Privacy Policy

In short: we process your data to do exactly what you ask us to do — publish your content to your accounts and show you statistics. We do not sell this data, share it with ad networks, or train models on it. You can disconnect access and delete your data at any time.

1. Who we are and what this document covers

Kutto (the “Service,” “we,” “us”) is a tool for creators and teams: preparing, scheduling, and publishing content on social networks and video platforms, plus analytics on the results. This document explains what data the Service receives, why it needs it, who it shares it with, how long it keeps it, and what you can do about it.

This document applies to the kutto.app website, the Kutto mobile app, the Telegram app, and programmatic access to the Service (API and MCP). For any question about data, write to support@kutto.app — this is our main contact channel, and we handle data requests first.

2. What data we receive

• Account. Your name, email address and — if you sign in by phone number — your phone number. When you sign in with Google, Apple, Telegram or GitHub, we receive from that platform your profile identifier, name, avatar and verified email address, if the platform provides one. A password, if you set one, is stored only as an irreversible hash.
• Organization and members. The workspace name, the list of members, their roles and invitations — what teamwork cannot do without.
• Access to connected accounts. When you connect a channel or profile (YouTube, Instagram, TikTok, Telegram), we receive and store the access tokens issued by the platform, the account identifier, name, avatar and channel settings. Tokens are stored encrypted.
• Your content. Texts, images, video and audio that you upload or create in the Service, post drafts, schedules, and the technical results of processing: speech transcripts, subtitles, covers, rendered videos.
• Statistics of connected accounts. Views, subscribers, reach, traffic sources and other metrics that a platform provides for your own accounts — so that we can show them to you in reports.
• Public data of other profiles. To analyze competitors and find references, the Service processes publicly available posts and profiles. This is data that is open to any visitor on the platform itself; we do not try to obtain private data.
• Payment information. The organization’s balance, transaction history and the payer details you provide yourself when topping up (name, tax ID — if the payer is a sole proprietor or a legal entity), as well as payment details from the payment agent or from PayPal (section 8): amount, date, payment method and status. The Service does not receive or store bank card details — they are entered on the page of the payment agent or PayPal and processed by them.
• Links in free tools and in the clipping field. Links to videos and channels that you paste into the site’s free tools and into the clipping field on the home page, and what you enter in their forms, are saved together with an anonymous visitor identifier — so that we can understand which videos bring people in and at which step they drop off. Until you sign in, these records are not linked to your identity; after you sign in, the record of a link from the clipping field is linked to your account and the project created from it.
• Guest clipping. If you click “Clip” before signing in, we download the video from your link, recognize the speech in its first minutes and assemble several preview clips from it. To limit the number of free clippings, we store the IP address together with the anonymous visitor identifier — as an irreversible hash from which the address cannot be recovered. The previews and the downloaded video are deleted within 48 hours; the clipping record is deleted too if you never sign in, and after you sign in it is linked to your account.
• Technical data. Service access logs, IP address, device and browser type, error information — for security, diagnostics and incident investigation.

3. Why we process it

• to publish and schedule your content in the accounts you have connected;
• to collect and show statistics for those accounts and posts;
• to process your material with the tools you run yourself: video clipping, subtitles, voiceover, text and image generation, profile analysis;
• to keep a record of paid operations and the organization’s balance;
• to send service messages: a sign-in code, a warning about a failed publication, an invoice;
• to keep the Service running and secure — to find failures, prevent abuse, and restore data from backups;
• to comply with the law where it applies to us.

We do not use your data to show you ads and do not build advertising profiles from it. We do not sell personal data.

4. On what basis

We process most of the data because the service you asked for cannot be provided without it: a video cannot be published without access to the channel. Certain actions — connecting a specific platform, running an AI tool, sending notifications — happen at your direct instruction in the interface, and you can withdraw it at any time. We process logs and failure information for our own legitimate interest — the reliability and security of the Service.

5. Connected platforms

The Service works through the platforms’ official interfaces and acts in them on your behalf — only within the access you have granted and only on your commands. We do not follow anyone, do not comment, and do not publish anything that you did not create in the Service.

• YouTube. Uploading your videos and thumbnails, adding them to a playlist you choose, channel branding, and reading channel analytics. Details are in section 6.
• Instagram. Publishing prepared materials and reading statistics of your posts and profile through the Instagram Graph API.
• TikTok. Uploading videos to your account and reading information about them.
• Telegram. Sending posts and notifications to your channels and chats through a bot that you added yourself.

A platform’s rules apply independently of ours: by connecting an account, you remain bound by that platform’s terms, and its restrictions — limits, blocks, moderation — apply to posts made through Kutto.

6. Google and YouTube API data

By connecting a YouTube channel, you use YouTube API Services and accept the YouTube Terms of Service and the Google Privacy Policy.

The access we request from a channel and what it is needed for:

• Uploading videos. Publishing the videos you prepared and setting the thumbnail.
• Managing the channel. Adding a published video to a playlist you choose, creating playlists, and editing channel branding — at your action in the interface, not on their own.
• Reading analytics. Views, subscribers and traffic sources of your videos — for reports inside the Service.

