Who we are
Kate AI is operated by ANDREOU INNOVATIONS LTD, company number HE 482315, based in Nicosia, Cyprus. References to “Kate AI,” “Kate,” “we,” “us,” or “our” in this policy refer to ANDREOU INNOVATIONS LTD.
For personal data collected through our website, waitlist, marketing, account administration, billing, service operations, and direct communications, ANDREOU INNOVATIONS LTD is generally the data controller. This means we decide why and how that personal data is used.
When a business customer submits personal data about its own employees, customers, social-media followers, or other individuals and asks Kate AI to process that data solely to provide the service, the business customer is normally the controller and Kate AI acts as its processor or service provider. See the Business customer data section below.
Scope of this Privacy Policy
This policy applies when you:
- visit the Kate AI website or landing pages;
- join the early-access or launch waitlist;
- contact us, request support, or communicate with our team;
- create or use a Kate AI account after the platform launches;
- upload brand assets, product information, screenshots, images, documents, prompts, or other content;
- connect an eligible Facebook Page or Instagram Professional account;
- generate, review, schedule, or publish social-media content; or
- subscribe to, pay for, or otherwise use our services.
Pre-launch notice: Kate AI is currently preparing for a planned September 2026 launch. Some sections of this policy describe processing that will apply only when the relevant platform feature becomes available and you choose to use it.
This policy does not govern third-party websites, social networks, payment services, or other services that have their own privacy notices. Where we link to or integrate with a third party, you should also review that party's privacy information.
Personal data we collect
The personal data we collect depends on whether you are visiting the website, joining the waitlist, operating a customer account, or using a connected service.
Waitlist and marketing data
Your email address, optional business name, subscription preferences, consent record, campaign attribution such as UTM parameters, and engagement with launch or marketing emails.
Account and business profile
Your name, work email, business name, role, country, account identifiers, authentication information, team membership, workspace settings, and selected service preferences.
Brand and content data
Website URL, public website content, logos, brand colors, fonts, screenshots, product images, service descriptions, release notes, prompts, generated visuals, captions, hashtags, edits, and approval history.
Website analysis data
Public pages and assets available at a website address you provide, including product or service information, images, page metadata, and brand references used to build your brand profile.
Connected social-platform data
Facebook Page and Instagram Professional account identifiers, profile metadata, permissions, access tokens, publishing status, approved content, and available performance insights when you enable those features.
Billing and transaction data
Subscription plan, billing name and address, tax information, payment status, invoices, transaction references, refunds, and limited payment metadata. Full card details are generally collected directly by our payment provider.
Technical and security data
IP address, device and browser information, timestamps, approximate location derived from IP, cookie or session identifiers, diagnostic events, server logs, fraud signals, and security records.
Communications and support
Messages, support requests, feedback, survey responses, attachments, call or meeting notes, and other information you choose to send to us.
Information from other sources
We may also receive personal data from:
- your employer or another workspace administrator who invites you to a Kate AI account;
- Meta when you authorize a Facebook or Instagram connection;
- payment, authentication, analytics, security, and email-delivery providers;
- public websites and public business pages that you ask Kate AI to analyze; and
- referral partners or campaign platforms where you have permitted the disclosure.
Please do not upload health information, government identifiers, payment-card details, passwords, or other highly sensitive personal data unless a Kate AI feature expressly supports that information and we have agreed in writing to process it.
How we use personal data and our legal bases
Under applicable data-protection law, we need a valid reason, often called a legal basis, to process personal data. The legal basis depends on the purpose and context.
