Who we are
The data controller is Starbridge di Gabriele Feruglio, registered office at Via Alcide de Gasperi, 33030 Dignano (UD), Italy, place of business at Vicolo Brovedan 9, 33100 Udine, Italy, VAT number IT03119880304 (“Kelp Studio”, “we”).
For any question about this policy or your data, write to info@kelpstudio.it or by certified email (PEC) to starbridge@pec.it.
This policy is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 (the “Italian Privacy Code”) and covers:
- the website kelpstudio.it (the “Site”);
- the Kelp Studio web and mobile application at app.kelpstudio.it, including its APIs (the “Service”).
Who this policy is for
- Visitors to the Site.
- Users: professionals, freelancers, agencies and their collaborators who create an account on the Service.
- Users’ Clients: people to whom a User sends a post approval link or a link to connect an Instagram account.
- Partners: those who join the partner program.
The Service is intended only for adult professionals. We do not knowingly collect data from anyone under 18.
What data we process
Data you give us
- Account: name, email address, password (stored only as a hash), passkeys and security settings, language and interface preferences.
- Sign in with Google: if you choose “Continue with Google”, