Privacy policy

This Privacy Policy explains how Kadro Social handles personal information when you use kadrotools.ai, the Kadro Social web app, and our support channels. “Kadro Social,” “we,” and “us” mean the business that operates Kadro Social and kadrotools.ai, established in Romania. The data controller’s identity is set out in the Contactsection. “You” means the person using the site or the app.

For residents of the European Economic Area (EEA), the United Kingdom, and Switzerland, this policy also describes our role and your rights under the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), the UK GDPR, and the Swiss Federal Act on Data Protection (“FADP”).

1. Scope

Kadro Social is a social media scheduler: you connect your own social accounts, write posts once, and publish or schedule them to those accounts, then review how they perform. This policy covers the marketing site at kadrotools.ai, your Kadro Social account, the web app, and the data we process on your behalf when you connect social accounts. Content you publish to a social platform is also governed by that platform’s own terms and privacy policy.

2. Information we collect

• Account data — your email address and either a hashed password (we never see or store it in plain text) or, if you sign in with Google, your Google account identifier, name, and email address; plus your user ID and email-verification status.
• Billing data — your Stripe customer ID and your subscription’s plan, price, billing interval, status, and renewal and cancellation dates. Payment details (card number, billing name and address, tax identifiers) are collected and held by Stripe and never touch our servers.
• Connected social-account data — the access tokens, profile details, imported post history, and analytics described in Section 3.
• Content you create — the posts you write (text, per-platform variations, links, and scheduled times), your posting schedule and time zone, reply text for X link-in-reply posts, platform options you choose (for example TikTok privacy settings or a Facebook feed-versus-Reels choice), and how you group accounts into brands.
• Media you upload — images and videos you attach to posts, with their dimensions, duration, and any alt text. Large videos may be resized in your browser before upload; the original file stays on your device.
• Publishing records — each post’s status, the platform’s post ID and link once published, and any error message a platform returns.
• AI-app connections — for each AI app you connect, the records described in Section 4.
• Support correspondence — emails you send us.
• Usage, device, and security data — IP address, browser and device information, and request, error, and rate-limit logs from our hosting provider. Sign-up, sign-in, and password-reset forms are protected by Cloudflare Turnstile, which evaluates signals from your browser to tell people from bots.

We do not run advertising or third-party analytics on kadrotools.ai, and we do not track you across other sites.

3. Connected social accounts

You connect a social account through the platform’s official sign-in (OAuth). You authenticate with the platform, not with us, and the platform shows you the permissions you are granting. We never see or store your social-platform password.

What we receive and store

• Access tokens (and refresh tokens where the platform issues them) that let Kadro Social act for you within the permissions you granted. Tokens are encrypted at rest with AES-256-GCM, are never sent to your browser, and are never shown to other users. For Facebook we store an access token for the Page you connect, not for your personal profile. Before an Instagram or Threads token expires we renew it with the platform; when a login can’t be renewed we mark the account for reconnection in Channels.
• Profile details — the account or Page ID, handle or username, display name, profile image URL, verification status where the platform reports it, the permissions granted, and for X your subscription tier (only to apply X’s post length limit for that account).
• Imported post history — for platforms that offer analytics (currently X, Bluesky, TikTok, Instagram, Facebook, and Threads), when you connect an account we import up to the last 365 days of that account’s own posts, including posts not made through Kadro Social: the post text, publish time, link, media type, and media or thumbnail URLs.
• Analytics — for those posts and for posts you publish through Kadro Social, we periodically fetch and store snapshots of engagement figures such as impressions or views, likes, replies, reposts, quotes, bookmarks, saves, shares, and profile and link clicks, plus the account’s follower, following, and post counts. Some of these figures (for example impressions on X, or insights on Instagram, Facebook, and Threads) are visible only to the account owner; we fetch them only for your own accounts and show them only to you.

Permissions we request

We request only the permissions needed to publish for you and to show you your own analytics:

• X — tweet.read, tweet.write, users.read, media.write, offline.access: publish posts and media, publish your link-in-reply, read your profile and your own posts’ metrics, and stay connected.
• Bluesky — atproto, transition:generic: publish posts and media, read your profile, and read your own posts and their engagement figures.
• LinkedIn — openid, profile, w_member_social: identify your profile and publish posts to it.
• TikTok — user.info.basic, user.info.stats, video.upload, video.publish, video.list: identify your account, upload videos to your inbox or publish them directly, and read your account and video statistics.
• YouTube — youtube.upload to upload videos, and youtube.readonly used only to read your channel’s ID, title, and thumbnail when you connect.
• Instagram — instagram_business_basic, instagram_business_content_publish, and, where analytics is enabled, instagram_business_manage_insights.
• Facebook Pages — public_profile, pages_show_list, pages_read_engagement, pages_manage_posts, business_management, and, where analytics is enabled, read_insights.
• Threads — threads_basic, threads_content_publish, and, where analytics is enabled, threads_manage_insights.

