Privacy Policy

1. Scope and who is responsible

This Privacy Policy applies to the Kabo website, iOS and Android applications, authentication services, creator-profile analysis, subscriptions, and related legal and support pages (collectively, the “Service”). Kabo is provided by DEALISM PTE. LTD. (“DEALISM”, “we”, “us”, or “our”), which is responsible for the personal data described here.

2. Information we collect or process

• Apple sign-in data. When you choose Sign in with Apple, Apple provides the account identifier and verification data needed to authenticate you and, only when Apple makes them available, your name and email address or private relay address. We do not receive your Apple Account password.
• Google sign-in data. When you sign in with Google, we receive the profile information permitted by the requested OpenID, email, and profile scopes, such as your name, email address, profile image, Google account identifier, and verification status. We do not receive your Google password.
• Kabo email sign-in data. Existing email-account users may sign in or reset their password. We process the account name, email address, a one-way password hash, password-reset codes, account identifier, and related authentication records. We do not store the plaintext password or reset code after verification.
• Onboarding and creator-profile data. We process the answers you provide during onboarding and the public Instagram handle or profile URL you submit. To create your Profile report, we may process publicly available creator information such as display name, avatar, biography, audience and following counts, post count, engagement signals, public post metadata, and the resulting AI-assisted insights and personalized inspiration.
• Authorized Instagram data. If Instagram connection is available for your Kabo account and you choose to connect, we receive the identifiers, profile, media metadata, captions, media addresses, and available account and media metrics allowed by your permissions. We store the access token encrypted on our servers to sync and refresh your connection. We do not receive your Instagram password. This data belongs to your Kabo connection and is kept separate from our public creator research and public profile reports. When you request an account review, your connected profile, recent post captions and available metrics are processed by our AI service providers to generate that review. Access tokens are not sent to the AI service.
• Authorized TikTok data. If TikTok connection is available for your Kabo account and you choose to connect, we receive your account identifiers, profile information, available follower and engagement counts, and public video metadata and counts allowed by your permissions. This includes video descriptions, cover images, duration, and links to watch on TikTok. We store access and refresh tokens encrypted on our servers to maintain the connection and sync this information. We do not receive your TikTok password. Authorized TikTok data is shown only in your connected account and stays separate from public creator research. This connection does not download original videos, publish posts, or send your TikTok data for AI account reviews.
• Selected and recorded video data. When you choose a video for analysis or record a take with Kabo's teleprompter, we upload that video to private cloud storage and process associated file metadata, audio, transcripts, analysis results, scripts, and recording state to provide the feature you requested. If you choose to save a recording to your device, the local copy is also governed by your device and backup settings.
• Subscriptions and purchase records. Kabo Pro purchases are processed by Apple App Store or Google Play. We do not receive or store your full payment-card details. We receive and store information needed to verify and restore access, such as the product identifier, signed transaction or purchase token, subscription status, billing-period dates, and related order metadata.
• Attribution and app activity. We use Adjust for app attribution and limited product analytics. Adjust may process app launches, sessions, onboarding progress, app and build version, platform information, and—subject to device settings and applicable permissions—an advertising identifier or other device identifiers. On iOS, Kabo asks for App Tracking Transparency permission before using an advertising identifier.
• Website analytics data. On the Kabo website, Google Analytics processes cleaned page URLs, referring domains or campaign tags, approximate location, browser and device information, engagement time, and Kabo interaction events. We do not send form entries, creator handles, prompts, generated results, passwords, authorization codes, or tokens to Google Analytics. Kabo's free tools also keep a random anonymous browser identifier and per-tool usage counts in local storage, and send Kabo the event name, tool, time, and cleaned page path. This first-party telemetry does not include tool input or generated results.
• Session, technical, and security data. We process session identifiers and ordinary network and security records such as IP address, request time, response status, request identifiers, and user-agent information to operate, secure, troubleshoot, and prevent abuse of the Service. To diagnose video-upload reliability, we also process a random upload-attempt identifier, service-generated asset and analysis identifiers, file size, video duration and estimated bitrate, uploaded and transferred byte counts, upload-stage durations, connection type, mobile platform, app and build versions, outcome, failure stage, error category, whether you manually retried, upload chunk size, and committed-chunk, retry, session-restart, or stall counts. This diagnostic record excludes video content, full filenames, local or signed upload addresses, upload credentials, and raw error text.
• Support communications. If you contact us, we process your contact details and the information you choose to provide so we can respond and maintain an appropriate support record.

3. Permissions and data Kabo does not use

Kabo requests camera and microphone access only when you choose the teleprompter recording feature. The camera captures the video you direct Kabo to record, and the microphone captures its audio; Kabo does not record in the background. The system media picker gives Kabo access only to a video you explicitly select for analysis, and Kabo requests add-only media-library access when you choose to save a recorded video to your device. Kabo does not scan your media library in the background and does not request precise location or contacts. On iOS, Kabo asks for App Tracking Transparency permission before Adjust may process an advertising identifier. Adjust may process other device identifiers for attribution, measurement, analytics, and fraud prevention as described above. On the website, Google Analytics does not receive form entries, creator handles, prompts, generated results, passwords, authorization codes, or tokens. The website tag disables Google signals and ad-personalization signals. Kabo does not display third-party advertising, sell personal data, or use private user data to train models offered to other customers.

