Privacy Policy

Kallos Labs is a software engineering and marketing studio. We respect your privacy and are committed to protecting the personal information you share with us. This policy applies to our website, our intake forms, our social media publishing service, and any communications between you and Kallos Labs. It does not apply to third-party websites, services, or platforms that we link to but do not control.

By using our website or submitting information through our contact form, you acknowledge that you have read and understood this Privacy Policy.

We collect information in the following ways, and only to the extent necessary to operate our business and respond to your requests:

• Information you provide directly — your name, email address, and the project details you submit through our contact or intake forms.
• Communications — the content of messages you send us by email or form, and our replies.
• Technical data — limited, aggregated information such as browser type, device category, and pages visited, used to keep the site secure and performant.
• Cookies and similar technologies — strictly necessary storage used to remember your cookie preferences and maintain basic site functionality. See our cookie disclosure below.

We do not knowingly collect special categories of sensitive personal data, and we ask that you do not submit such information through our forms.

We use the information we collect for legitimate business purposes, including to:

• Respond to your inquiries and provide the engineering and marketing services you request.
• Scope, plan, and deliver projects, including architecture reviews and proposals.
• Operate, maintain, secure, and improve our website and services.
• Comply with legal obligations and enforce our agreements.
• Send you service-related communications about an active or prospective engagement.

We do not sell your personal information, and we do not use it for third-party advertising.

Kallos Labs operates a private content system (the "Kallos CRM") that our team and our clients use to plan, review, approve, and publish posts to social media accounts that belong to Kallos Labs or to our clients. It publishes only through the official APIs of each platform: Facebook, Instagram, Threads, X, LinkedIn, Pinterest, TikTok, YouTube, Tumblr, Dribbble, Bluesky, and Mastodon. We do not use browser automation, scraping, or shared passwords to post.

An account is connected only when its owner, or a person the owner authorizes to manage it, signs in on the platform's own consent screen and approves the requested permissions. Every post is reviewed and approved by a person before it is published. The service is not offered to the general public; it is provided to our clients under a written agreement.

When an account is connected, we receive only what the platform sends for the permissions you approve, and we keep only what we need to publish and confirm your posts:

• Account identity: the platform's account or user ID, username or handle, and display name (for LinkedIn, the member's name and email address from Sign In with LinkedIn; for YouTube, the channel ID and channel title; for Meta, the Facebook Pages and linked Instagram professional accounts you manage, so you can choose the one to connect).
• Access credentials: OAuth access tokens and, where the platform issues them, refresh tokens, together with the permissions granted and their expiry dates.
• Publishing information: for posts we publish for you, the platform's post or media ID, its link, its processing and publishing status, and the account limits the platform reports (for example, daily posting limits, or the privacy and interaction options TikTok offers for your account).

We do not request or read direct messages, followers or contact lists, other people's content, or advertising data, and we do not request permissions we do not use.

• We use connected account data only to publish the content you approved to the account you chose, to check that a post goes to the right account, to confirm that it was published and show you its status and link, and to keep the connection working (token refresh and expiry reminders).
• We do not sell connected account data, use it for advertising, use it to build profiles of anyone, or use it to train artificial intelligence or machine learning models.
• We do not share connected account data with third parties, except with the platform itself when publishing, with infrastructure providers that host our systems under confidentiality obligations, or when required by law.
• Access and refresh tokens are encrypted at rest (AES-256-GCM) on a server controlled by Kallos Labs. They are never shown in a browser, sent by email, or written to logs. Only a small number of authorized Kallos Labs staff can operate the system, and staff do not read connected account data except to provide support you ask for, to investigate abuse or security issues, or to comply with law.

Our YouTube integration uses YouTube API Services. By connecting a YouTube channel, you agree to be bound by the YouTube Terms of Service (https://www.youtube.com/t/terms), and Google's handling of your data is described in the Google Privacy Policy (https://policies.google.com/privacy).

With your permission we use the scopes youtube.upload, to upload the videos you approve to your channel and set their thumbnails, and youtube.readonly, to confirm the connected channel and check the status of the videos we uploaded. We store the channel ID and title, OAuth tokens, and the IDs and status of the videos we uploaded, as described above. We refresh or delete this stored YouTube data at least every 30 days. We do not use cookies or similar storage on your device for this integration.

Kallos Labs' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

You can revoke our access at any time from your Google Account security settings (https://myaccount.google.com/permissions). When access is revoked or you ask us to delete your data, we delete the stored tokens and the channel's data within 7 days, except records we must keep by law.

You can disconnect a social account at any time, in the Kallos CRM or by removing Kallos Labs from the apps and websites settings of the platform. When an account is disconnected, its tokens are deleted from our store right away and, where the platform offers it, we also revoke them at the platform. When Facebook, Instagram, or Threads notifies us that you removed our app or asked for deletion, we do the same automatically.

Records of posts we published for you (post IDs, links, captions, and status) are kept for your account history while our engagement lasts and are deleted within 30 days of a deletion request or the end of the engagement, unless the law requires us to keep them longer. Step-by-step instructions are on our Data Deletion page (https://kalloslabs.com/data-deletion).

Where the EU/UK General Data Protection Regulation applies, we process personal data under one or more of the following legal bases: your consent; the performance of a contract with you; compliance with a legal obligation; and our legitimate interests in operating and improving our business, provided those interests are not overridden by your rights.

We share personal information only in limited circumstances:

• Service providers — trusted vendors who process data on our behalf (for example, hosting, email, and infrastructure providers) under contractual confidentiality and data-protection obligations.
• Legal and safety — when required by law, regulation, legal process, or to protect the rights, property, or safety of Kallos Labs, our clients, or others.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to the protections described in this policy.

We do not sell, rent, or trade your personal information to third parties.

We are based in the United States and may process information in countries other than your own. Where we transfer personal data internationally, we rely on appropriate safeguards such as standard contractual clauses or equivalent mechanisms to protect your information.

We retain personal information only for as long as necessary to fulfill the purposes described in this policy, to comply with our legal obligations, to resolve disputes, and to enforce our agreements. When information is no longer needed, we delete or anonymize it using commercially reasonable measures.

We implement administrative, technical, and organizational measures designed to protect personal information against unauthorized access, loss, misuse, or alteration. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

Depending on your location, you may have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion of your personal information.
• Object to or restrict certain processing.
• Request portability of information you provided to us.
• Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, contact us at hello@kalloslabs.com. We will respond within the timeframe required by applicable law. You also have the right to lodge a complaint with your local data-protection authority.

Our website uses a minimal set of cookies and browser local storage. Strictly necessary storage remembers your cookie-consent choice and keeps the site functioning. With your consent, we also use Google Analytics to understand how the site is used — these analytics cookies are only set after you accept, and you can decline them. We do not use advertising or cross-site tracking cookies. You can change or withdraw your consent at any time using the cookie banner, and you can clear stored preferences through your browser settings.

Our website and services are intended for businesses and individuals aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has provided us information, please contact us so we can delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will revise the effective date at the top of this page and, where appropriate, provide additional notice. Your continued use of our website after changes take effect constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or our data practices, contact Kallos Labs LLC, 1209 Mountain Road Pl NE, Ste R, Albuquerque, NM 87110, United States, or by email at hello@kalloslabs.com.