What we do on the platform for you

We only act when you ask us to: we publish the posts you create at the time you schedule them, with the media and options you chose, and read your own account’s profile and analytics. On X, if you add a link-in-reply, we post your own pre-written reply under your post and check that post’s like count to decide when. We do not read your direct messages, follow or unfollow accounts, like or comment on other people’s posts, or post anything you did not create.

4. AI apps you connect

You can connect an AI app — such as Claude, ChatGPT, or Cursor — to your Kadro Social account through our Model Context Protocol (MCP) server at kadrotools.ai/mcp. Nothing is connected unless you sign in on our consent page and choose an access level: Read + drafts or Full access.

• What a connected app can do. With Read + drafts it can read your connected accounts’ names, handles, and status, your posts and their results, your analytics, your posting schedule, and your media library; create, edit, and delete drafts; and add media. With Full access it can also schedule, publish, reschedule, and cancel posts on your connected social accounts, and edit scheduled posts or move them back to drafts. It cannot connect or disconnect social accounts, change your settings or billing, or see your social-account tokens or payment details.
• What we store. For each connection: the app’s name and client identifier as the app reports them, the address it signs in through, the access level you chose, when you connected it, and when it was last used. Its access and refresh tokens are stored in Cloudflare Workers KV only as cryptographic hashes, with the connection’s details encrypted. We keep an activity log of every change an app makes or attempts — the app, the action, the post it affected, the outcome, and the time — and we label posts an app created with its name. Media an app imports from a web address, or that you upload through an app’s upload link, is stored in your media library like any other upload; upload links are stored only as hashes and expire after 30 minutes.
• Where your data goes. What a tool returns — for example your posts, analytics, or account handles — is sent to the AI app you connected and processed by its provider (such as Anthropic, OpenAI, or Anysphere) under your own account and agreement with that provider, not ours; their privacy policies govern what they do with it. When an app asks us to import media from a web address, we download the file from that address.
• Disconnecting. Account → Connected AI apps → Disconnect revokes a connection, its tokens and its unused upload links immediately. A connection that goes unused for 60 days expires on its own; changing or resetting your password and deleting your account revoke all of them. Apps stop working while your subscription is inactive.

5. How we use information

• Provide Kadro Social: publish and schedule your posts, show your posts’ status, keep account labels and avatars current, and show you analytics for your own accounts.
• Create and secure your account, sign you in, and check that your subscription is active.
• Process subscriptions, renewals, cancellations, and invoices through Stripe.
• Answer support requests.
• Detect and prevent abuse, fraud, spam, and security incidents, and keep the service reliable.
• Comply with legal obligations and enforce our terms.

We do not sell your personal information, we do not use it for advertising, and we do not use your posts, media, connected-account data, or analytics to train artificial-intelligence models. Data we receive from a social platform is used only to provide the features described above to you.

6. Legal basis for processing (EEA, UK, Switzerland)

If you are located in the EEA, the UK, or Switzerland, we process your personal data only where we have a lawful basis to do so under Article 6(1) of the GDPR (and the corresponding provisions of the UK GDPR and the Swiss FADP):

• Performance of a contract (Article 6(1)(b)): creating and operating your account, publishing and scheduling your posts, storing your media, showing your analytics, processing your subscription, and answering support requests about the service.
• Legitimate interests (Article 6(1)(f)): keeping the service secure and reliable, preventing fraud and abuse, keeping security logs, communicating essential service updates, and defending legal claims. We balance these interests against your rights and freedoms before relying on this basis.
• Consent (Article 6(1)(a)): connecting a social account or an AI app (you choose what to connect and can disconnect it at any time) and any other processing we ask you to opt in to. Withdrawing consent does not affect processing before withdrawal.
• Legal obligation (Article 6(1)(c)): keeping tax, accounting, and billing records, and responding to lawful requests from public authorities.

Where we rely on legitimate interests, you have the right to object (see Section 13).

