Privacy Policy

1. Who we are

Kittychat (the "Service") is an Instagram and TikTok messaging automation service operated by Peerprinter Inc. ("Company", "we", "us", or "our"), a company registered in Canada at 4915 Natkarni Cres., Mississauga, Ontario, Canada. The Service is available at https://www.kittychat.ai and in the Kittychat web application.

For personal data about you as a Kittychat user or website visitor, Peerprinter Inc. is the data controller. For personal data about the people who interact with your Instagram or TikTok account, we act as a data processor on your behalf (see Section 8).

Please read this Privacy Policy together with our Terms of Service. By using the Service, you acknowledge that your information will be handled as described in this Privacy Policy. Unless defined differently here, terms used in this Privacy Policy have the same meanings as in our Terms of Service.

2. Definitions

3. Information we collect

In short: we collect what you give us, what the Instagram and TikTok accounts you connect make available through their official APIs, and technical data generated when you use our website and app.

3.1 Information you provide to us

• Account information: name, email address, password (stored only in hashed form), phone number (optional), preferred language, and business or brand name.
• Billing information: plan, billing history, and billing country. Payment card details are entered directly with our payment processors (Stripe or Square) and are never stored on our servers.
• Content you create in the Service: automation settings, trigger keywords, message templates, buttons, lead-form configurations, and scheduled or bulk messages.
• AI knowledge base content: website URLs you ask us to scan, files you upload, and text you enter so that the AI chatbot can answer questions.
• Communications: messages you send to our support team, feedback, and survey answers.

3.2 Information from your Connected Accounts

When you connect an Instagram or TikTok account, we receive data through that platform's official API, limited to the permissions you approve. This includes account identifiers and profile information, access tokens, your posts and videos, comments, direct messages, and Story mentions. Section 6 gives the full list and explains how we use it.

3.3 Information about your audience

To run your automations, we process the public username and account ID of people who comment on your posts or message your account, the content of those comments and messages, their follow status, and any information they choose to submit through a lead form you create (for example name, email address, or phone number). See Section 8.

3.4 Information collected automatically

• Usage and device data: IP address, browser type and version, operating system, device type, language settings, referring URL, pages viewed, time and date of visits, time spent on pages, and diagnostic and error data.
• Cookies and similar technologies: see Section 10.
• Advertising and conversion data: if you arrive on our website by clicking a Kittychat ad, the ad platform's click identifier (for Google Ads, the gclid, gbraid, or wbraid parameter) and the campaign parameters in the link (UTM values). See Section 5.

3.5 Information we do not collect

• We do not access your Google Account or any data stored in it (such as Gmail, Google Drive, Google Contacts, or Google Calendar).
• We do not collect or store payment card numbers.
• We do not ask for your Instagram, Facebook, or TikTok password. Accounts are connected only through the platforms' official login and authorization flows.
• We do not intentionally collect sensitive (special-category) personal data, and we ask you not to put it into automations or AI knowledge bases.

4. How we use information and our legal bases

In short: we use your information to provide and secure the Service, to bill you, to support you, to improve the product, and to measure how well our own advertising works.

We do not use your personal data for automated decision-making that produces legal or similarly significant effects on you.

5. Google Ads, Google Analytics, and Google API data

In short: we use the Google Ads API only to tell our own Google Ads account which ad clicks led to a sign-up or purchase. We never access your Google Account.

5.1 What we do not access

Kittychat does not offer "Sign in with Google" and does not request any OAuth permission (scope) to your personal Google Account. We do not access, read, store, or share your Gmail, Google Drive, Google Contacts, Google Calendar, YouTube account, or any other data in your Google Account.

5.2 How we use the Google Ads API

We advertise Kittychat on Google (for example in Google Search and on YouTube). To measure which ads actually bring new customers, Kittychat connects to our own Google Ads account through the Google Ads API. The process works like this:

1. When you click one of our ads, Google adds a click identifier (gclid, gbraid, or wbraid) to the link. Our website saves this identifier and any UTM campaign values in a first-party cookie.
2. If you then create a Kittychat account, we store the click identifier with your account record.
3. When a conversion event happens, we upload a conversion record to our Google Ads account through the Google Ads API. Conversion events are account sign-up, starting a trial, a paid subscription purchase, and a plan upgrade.

A conversion record contains only: the click identifier, the name of the conversion action (for example "Sign-up" or "Purchase"), the date and time of the conversion, and, for purchases, the conversion value and currency. Where we use Google's "enhanced conversions" feature, we may also send your email address in hashed form (irreversibly converted with SHA-256 before it leaves our systems) so that Google can match the conversion to the ad click.

We never send Google any data from your Connected Accounts. This includes your Instagram or TikTok messages, comments, followers, audience data, lead-form submissions, and AI knowledge base content.

