data they hold is governed by their own privacy policies.
• Legal and safety: if required by law, or to protect the rights, safety, or property of Kitestring or others.
• Business transfers: if Kitestring is acquired or merged, your information may transfer with it; this policy would continue to apply until updated with notice.

5. Data retention and deletion

We keep your information while your account is active. Disconnecting a store or ad account removes its access token from our systems; you can also revoke Kitestring’s access from the platform’s side (Shopify, Etsy, or Meta settings) at any time. To delete your account and its data, email hello@kitestring.app — we will delete your data within 30 days, except records we must keep for legal reasons (kept only as long as required). Campaigns already running in your Meta ad account are not deleted by account deletion; manage those in Meta Ads Manager.

6. Security

Data is encrypted in transit (TLS) and at rest, access tokens are stored server-side and never exposed to your browser, and database access is restricted per-user with row-level security. No system is perfectly secure, but we design for least access and will notify you of a breach affecting your data as required by law.

7. Your rights

Depending on where you live (including under the GDPR, UK GDPR, and U.S. state privacy laws such as the CCPA), you may have rights to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to complain to a data protection authority. To exercise any of these, email hello@kitestring.app — we will respond within the time required by the applicable law. We do not discriminate against you for exercising your rights. Because we do not sell or share personal information for cross-context behavioral advertising, there is nothing to opt out of on that front.

8. International transfers

Kitestring is operated from the United States and data is processed on U.S.-based infrastructure. If you use the Service from outside the U.S., your information will be transferred to and processed in the U.S.

9. Children

The Service is for business use by adults. It is not directed to anyone under 18, and we do not knowingly collect information from children. If you believe a child has provided us information, contact us and we will delete it.

10. Changes to this policy

We will update this policy as the Service evolves. Material changes will be announced by email or in-app notice before they take effect, and the “Last updated” date above always reflects the current version.

11. Contact

Privacy questions and requests: hello@kitestring.app. See also our Terms of Service.