7. How we share information

We share information with service providers (“processors” under the GDPR) that help us run Kadro Social. Each may use your data only to provide its service to us:

• Cloudflare, Inc. — hosts kadrotools.ai and the app (Cloudflare Workers), stores uploaded media (Cloudflare R2), runs our publishing queues and scheduled jobs, stores AI-app connection records (Workers KV), provides DNS, edge security, bot protection (Turnstile), request logs, and inbound email routing for our @kadrotools.ai addresses.
• Supabase, Inc. — hosts our database and authentication service: your account, encrypted connected-account tokens, posts, schedules, and analytics. Supabase also sends our account emails (email confirmation and password reset).
• Stripe (Stripe, Inc. and Stripe Payments Europe, Ltd.) — processes payments, subscriptions, invoices, and tax records.

Social platforms you connect. When you publish, we send your post text, media, and publishing options to the platform you chose — X, Bluesky, LinkedIn, TikTok, YouTube, Instagram, Facebook, or Threads — through that platform’s official API, acting on your instructions. Platforms fetch attached media from our media storage at publish time. What you publish is visible on that platform according to your settings there.

AI apps you connect. When you connect an AI app, we send it the data its tools return, on your instructions. Its provider is not our processor: it handles that data under your own agreement with it (see Section 4).

Your browser. Our marketing pages load platform logos from cdn.simpleicons.org, and Stripe Checkout runs on Stripe’s own pages; these requests expose your IP address and browser information to those providers.

We may also disclose information when required by law, to enforce our terms, or as part of a business transfer (such as a merger or sale of assets), in which case we will give you notice where we can. We do not sell personal information, and we do not “share” it for cross-context behavioural advertising as those terms are defined under U.S. state privacy laws.

8. Cookies and local storage

We use only what the service needs to work. None of these are used for advertising or cross-site tracking, so they do not require consent under the ePrivacy Directive:

• Sign-in cookies (sb-…-auth-token) — keep you signed in.
• kadro_social_group — remembers which brand group you last selected in the app (one year).
• Local storage in your browser — remembers whether you dismissed the composer guide and your TikTok direct-post or inbox choice per account.
• Third-party pages — Cloudflare Turnstile (on sign-up and sign-in) and Stripe Checkout may set their own cookies for security and fraud prevention.

Blocking cookies in your browser will prevent you from signing in.

9. Retention

• Account, content, media, connected-account data, and analytics are kept while your account exists, so your post history and analytics stay available to you. They are deleted when you delete your account (see Section 10).
• Access tokens are deleted as soon as you disconnect the account, delete your Kadro Social account, or the platform tells us you removed our access.
• AI-app connections are kept until you disconnect the app, it goes unused for 60 days, or you delete your account; last-used times are kept for up to 90 days. The AI-app activity log is kept while your account exists.
• Billing records — invoices and payment records are held by Stripe and kept for as long as Romanian and EU tax and accounting law requires (up to 10 years).
• Support correspondence is kept for 24 months.
• Request and error logs are kept for a short period under our hosting provider’s log retention.

Deleted data may remain in our providers’ encrypted backups until those backups expire in their normal rotation.

10. Deleting your data

You control the data Kadro Social holds, including data from your Facebook Page, Instagram, Threads, TikTok, X, LinkedIn, Bluesky, and YouTube accounts:

1. Delete your whole account. Go to Account → Delete account and confirm. We immediately cancel your subscription, disconnect every AI app, delete your connected accounts and their tokens, your posts and schedules, your uploaded media, your imported post history and analytics, and your sign-in account.
2. Disconnect one social account. In Kadro Social → Channels, disconnect the account. Its tokens are deleted immediately, scheduled posts to it are cancelled (drafts are kept, without that account), and we stop accessing it. Its past posts and analytics stay in your Kadro Social history until you delete them with option 1 or 3.
3. Ask us. Email privacy@kadrotools.ai from the address on your account and tell us which account or data to erase. We will delete it within 30 days and confirm by email.

Threads. If you remove Kadro Social from your Threads account and request deletion of your data through Meta, Meta notifies us automatically and we delete that Threads account and all of its data from Kadro Social. You receive a confirmation code you can quote to us.

Removing Kadro Social’s access on a platform also stops us from accessing that account. To do that:

• Facebook — Settings → Business integrations; Instagram — Settings → Apps and websites; Threads — Settings → Account → Website permissions.
• Google and YouTube — myaccount.google.com/permissions.
• X — Settings → Connected apps; LinkedIn — Settings → Data privacy → Permitted services; TikTok — Settings and privacy → Security → Apps and services permissions.

Content already published to a platform stays there until you delete it on that platform.