We use data received through Google APIs only for the Service functions listed above. We comply with the Google API Services User Data Policy, including the Limited Use requirements: this data is not sold, not transferred to ad networks, data brokers or third parties, not used to serve ads, and not used to train AI models. Humans can access it only with your explicit consent, to fix a failure, or when the law requires it.

You can revoke Kutto’s access to your Google account at any time — in the Service (Settings → Channels, the trash icon next to the channel) or on your Google account permissions page. YouTube data stored with us is deleted when you disconnect the channel; the general deletion procedure is in section 12.

7. Artificial intelligence processing

Some of the Service’s tools run on models from third-party providers: speech recognition, writing and translating texts, generating images and voiceover, analyzing videos and profiles. You run such a tool yourself — it does not start on its own.

When you run it, the model provider receives what is needed to do the work: a piece of text, a frame, an audio track, or a link to a file available at a temporary address. We choose providers whose terms prohibit using submitted materials to train models, and we do not train models on your data ourselves. The model’s output is a suggestion, not a finished post: you decide what actually goes out to your account.

8. Who we share data with

We share data only with those without whom the Service does not work, and only to the extent needed for their part of the work:

• platforms — Google (YouTube), Meta (Instagram), TikTok, Telegram: what you publish, and statistics requests;
• AI model providers — materials you sent to a specific tool for processing (section 7);
• cloud storage (HOSTKEY S3 storage) — media files, when they need to be served externally: to a platform at publication or to your browser for viewing;
• the payment agent — the amount and purpose of the payment, the account identifier and email address, when you top up your balance or pay for a plan. You enter your card details with the agent directly, bypassing us;
• PayPal — when you pay for a plan in a foreign currency. PayPal accepts the payment on its own page as an independent controller of payment data. We pass to PayPal the amount and currency, the order description, and our internal order number. You enter your PayPal account and card details with PayPal, and PayPal processes them under its own Privacy Statement — you can choose the version for your country on PayPal’s legal agreements page. From PayPal we receive the order and payment identifiers, the amount, PayPal’s fee, and the payment status, and — if PayPal provides them — the payer’s email address, name, country, and PayPal payer ID; for a card payment, also the card type and its last four digits. We do not receive or store the full card number or security code. When you pay by a PayPal payment link, we also receive from PayPal the code you entered, the transaction number, the amount, PayPal’s fee, and the payer’s country. We do not store the payer’s name, address, or email address from the PayPal notification;
• messaging providers — the address or number and the text of a service message, to deliver a sign-in code or notification to you;
• infrastructure providers — server hosting, backups, error monitoring.

We do not share data with ad networks or data brokers. Disclosure at the request of government authorities is possible only in cases expressly provided for by applicable law. The servers of the Service and its providers may be located outside your country — by connecting an account and uploading materials, you agree to such transfer.

9. How long we keep it

• Account and organization data — for as long as the account exists.
• Platform access tokens — until you disconnect the account in settings or revoke access on the platform’s side; after that they are deleted.
• Media files and processing results — for as long as you need them in the project; the Service automatically removes source and intermediate files once the work on them is finished.
• Post statistics — for as long as the account they belong to is connected: without history, reports lose their meaning.
• Payment transactions — for as long as accounting requires.
• Logs and backups — for a limited period, after which they are overwritten. Deleted data may remain in a backup until it expires.

10. How we protect data

The Service is accessed over a secure connection. Platform access tokens are stored in the database encrypted, not in plain text. Staff access to data is restricted and granted for a specific task — for example, handling a support request or fixing a failure. Media files are served externally at temporary addresses with a limited lifetime.

There is no such thing as absolute protection, and promising it would be dishonest. If a breach affecting your data occurs, we will tell you about it and about what we did in response.

11. Your rights

You can:

• request what data of yours we hold and receive a copy of it;
• correct inaccurate data — some of it can be edited directly in profile settings;
• disconnect any connected account and thereby stop the exchange with the platform;
• withdraw consent to certain kinds of processing, for example notifications;
• demand deletion of your account and related data;
• object to processing or demand that it be restricted.

To exercise any of these rights, write to support@kutto.app from the address the account is registered to. We respond within a reasonable time, usually within 30 days. The scope of your rights may depend on the laws of your country.

12. Data deletion

A separate platform account is disconnected in the Service: Settings → Channels, the trash icon next to the account — its tokens are deleted along with it. The procedure for fully deleting a Kutto account and all related data is described on a separate page: Data deletion.

13. Children

The Service is intended for working with content and is not designed for children. We knowingly do not collect data of persons who, under the laws of their country, may not enter into such agreements on their own. If such data reaches us by mistake, write to us — we will delete it.

15. Changes to this policy

We edit this document when the product changes: a new platform, a new provider or a new kind of processing appears. The date of the last change is at the top of the page. We tell you about material changes — those that expand the scope of data or the circle of recipients — in the Service or by email, without putting you before a fait accompli after the fact.

16. Contact

Questions about data, access and deletion requests, and reports of privacy problems — support@kutto.app. The terms of using the Service are on the Terms of Service page.

Data controller: Individual Entrepreneur IVAN PIMANOV, Identification Number 302382785, legal address: Georgia, Tbilisi, Chugureti district, Giorgi Chubinashvili street N59, floor N2, apartment N6.