| Purpose | Examples of data | Legal basis |
|---|---|---|
| Operate the waitlist | Email address, business name, consent record, source campaign, and communication preferences. | Consent, including your choice to receive launch communications. |
| Create and manage accounts | Identity, work contact details, authentication identifiers, team membership, and settings. | Taking steps at your request before a contract and performing our contract with you or your business. |
| Analyze your brand and generate content | Website data, brand assets, product information, prompts, drafts, edits, and generated outputs. | Performance of our contract and your instructions when you use these features. |
| Connect, schedule, and publish | Social account identifiers, permissions, tokens, content, schedules, and publishing results. | Performance of our contract and your instructions. |
| Process subscriptions and comply with finance law | Billing details, invoices, payment status, tax information, and transaction records. | Performance of our contract and compliance with legal obligations. |
| Provide support and service communications | Contact details, account information, support requests, service notices, and troubleshooting data. | Performance of our contract and our legitimate interest in supporting users and operating the service. |
| Protect the service | IP address, security logs, device data, authentication events, abuse signals, and audit records. | Our legitimate interests in preventing fraud, abuse, unauthorized access, and service disruption, and compliance with legal obligations where applicable. |
| Measure and improve Kate AI | Feature usage, diagnostics, aggregated performance data, feedback, and consented analytics data. | Our legitimate interests in improving a secure and useful service; consent for non-essential cookies or analytics where required. |
| Send relevant marketing | Contact details, preferences, customer relationship, and campaign engagement. | Consent where required, or our legitimate interests where direct marketing is permitted by law. You may opt out at any time. |
| Establish or defend legal claims | Account, transaction, communication, security, and contractual records. | Compliance with legal obligations and our legitimate interests in protecting our rights. |
Where we rely on legitimate interests, we consider the expected benefit, necessity of the processing, impact on individuals, and available safeguards. Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that was lawful before withdrawal.
You are not required to provide optional information. However, if you do not provide data that is necessary to create an account, process payment, connect a platform, or provide a requested feature, we may be unable to deliver that part of the service.
Website analysis and AI-generated content
Website and brand analysis
When you provide a website URL, Kate AI may retrieve and analyze publicly accessible pages, text, images, metadata, branding, product or service descriptions, and other assets from that website. We use this information to create a brand profile and generate content relevant to the business you identify.
Website analysis may incidentally collect personal data displayed on public pages, such as staff names, professional photographs, testimonials, or contact details. You should only ask us to analyze a website or use content where you have authority and an appropriate lawful basis to do so.
AI processing
Kate AI uses automated systems and third-party AI-generation services to create drafts, images, captions, hashtags, content suggestions, summaries, and brand profiles. To produce an output, relevant prompts, business information, and approved assets may be sent to an AI service provider.
- Generated content may be inaccurate, incomplete, or unsuitable and should be reviewed before publication.
- You can edit, regenerate, approve, reject, reschedule, or skip content. Automatic publishing is optional and controlled through your account settings.
- Kate AI does not use automated processing to make decisions about individuals that produce legal or similarly significant effects.
- We do not use private customer content to train a general-purpose Kate AI model without permission. We aim to select and configure production AI providers so they do not use customer API content for unrelated general-model training where contractual and technical controls are available.
Before the paid platform launches, we will identify material production AI providers in this policy or in a current subprocessor notice. Provider-specific retention and processing terms may vary, and we will apply contractual, access, minimization, and transfer safeguards appropriate to the service.
International data transfers
Kate AI is operated from Cyprus, within the European Union. Some service providers or their infrastructure may be located outside the European Economic Area, including in countries whose data-protection laws may differ from those in your country.
Where personal data is transferred outside the EEA and a suitable adequacy decision does not apply, we use an appropriate transfer mechanism where required, such as European Commission Standard Contractual Clauses, together with supplementary technical, contractual, or organizational measures where appropriate.
You may contact us to request more information about the transfer safeguards relevant to your personal data. Certain confidential or commercially sensitive terms may be summarized rather than provided in full.
How long we keep personal data
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, to provide the service, resolve disputes, maintain security, enforce agreements, and comply with legal, tax, accounting, and regulatory obligations.
| Data category | Typical retention approach |
|---|---|
| Waitlist and launch marketing | Until you unsubscribe, we determine the launch communications are no longer relevant, or approximately 24 months after your last meaningful engagement, whichever occurs first. A minimal suppression record may be retained to respect your opt-out. |
| Account and workspace data | For the life of the account and normally up to 90 days after account closure, unless a longer period is necessary for recovery, disputes, security, or law. |
| Brand assets, prompts, and generated content | While the workspace is active and normally deleted or anonymized within 90 days after account closure or a valid deletion request, subject to backup cycles, legal holds, and content already published to third-party platforms. |
| Connected-platform tokens | Until you disconnect the relevant account, the permission expires, or the Kate AI account closes. Tokens are then revoked or deleted as soon as reasonably practicable, subject to secure backup cycles. |
| Security and operational logs | Usually up to 12 months, unless a longer period is necessary to investigate an incident, prevent abuse, or establish legal claims. |
| Support communications | Normally for the active customer relationship and up to 24 months afterward, depending on the nature of the request. |
| Billing, invoice, and tax records | For the period required by applicable accounting, tax, anti-fraud, and legal obligations. |
Secure backups may persist for a limited period after deletion and are isolated from ordinary use. We may retain aggregated or irreversibly anonymized information for longer because it no longer identifies an individual.
