Privacy Policy

Last updated: 1 August 2026

This policy explains what personal data Klud.app (Klud App, 373 Princes Highway, Banksia, NSW, 2216) collects, why, and your rights. For prospect data you import, you are the controller and Klud acts as your processor.

1. Data we collect

  • Account data: name, email, password hash, timezone.
  • Billing data: handled by Stripe; we store your Stripe customer/subscription IDs and plan status. We never see or store full card numbers.
  • Connected accounts: your LinkedIn session credentials, your Google OAuth refresh token, and, if you pair one, your WhatsApp session and the phone number and profile name associated with it. Credentials are encrypted at rest with AES-256-GCM, or held by our licensed provider where that provider owns the session. Used exclusively to perform the actions you configure.
  • Prospect data you import: names, job titles, companies, public profile URLs, email addresses, phone numbers and location, whether you provide them directly, upload them, or the Service finds them while acting on your instructions.
  • Content: message templates and audio recordings you create.
  • Usage & log data: actions performed, delivery events (sends, opens, replies), IP address and user agent for security logs.

2. How we use data

  • To operate the Service: schedule and send your sequences, detect replies, show analytics.
  • To bill you through Stripe and manage your subscription.
  • To secure the Service: session management, fraud and abuse prevention, rate limiting.
  • To communicate service messages (verification, receipt and payment failure notices).

We do not sell personal data. We do not use your prospect data for our own marketing.

3. Legal bases (GDPR)

Performance of contract (operating your account and campaigns), legitimate interests (security, service communications), and consent where required. For prospect outreach, you are responsible for your own lawful basis.

4. Processors we use

  • Stripe: payments and subscription management.
  • Google: Gmail API access you authorize.
  • Unipile: our licensed provider for LinkedIn and WhatsApp. If you connect either channel, it holds the session for that account and performs the actions you configure.
  • Hetzner: infrastructure and database hosting.

5. Retention

Account and campaign data are retained while your account is active and for 30 days after termination, then deleted. Encrypted connected account credentials are deleted immediately when you disconnect an account. Backups roll off within 35 days.

6. Security

Passwords are hashed with scrypt; sessions are stored on our servers and referenced by hashed tokens; sensitive credentials are encrypted with AES-256-GCM using keys held outside the database; transport is TLS at all times; access to production systems is restricted and logged.

7. Your rights

Depending on your location you may have rights to access, rectify, export, restrict, or delete your personal data, and to object to processing. Exercise them from Settings or by contacting us. You may lodge a complaint with your supervisory authority.

8. International transfers

Where data is transferred internationally we rely on adequacy decisions or standard contractual clauses with our processors.

9. Contact

Privacy questions: support@klud.app. Abuse and opt out complaints: support@klud.app.