11. Security

• kadrotools.ai and the app run over TLS only.
• Social-platform tokens are encrypted at rest with AES-256-GCM and are only readable by our server-side services, never by your browser or other users.
• Row-level security is enabled on every database table, and no Kadro Social table can be read or written directly from a browser: all access goes through our server-side services, which only ever return your own data.
• Access to production systems is restricted and protected by multi-factor authentication.
• Sign-up and sign-in are protected against bots, and our endpoints are rate-limited.

Uploaded media is stored at an unguessable address on media.kadrotools.ai so that platforms can fetch it when your post is published; anyone who has that exact link can view the file. No method of transmission or storage is perfectly secure. If a personal-data breach affects your data, we will notify you and the competent supervisory authority as required by Articles 33 and 34 of the GDPR.

12. International transfers

Kadro Social is operated from Romania, within the EEA. Our processors — Cloudflare, Supabase, and Stripe — are established in the United States or operate global infrastructure, and the social platforms you connect process data under their own policies, often outside the EEA. When we transfer personal data from the EEA, the UK, or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards under Article 46 of the GDPR, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, the Swiss addendum, and, where a provider is certified, the EU-U.S., UK Extension, and Swiss-U.S. Data Privacy Frameworks. You can request a copy of the safeguards we rely on by emailing privacy@kadrotools.ai.

13. Your rights and choices

Depending on where you live, you may have rights under applicable privacy law. For residents of the EEA, the UK, and Switzerland, these rights include — subject to the conditions and exceptions set out in the GDPR, UK GDPR, and FADP:

• Access (Article 15): to obtain confirmation of whether we process your personal data and to receive a copy.
• Rectification (Article 16): to correct inaccurate or incomplete personal data.
• Erasure (Article 17): to have your personal data deleted — you can do this yourself at any time, see Section 10.
• Restriction (Article 18): to request that we limit processing in certain circumstances.
• Portability (Article 20): to receive your personal data in a structured, commonly used, machine-readable format.
• Objection (Article 21): to object to processing based on legitimate interests.
• Withdraw consent (Article 7(3)): for example by disconnecting a social account.
• Automated decisions (Article 22): we do not make decisions producing legal or similarly significant effects about you based solely on automated processing.

To exercise any of these rights, email privacy@kadrotools.ai. We will respond within one month, extendable by up to two further months where necessary, consistent with Article 12(3) of the GDPR. We may need to verify your identity before acting on your request.

You also have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), dataprotection.ro. You may also complain to the supervisory authority where you live or work, or where the alleged infringement took place (a list is available from the European Data Protection Board at edpb.europa.eu; in the UK, the Information Commissioner’s Office at ico.org.uk).

California (CCPA / CPRA). If you are a California resident, you also have the right to know what personal information we collect, use, and disclose; to delete it; to correct it; to opt out of “sale” or “sharing” (we do neither); to limit use of sensitive personal information (we do not use it for purposes that trigger this right); and to be free from retaliation for exercising these rights. An authorized agent may submit a request on your behalf with proof of authorization.

Other regions. If your local law gives you additional rights — for example Brazil’s LGPD, Canada’s PIPEDA, or Australia’s Privacy Act — email us and we will honor them.

14. EU and UK representatives

We are established in Romania, within the EEA, so we are not required to designate a separate EU representative under Article 27 of the GDPR; the controller is reachable at the contact details in Section 18. To the extent Article 27 of the UK GDPR applies to our processing, a UK representative will be designated when required. Until then, you may send UK-specific privacy questions to privacy@kadrotools.ai; this does not affect your right to complain to the ICO.

15. Children

Kadro Social is not directed to children. We do not knowingly collect personal information from anyone under 13, and we do not knowingly offer the service to children under 16 in the EU and UK without parental consent where local law requires it. If you believe a child has provided personal information to us, contact us at privacy@kadrotools.ai and we will delete it.

16. Platform-specific terms

Kadro Social accesses each platform through its official API and complies with that platform’s developer terms. Your use of a platform through Kadro Social is also subject to that platform’s own terms and privacy policy:

• Google / YouTube. Kadro Social’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. By connecting YouTube you agree to the YouTube Terms of Service, and Google’s handling of your data is described in the Google Privacy Policy.
• Meta (Facebook, Instagram, Threads) — Meta Privacy Policy.
• TikTok — TikTok Privacy Policy.
• X — X Privacy Policy; LinkedIn — LinkedIn Privacy Policy; Bluesky — Bluesky Privacy Policy.

17. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page tells you when. If we make a material change, we will notify you by email or in the app before it takes effect.

18. Contact

Privacy questions or requests may be sent to privacy@kadrotools.ai.

The data controller is Alexandru Popescu, sole trader, established in Romania, operating Kadro Social and kadrotools.ai.