How we protect personal data
We use technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.
- role-based and least-privilege access controls;
- encryption in transit and, where appropriate, encryption at rest;
- protected storage and handling of social-platform credentials and access tokens;
- authentication controls, audit logging, rate limiting, and abuse prevention;
- logical separation of customer workspaces and stored assets;
- backups, monitoring, vulnerability management, and incident response procedures; and
- contractual confidentiality and security obligations for relevant service providers.
No online service can guarantee absolute security. You are responsible for protecting your account credentials, using a secure device, limiting workspace access to authorized users, and notifying us promptly if you suspect unauthorized access.
If a personal-data breach occurs, we will investigate and provide notifications to affected individuals and supervisory authorities where required by applicable law.
Your privacy rights
Depending on your location and the circumstances, you may have the right to:
Rights are not absolute and may be limited where an exemption applies, where we need data to comply with law, or where retaining information is necessary to establish, exercise, or defend legal claims.
To exercise a right, email privacy@trykate.app. We may ask for information needed to verify your identity and locate the relevant data. We normally respond within one month, although the response period may be extended where permitted for a complex or numerous request.
You may unsubscribe from marketing emails at any time using the link included in the message or by contacting us. Service, security, billing, and account notices are not marketing and may still be sent where necessary.
Complaints in Cyprus
You have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus or another competent supervisory authority in your country. We encourage you to contact us first so we can try to resolve the issue.
Visit the Cyprus data-protection authorityRights outside the EEA
Some jurisdictions provide additional rights to know, access, correct, delete, or opt out of certain uses of personal data. We do not sell personal data for money. If advertising technologies we use constitute “sharing,” targeted advertising, or a similar regulated activity under applicable law, we will provide the notices and choices required in that jurisdiction.
Personal data provided by business customers
A Kate AI customer may upload or connect information that includes personal data relating to staff members, clients, customers, followers, testimonial authors, models, creators, or other people. In this context, the business customer normally decides why the data is used and is responsible for:
- having a valid legal basis and all necessary rights or permissions;
- providing required privacy notices to affected individuals;
- ensuring instructions given to Kate AI are lawful and appropriate;
- limiting uploads to information genuinely needed for the service; and
- responding to individual rights requests, with reasonable assistance from us where required.
Where Kate AI acts as a processor, our processing will be governed by the applicable customer agreement and data-processing terms. We process that data only to provide, secure, maintain, and support the service, according to documented customer instructions and applicable law.
Customers should not use Kate AI to infer sensitive traits, build intrusive profiles of individuals, create deceptive endorsements, or publish personal data without appropriate authorization.
Children
Kate AI is a business service and is not directed to children or intended for use by anyone under 18. We do not knowingly collect personal data directly from children through account registration or the waitlist.
If you believe a child has provided personal data to us without appropriate authorization, contact privacy@trykate.app, and we will review the request and take appropriate action.
Changes to this Privacy Policy
We may update this policy as Kate AI develops, new features launch, service providers change, or legal requirements evolve. The “Last updated” date at the top shows when the latest revision took effect.
If a change materially affects how we use personal data, we will provide an appropriate notice, such as an email, account message, or prominent website notice, before the change takes effect where required.
Contact us
Questions, requests, or concerns about this Privacy Policy or our handling of personal data can be sent to:
Facebook and Instagram connections
If you connect an eligible Facebook Page or Instagram Professional account, the authorization process is handled through Meta's official tools. Kate AI does not need your Facebook or Instagram password.
Depending on the permissions you approve and the features available, Kate AI may access and process:
We use connected-platform data only to provide, secure, support, and improve the features you request; comply with applicable platform terms; and maintain records of publishing activity. We do not sell access tokens or use connected-account content to advertise unrelated third-party products.
When social publishing becomes available, access tokens will be protected with encryption, limited-access controls, and operational safeguards. You can disconnect an account through Kate AI or the relevant Meta settings. Disconnecting stops future access, but it does not delete content already published to Facebook or Instagram. Meta may continue to process published content under its own privacy terms.