4. How and why we use information

We use information to authenticate users; maintain sessions; save onboarding progress; retrieve and analyze the requested public creator profile; generate and restore Profile reports and personalized inspiration; display and sync social accounts you authorize; upload, record, transcribe, analyze, and export videos at your request; maintain scripts and recording state; verify purchases and provide Kabo Pro access; measure website acquisition, engagement, and onboarding; diagnose failures; prevent fraud, spam, and abuse; respond to requests; enforce our Terms; and comply with legal obligations.

Depending on your location and the context, our legal bases may include taking steps at your request and performing our contract with you, your consent, our legitimate interests in operating, measuring, and securing Kabo, and compliance with law. Withdrawal of consent does not affect processing already carried out lawfully.

5. How information may be disclosed

We may disclose personal data to contracted hosting, database, authentication, public-data retrieval, AI-processing, payment verification, analytics and attribution, monitoring, security, and support providers that need it to perform services for us and are subject to appropriate confidentiality and data-protection obligations. Apple App Store and Google Play process subscription transactions under their own terms and privacy policies. Google processes website analytics as our analytics provider. We may also disclose information where reasonably necessary to comply with law or lawful process; protect users, DEALISM, or others; investigate abuse; establish or defend legal claims; or complete a corporate transaction subject to appropriate safeguards. We do not permit service providers to use personal data for their own advertising.

6. International transfers

DEALISM is based in Singapore, and service providers may process data in other countries with different data-protection laws. Where required, we use contractual or other safeguards intended to ensure an appropriate or comparable standard of protection, including safeguards required by Singapore's Personal Data Protection Act 2012 (“PDPA”).

7. Retention

• Account, session, onboarding, creator-profile, public creator observations, generated reports, scripts, uploaded or recorded video assets, transcripts, analyses, and recording metadata are retained while needed to provide and secure the account or requested feature, subject to deletion requests and applicable law.
• Authorized Instagram profiles, media, metrics and derived account reviews are removed from active storage when you disconnect, revoke access through Instagram, or delete your Kabo account. We stop access and prevent pending tasks from restoring the removed data. Remote permission revocation is processed asynchronously. We may temporarily retain an encrypted credential and minimal routing information solely to complete or retry that revocation, until successful or until the token expires. Disconnecting an Instagram connection does not remove independently collected public research, your separate drafts, or videos you chose to save through other Kabo features.
• Authorized TikTok profiles, video metadata, and metrics are removed from active storage when you disconnect, revoke access through TikTok, or delete your Kabo account. We stop access and block pending tasks from restoring the data. Remote permission revocation is processed asynchronously. An encrypted credential and minimal routing information may be retained only to complete or retry revocation, until it succeeds or the refresh grant expires. Disconnecting does not remove independently collected public research, separate drafts, or videos saved through other Kabo features.
• Purchase and subscription records are retained while needed to verify access, support restoration, prevent token reuse or fraud, resolve disputes, and meet legal or accounting obligations.
• Attribution, analytics, and ordinary security records are retained only for the periods reasonably needed for measurement, reliability, security, fraud prevention, and legal compliance.
• After a valid account-deletion request, associated server account data is deleted or de-identified unless limited retention is reasonably necessary for law, security, fraud prevention, disputes, payment records, or backup integrity.

8. Security

We use encrypted transport, access controls, secret isolation, and reasonable administrative and technical safeguards designed to protect personal data from unauthorized access, loss, misuse, or alteration. No transmission or storage system is completely secure, so we cannot guarantee absolute security. Protect your credentials and never share a password, one-time code, purchase token, or authorization token with us by email.

9. Account deletion and your choices

iOS and Android users can open Account → Delete account. You may also follow the web deletion instructions or email developer@dealism.com. You can revoke Kabo's Apple or Google authorization in the applicable account settings and can reset or limit advertising or device identifiers through system settings. You can limit website analytics through your browser settings or Google's Analytics opt-out browser add-on. Clearing Kabo's site data resets the anonymous free-tool identifier and local usage counts. Blocking analytics does not affect Kabo's core features. Revoking authorization stops future access but is not always a substitute for deleting the Kabo account.

10. Access, correction, deletion, and other rights

Depending on where you live, you may request access, correction, deletion, restriction, objection, withdrawal of consent, or certain data portability, and may complain to a data-protection authority. Singapore users may exercise applicable access and correction rights under the PDPA. Email developer@dealism.com to submit a request. We may verify your identity and may retain or decline information where an applicable legal exception permits it.

11. Children

Kabo is not directed to children under 13. You must also meet any higher minimum age required in your country to consent to data processing or use an online service. If we learn that we collected a child's data without valid authorization, we will take reasonable steps to delete it.

12. Changes and contact

We may update this Policy when Kabo, our data practices, or applicable law changes. We will update the effective date and provide additional notice where required. Contact DEALISM PTE. LTD. at developer@dealism.com for privacy and data-protection inquiries.