Privacy policy
Version of 2026-10-24 · This English version is a translation; the French version prevails.
- Data controller
- Data we collect
- Purposes and legal bases
- What we don't do
- Recipients and service providers
- Explore: what is public
- Retention periods
- Your rights
- Minimum age
- Security
- Cookies and changes
1. Data controller
Hugo MARIE, sole trader trading as Kelio.AI, 6 allée des Bleuets, 35133 Saint-Germain-en-Coglès, France. Contact for any question about your data: hugomariepro@gmail.com.
2. Data we collect
- Account: email address, login identifier and, if you sign in with a third-party account (e.g. Google), the information it provides (name, photo). Creation and last activity dates.
- Audience measurement: pages viewed, referrer, country, device and browser type, anonymously and in aggregate, without cookies, via Vercel Web Analytics. You are not identified and your visits are not tracked from one day to the next.
- Waiting list: email address, language, sign-up date and possible source (for example "instagram"), if you join the list on the /early-access page before the site opens.
- Creations: text prompts, images you upload, generated videos and their settings, exported edits (processed in your browser, not stored by us).
- Purchases: packs bought, amounts, dates, subscription status, Stripe identifiers. Your card details are handled only by Stripe.
- Credits and referrals: balance, credit debits and refunds, referral code, referrer link; for free sign-up credits, an encrypted, non-reversible fingerprint of your email address and IP address, so they cannot be claimed several times.
- Social publishing (subscribers): linked accounts (username, picture), titles, descriptions, dates and time zone of posts. Access authorisations to your networks are held by Upload-Post, not by Kelio.AI.
- Security and moderation: requests refused by moderation (excerpt and reason), video reports, technical logs (IP address, browser, date) kept by the host.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR, art. 6) |
|---|---|
| Create and manage your account, generate and store your videos, editor, Explore, social publishing, referrals, support | Performance of the contract |
| Payments, invoicing, accounting | Performance of the contract and legal obligation |
| Moderating requests, handling reports, responding to authorities | Legal obligation (Digital Services Act) and legitimate interest (safety of the service and third parties) |
| Anonymous audience measurement to improve the site | Legitimate interest |
| Waiting list: emailing you when the site opens and granting the promised bonus credits | Consent (you can withdraw it at any time) |
| Security, preventing fraud and abuse (multiple accounts, referrals, free credits) | Legitimate interest |
4. What we don't do
No targeted advertising, no sale of data, no third-party analytics, no marketing emails. We do not use your content to train artificial intelligence models.
5. Recipients and service providers
Your data is only accessible to the publisher and to the technical providers below, which act on our instructions (processors) under a data processing agreement. Stripe also acts on its own behalf for its legal obligations (fraud and anti-money laundering). When you publish to TikTok, Instagram or YouTube, those networks then process the video under their own rules.
| Provider | Country | Role | Non-EU transfer safeguard |
|---|---|---|---|
| Clerk, Inc. | USA | Sign-in and account management | Data Privacy Framework + standard contractual clauses |
| Vercel Inc. | USA | Website hosting and technical logs | Data Privacy Framework |
| Neon, Inc. | USA (database: see below) | Database | Standard contractual clauses |
| Cloudflare, Inc. | USA | Video and image storage (R2) | Data Privacy Framework |
| Stripe Payments Europe Ltd. | Ireland (Stripe group: USA) | Payments, invoices, fraud prevention | European Union / Data Privacy Framework |
| Kling AI (Kuaishou) | Singapore | Video generation (prompt and image sent) | [À COMPLÉTER : clauses contractuelles types signées avec Kling] |
| OpenAI | USA / Ireland | Request moderation and “Improve my prompt” assistant (text and image sent) | Data Privacy Framework + standard contractual clauses |
| Upload-Post (TONVI TECH S.L.) | Spain (EU) | Publishing to TikTok, Instagram, YouTube (subscribers) | European Union (its own non-EU sub-processors: SCCs / DPF) |
| Resend, Inc. | USA | Sending service emails (confirmations) | Data Privacy Framework + standard contractual clauses |
Database hosting region: AWS Europe Central 1 (Francfort, Allemagne). Some providers are outside the European Union; transfers are covered by an adequacy decision (Data Privacy Framework for certified US companies) or by the European Commission's standard contractual clauses. You can obtain a copy by writing to us.
6. Explore: what is public
Only the videos you choose to publish in Explore are visible to everyone, with their prompt, without your name or email. You can remove them at any time. Note: do not write personal information in a prompt you publish.
7. Retention periods
- Account, videos, images and posts: as long as your account exists. They are deleted when you delete your account.
- Account inactive for 3 years, with no remaining credits and no subscription: deleted automatically.
- Purchases and invoices: 10 years (accounting obligation, article L123-22 of the French Commercial Code), including after account deletion.
- Waiting list: until 30 days after you create your account, and at most 12 months after joining if you don't create an account. You can ask for deletion at any time by email.
- Free sign-up credits: IP address fingerprint erased after 30 days; email address fingerprint kept for 3 years, including after account deletion, to prevent claiming the free credits again.
- Requests refused by moderation and reports: 1 year.
- Technical logs: short period set by the host.
- At OpenAI: up to 30 days for abuse detection, not used for training. At Kling: according to its privacy policy.
8. Your rights
You have the rights of access, rectification, erasure, restriction, objection (for processing based on legitimate interest) and data portability, and the right to set instructions on what happens to your data after your death.
Directly on the site, on the My data page: download all your data, delete your account. For anything else, write to hugomariepro@gmail.com. We reply within one month.
Automated moderation may refuse a generation request. This decision has no legal effect on you and no credits are debited; you can ask for a human review by writing to us.
You can lodge a complaint with the CNIL (www.cnil.fr).
9. Minimum age
Kelio.AI is for adults only. If you learn that a minor has created an account, write to us: we will delete it.
10. Security
Encrypted connections (HTTPS), files stored in a private space accessible only through temporary links, protected admin access, payments handled by Stripe. In case of a data breach presenting a risk, we will notify the CNIL and, where necessary, the people concerned.
11. Cookies and changes
The cookies we use are described in the cookie policy. We may update this policy; in case of a significant change, you will be notified by email or on the site.