Privacy policy

Kylip is operated by Kylip. This policy explains how we handle personal data when you visit our website, create a Kylip workspace, or interact with a business that uses Kylip — for example by filling in its form, answering its lead ad, or messaging it on WhatsApp.

We follow India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000 and its rules. Where the GDPR or similar laws apply to you, you have the rights they give as well.

For the people who sign up for and run a workspace — owners, admins and hosts — and for visitors to kylip.app, Kylip decides how the data is used. We are the data fiduciary (controller).

For the data a business keeps in its workspace — its leads, contacts, clients and their form answers — that business is the data fiduciary and Kylip is its data processor. We process that data only to provide the Service to the business and on its instructions. If you are a client or lead of a business using Kylip, that business's own privacy notice governs how it uses your data, and you should contact it first with any request.

Account data: your name, email address, phone number, password (stored only as a secure hash), role, and the workspace's business name, logo, contact details, address and social links.

Billing data: plan, invoices, GST details if you provide them, and payment status. Card, UPI and bank details are entered directly with Razorpay; we never see or store full card numbers.

Workspace content, on behalf of our customers: leads and contacts (name, email, phone, city and similar), answers to forms and lead ads, where a lead came from, pipeline stage, notes, follow-up dates, activity history, and the messages the business sends through Kylip.

Integration data: when a business connects Meta, Google, YouTube or a WhatsApp provider, we store encrypted access tokens and the identifiers needed to fetch leads, write to the chosen spreadsheet or calendar, send messages, publish posts, and send lead results to the business's own Meta dataset.

Social post data: the captions, photos, videos and thumbnails a business uploads for its posts, the schedule, which Page, account or channel each post went to, the post's status, and the post IDs and links the platform returns.

Technical data: IP address, browser and device type, pages visited, and logs used for security, debugging and preventing abuse.

• To provide the Service: create and secure accounts, capture and route leads, send reminders and notifications, and sync with the integrations you choose.

• To bill you and meet our tax and accounting obligations.

• To send service emails — verification, password resets, lead notifications, receipts and important changes. We send marketing emails only if you agree, and you can unsubscribe at any time.

• To keep the Service safe: detect fraud and abuse, enforce our Terms, and fix problems.

• To improve the Service using aggregated, de-identified usage information.

We do not sell personal data, we do not use workspace content for advertising, and we do not use it to train AI models. Kylip has no AI image or video generation, and data from Google APIs, including YouTube, is never used to develop, improve or train AI models or to generate content.

We process account data to perform our contract with you, to comply with law, and — where the DPDP Act allows — for legitimate uses such as security. Where we rely on consent, you can withdraw it at any time, as easily as you gave it; that does not affect processing already done.

Businesses using Kylip are responsible for collecting any consent needed from their own leads and clients — including consent to receive WhatsApp messages, and explicit consent for health-related information in therapy and wellness practices.

When a business connects Facebook or Instagram lead ads, Kylip receives the lead's answers to that business's form (typically name, email and phone, plus any custom questions) and the ad, form and page identifiers. When a business connects WhatsApp, Kylip sends the messages it asks us to send and keeps a record of which messages were sent to whom.

When a business connects a Facebook Page or Instagram professional account for publishing, Kylip receives the Page or account name, picture and ID, publishes the posts the business creates or approves, and reads back each post's status and link so the business can see what went out.

YouTube: Kylip uses YouTube API Services. When a business connects a YouTube channel, Kylip reads the channel's name, picture and subscriber count, lists the channel's videos and their processing status, uploads the videos the business creates or approves, updates the title, description, tags, privacy setting and thumbnail of those videos when the business asks, and reads the channel's own YouTube Analytics (views, watch time, average view duration, subscribers gained and lost, likes and comments) to show a performance chart in the dashboard. Kylip does not delete videos or manage comments, ratings or captions. This data is shown only to the workspace that connected the channel.