Why we do this: to measure how effective our ads are, to decide where to spend our advertising budget, and to let Google's bidding tools optimize our campaigns. We do not use this data to build profiles of you for any other purpose. We do not sell it.

Google's role: Google processes conversion data as our service provider under the Google Ads Data Processing Terms. Google's use of information is described in Google's Privacy Policy and How Google uses information from sites or apps that use its services.

5.3 Google Analytics

We use Google Analytics 4 to understand how visitors use our website, for example which pages are visited and how people move through the sign-up flow. Google Analytics uses cookies and collects Usage Data such as pages viewed, approximate location derived from IP address, device and browser type, and referral source. We do not send your name, email address, or any Connected Account data to Google Analytics. You can prevent Google Analytics from collecting your data by installing the Google Analytics Opt-out Browser Add-on. More information: Google Analytics data safeguards.

5.4 Google API Services User Data Policy

Kittychat's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, any information we receive through Google APIs:

• is used only to provide the conversion measurement described above;
• is not transferred to others except as necessary to provide that function, to comply with applicable law, or as part of a merger or acquisition with prior notice;
• is not used for serving ads based on your personal data and is not sold;
• is not used to determine creditworthiness or for lending purposes;
• is not read by humans unless required for security purposes, to comply with applicable law, or with your explicit permission;
• is not used to develop, improve, or train generalized AI or machine-learning models.

5.5 Your choices

• Refuse or delete cookies in your browser, or decline advertising cookies in our cookie banner where one is shown. Without the cookie, your ad click cannot be linked to a sign-up.
• Manage personalized ads from Google at My Ad Center.
• Email hello@kittychat.ai to ask us not to upload conversion data about your account or to delete the click identifiers we hold. We will act on your request within 30 days.

6. Instagram, Meta, and TikTok platform data

In short: we access your social accounts only through official APIs, only with the permissions you grant, and only to run the features you turn on.

6.1 Instagram and Meta

The Service connects to your Instagram professional account through the official APIs provided by Instagram and Meta Platforms, Inc. ("Meta"). With your permission, we access and process:

• Your Instagram account identifiers and profile information: account ID, username, profile name, profile picture, and the linked Facebook Page where applicable.
• Access tokens issued by Meta that let the Service act on your behalf.
• Your posts, Reels, and Stories and their identifiers, so that an automation can be attached to a specific post.
• Comments on your posts, and the public username and account ID of the commenter, to detect trigger keywords and post replies.
• Direct message (DM) conversations sent to or from your account through the Service, including message content. We use these to send auto-DMs, run the AI chatbot, and show conversation history.
• Story mentions of your account.
• The follow status of a person who has interacted with you, used only for the follow-check feature.
• Aggregate metrics such as delivery, click, and response counts, to show your statistics.

6.2 TikTok

If you connect a TikTok account, the Service accesses it through TikTok's official APIs. With your permission, we access and process:

• Your TikTok account identifiers and basic profile information: open ID, display name, username, and avatar.
• Access and refresh tokens issued by TikTok.
• Your videos and their identifiers, so that an automation can be attached to a specific video.
• Comments on your videos, and the public username and ID of the commenter, to detect trigger keywords and post replies.
• Direct messages sent to or from your account through the Service, including message content, where TikTok's APIs make this available.
• Aggregate metrics about your automations.

6.3 Our commitments for platform data

• We use platform data only to provide and improve the features you use, to keep them safe, and to comply with law.
• We do not sell platform data. We do not use it for advertising, and we do not share it with data brokers.
• We do not use platform data to train our own or third-party AI models.
• We do not build profiles of your audience beyond what is needed to run your automations.
• We handle this data in line with Meta's Platform Terms and Developer Policies and TikTok's Developer Terms of Service.
• You can revoke our access at any time (see Section 13).

7. AI features and third-party AI processing

In short: AI features are optional and run through the OpenAI API. OpenAI does not use API data to train its models by default.

The Service offers optional AI-powered features, including the AI DM inquiry chatbot, draft mode, and AI message variation. These features use third-party AI providers, currently the OpenAI API.

• When you enable an AI feature, the relevant content is sent to the AI provider to generate a response. Depending on the feature, this may include the message text you configure, your AI knowledge base content, and incoming messages from your audience.
• Data sent through the OpenAI API is subject to OpenAI's API data usage policies. OpenAI states that data submitted through its API is not used to train its models by default. See OpenAI's privacy policy.
• If you turn on conversation transcripts by email, we email the AI conversation transcript to the address you choose.
• Do not enter sensitive personal data, payment card details, passwords, or special-category data into AI knowledge bases or AI-enabled message flows.
• AI-generated output may be inaccurate. You are responsible for reviewing and monitoring what the AI sends to your audience under your account and brand. See the Terms of Service.
• If you turn off the AI features, no further content from your account is sent to the AI provider.