By connecting YouTube you agree to the YouTube Terms of Service (https://www.youtube.com/t/terms), and Google's handling of your data is described in the Google Privacy Policy (https://policies.google.com/privacy). You can disconnect YouTube from Integrations at any time, which revokes Kylip's access with Google and deletes the stored access token. You can also remove Kylip's access from your Google Account at https://myaccount.google.com/permissions.

Kylip's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google access is limited to spreadsheets Kylip creates or you pick, and to a calendar Kylip creates — we cannot see the rest of your Drive or your other calendars.

If a business turns on "Send lead results to Meta", Kylip sends Meta the stage a lead reached (for example Qualified or Converted) with the lead's Meta lead ID, the ad click ID, or a one-way hash (SHA-256) of the lead's email and phone. Meta uses this to measure and improve that business's own ads. Kylip never sends the plain email or phone, the lead's answers, notes, IP address or browser details.

Data from Meta, Google and YouTube is used only to provide the features the business turned on. Kylip does not sell it, does not use it for its own advertising, and shares it only with the processors below.

We use trusted service providers (sub-processors) to run the Service. Each only receives what it needs and is bound by contract to protect it:

• MongoDB Atlas — database hosting;

• Cloudflare R2 and Cloudinary — storage and delivery of uploaded images such as logos;

• Resend — transactional email;

• Razorpay — subscription payments;

• Meta Platforms (Facebook, Instagram, WhatsApp) and WATI — lead ads, publishing posts, WhatsApp messaging and, when a business turns it on, sending lead results to its Meta dataset (Conversions API);

• Google — Sheets, Calendar and Ads lead forms, and YouTube (publishing and analytics), when a business connects them.

We may also disclose data where the law requires it, to protect people's safety or our rights, or to a buyer as part of a merger or acquisition, who would be bound by this policy. Some providers may store data outside India; where they do, we make sure appropriate safeguards are in place, in line with the transfer rules of the DPDP Act.

We use only the cookies needed to keep you signed in and to secure your session. We do not use advertising or third-party tracking cookies on kylip.app. You can block cookies in your browser, but you will not be able to sign in without them.

Data is encrypted in transit (HTTPS/TLS). Integration tokens are encrypted at rest, passwords are hashed, access within a workspace is limited by role, and workspaces are isolated from one another. Sensitive actions are logged. No system is perfectly secure; if a breach affects your data, we will notify you and the relevant authorities as the law requires.

Account and workspace data is kept while the workspace is active. Businesses can delete individual leads, contacts, forms and scheduled posts at any time.

When a social account or YouTube channel is disconnected, its access token is deleted straight away and nothing more is fetched from it. Post history and analytics already in the workspace stay until the business deletes them or the workspace is closed.

After a workspace is closed, we keep its data for 30 days so it can be reactivated or exported, then delete it. Backups are overwritten within a further 30 days.

We keep invoices and payment records for as long as Indian tax and company law requires (typically up to 8 years), and security logs for up to 180 days.

Depending on where you live, you can ask to access your personal data, correct or update it, delete it, withdraw consent, nominate someone to act for you, and receive a copy of it. You can also raise a grievance with us.

Email info@kylip.app from the address linked to your data. We verify requests before acting on them and respond within 30 days. If your data is held in a business's workspace, we will pass your request to that business and help it respond. See our Data Deletion page for deletion requests.

If you are not satisfied with our response, you can complain to the Data Protection Board of India or, where the GDPR applies, to your local data protection authority.

Kylip accounts are for adults. We do not knowingly collect children's data for our own purposes. Businesses that teach or coach children may keep a child's details in their workspace only with verifiable consent from a parent or guardian, and must not use it for tracking or targeted advertising.

We will post updates to this policy here and change the effective date. For significant changes we will also notify workspace owners by email.

Questions or requests: info@kylip.app. Our Grievance Officer can be reached at info@kylip.app. We acknowledge grievances within 48 hours and aim to resolve them within 30 days.