8. Data of your audience and our role as processor

When you use the Service, we process personal data about your audience: the followers and visitors who comment on your posts, send you DMs, mention you in a Story, or submit a lead form.

For this data, you are the data controller and we act as a data processor on your behalf. We process it only on your documented instructions, which are the settings and automations you configure in the Service.

As the controller, you are responsible for:

• having a valid lawful basis (such as consent) to message your audience and to process their data;
• complying with all applicable privacy, marketing, and anti-spam laws where your audience is located;
• giving your audience your own privacy notice, and honoring their requests to access, correct, or delete their data;
• the content of every message sent from your account through the Service, including automated and AI-generated messages;
• complying with Meta's, Instagram's, and TikTok's policies on automated messaging.

If a member of your audience contacts us directly with a data request, we will generally refer them to you, unless the law requires us to act. We will help you respond to such requests as far as reasonably possible. You can delete audience data (such as leads) from your dashboard, or ask us to delete it by emailing hello@kittychat.ai.

9. How we share information

In short: we share data only with service providers that help us run Kittychat, when the law requires it, or with your consent. We do not sell personal data.

We share personal data only in these situations:

• Service providers (sub-processors) that process data on our behalf under contract. They are listed below.
• The platforms you connect. When our automation sends a reply or DM, the content is sent to Meta or TikTok for delivery.
• Legal requirements. When required by law, court order, or a valid request by public authorities, or to protect the rights, property, or safety of our users, the public, or us.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets. You will be notified before your personal data becomes subject to a different privacy policy.
• With your consent. For example, if you agree to let us show your company logo as a customer on our website.

Our service providers may use personal data only to perform services for us and must protect it. This list may change as the Service evolves. The current list is available on request at hello@kittychat.ai.

10. Cookies and tracking technologies

We use cookies and similar technologies (such as tags, pixels, and local storage) on our website and in the app:

• Strictly necessary cookies: keep you logged in, keep the Service secure, and remember choices like closing the chat widget.
• Preference cookies: remember your language and settings.
• Analytics cookies: Google Analytics, to understand how the website is used.
• Advertising and conversion cookies: store ad click identifiers so we can measure which of our ads led to a sign-up or purchase (see Section 5).

Our website also embeds videos from Vimeo, which may set its own cookies when a video plays.

You can set your browser to refuse cookies or to alert you when cookies are sent. If you refuse strictly necessary cookies, some parts of the Service may not work. Where the law requires it (for example in the EU, the UK, or Korea), we ask for your consent before setting analytics or advertising cookies.

Do Not Track and Global Privacy Control

There is not yet a common industry standard for "Do Not Track" browser signals. We treat a Global Privacy Control (GPC) signal as a request to opt out of advertising conversion tracking for that browser where applicable law requires it.

11. International data transfers

We are based in Canada, and our main servers and many of our service providers are located in the United States. Your information may therefore be transferred to, stored in, and processed in Canada, the United States, and other countries where our service providers operate. Data protection laws there may differ from those in your country.

Where we transfer personal data out of the European Economic Area, the United Kingdom, Switzerland, or other regions with transfer rules, we use appropriate safeguards. These include the European Commission's Standard Contractual Clauses (Article 46(2)(c) GDPR) and the UK International Data Transfer Addendum, or rely on an adequacy decision (for example for Canada).

12. Data retention

In short: we keep data only as long as needed for the purposes in this policy, and we delete it on the schedule below.

We may keep data longer where the law requires it or to resolve disputes and enforce our agreements. When we no longer need data, we delete it or irreversibly anonymize it.

13. Disconnecting accounts and deleting your data

Disconnect an Instagram or TikTok account

1. In Kittychat, open your account settings and choose Disconnect for the account. We stop accessing new data from that account and delete the stored access token immediately.
2. You can also remove Kittychat from the platform itself:
   • Instagram: Settings and activity → Website permissions → Apps and websites → Kittychat → Remove.
   • Facebook: Settings & privacy → Settings → Business integrations → Kittychat → Remove.
   • TikTok: Settings and privacy → Security and permissions → Apps and services permissions → Kittychat → Remove access.

Delete your data or your account

• You can delete individual automations, conversations, and leads from your dashboard at any time.
• To delete your whole Kittychat account and all associated data, email hello@kittychat.ai from the email address registered to your account with the subject "Delete my account". We will confirm your identity and complete the deletion within 30 days. This includes Connected Account data, conversation content, audience data, AI knowledge base content, and ad click identifiers.
• If Meta or TikTok sends us a data deletion request because you removed our app, we process it the same way.

Some billing records may be kept as required by law (see Section 12).

14. Security of data

We use administrative, technical, and physical safeguards to protect personal data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These include:

• encryption of data in transit using HTTPS/TLS;
• encrypted storage of platform access tokens;
• hashing of passwords;
• access to personal data restricted to authorized personnel who need it for their job;
• regular backups and monitoring for unusual activity.

No method of transmission over the internet or of electronic storage is 100% secure. If we learn of a data breach that affects your personal data, we will notify you and the relevant authorities as required by law.

15. Your privacy rights

In short: depending on where you live, you can access, correct, delete, or export your data, and object to or restrict some processing. To use these rights, email hello@kittychat.ai.

All users

We respond to requests to access, correct, or delete your personal data from any user, wherever they live. We may need to verify your identity before responding. We respond within 30 days, or sooner if local law requires.

EEA, UK, and Switzerland (GDPR)

• Right of access, and to receive a copy of your personal data in a portable format.
• Right to rectification of inaccurate data.
• Right to erasure, subject to legal exceptions.
• Right to restrict processing.
• Right to object to processing based on legitimate interests, and to direct marketing at any time.
• Right to withdraw consent at any time, without affecting processing that took place before withdrawal.
• Right to lodge a complaint with the supervisory authority where you live, work, or where an alleged infringement occurred.

Canada (PIPEDA)

You may access and correct your personal information and withdraw consent, subject to legal or contractual restrictions. You may also contact the Office of the Privacy Commissioner of Canada.

Brazil (LGPD)

You have the rights described in Article 18 of the LGPD. These include confirmation of processing, access, correction, anonymization or deletion, portability, information about sharing, and withdrawal of consent. You may also file a complaint with the ANPD.

United States residents (California and other states)

• You may request to know, access, correct, and delete personal information we hold about you.
• We do not sell personal information. In the past 12 months, we have not sold personal information.
• We share limited data with Google for ad conversion measurement (see Section 5). Where state law treats this as "sharing" or "targeted advertising", you can opt out by emailing us or by enabling Global Privacy Control in your browser.
• We will not discriminate against you for using your rights.

California Online Privacy Protection Act (CalOPPA)

• You can visit our website without telling us who you are.
• This Privacy Policy is linked from the footer of every page of our website, including the homepage, and in the app.
• We will notify you of changes to this policy on this page and as described in Section 18.
• You can change your personal information in your account settings or by emailing us.

16. Children's privacy

The Service is not directed to children under 16, and we do not knowingly collect personal data from anyone under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us. We will delete that information.

17. Links to other sites

The Service links to third-party sites and services that we do not operate, such as our feature-request board, affiliate program portal, and support portal. Those services have their own privacy policies. We are not responsible for their content or practices, so please review their policies.

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page.

If we make a material change, we will notify you before the change takes effect by email and/or by a notice in the app. Material changes include changes to what data we collect, how we use Google, Instagram, Meta, or TikTok data, or who we share data with. Where the law requires, we will ask for your consent again. Previous versions of this policy are available on request.

19. Contact us

If you have questions about this Privacy Policy or want to exercise your rights, contact us:

For users in South Korea, we comply with the Personal Information Protection Act (PIPA) and related laws.

• Destruction: Unless the law requires otherwise, personal data is destroyed without delay when you withdraw consent, when the purpose of collection is achieved, or when the retention period ends. Electronic files are deleted in a way that cannot be restored, and paper records are shredded. If the law requires us to keep data, it is stored separately from other data and destroyed when the legal period ends.
• Overseas transfer and outsourcing: Personal data is transferred over the network to the providers listed in Section 9, in the countries shown there, when you use the Service. It is kept for the periods in Section 12. If you do not want your data transferred overseas, you can refuse by not using the Service or by deleting your account. However, the Service cannot be provided without these transfers.
• Third-party provision: We do not provide your personal data to third parties without your consent, except as permitted by law.
• Privacy officer: Taewoo No, CEO · hello@kittychat.ai · 1-647-767-6444.
• Remedies: You can also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, ☎ 118), the Personal Information Dispute Mediation Committee (www.kopico.go.kr, ☎ 1833-6972), the Supreme Prosecutors' Office Cybercrime Investigation Division (☎ 1301), or the Korean National Police Agency Cyber Bureau (ecrm.police.go.kr, ☎ 182).

We comply with Japanese laws and regulations, including the Act on the Protection of Personal Information (APPI). When we provide personal data to service providers in foreign countries (see Section 9), we take the measures required by the APPI to ensure that the data is protected. We remain responsible for the management of personal data we entrust to affiliates or third parties. We do not provide your information to third parties for their marketing purposes without your prior consent. For requests for disclosure, correction, suspension of use, or deletion, contact hello@kittychat.ai.

© Peerprinter Inc. 2026. All Rights Reserved.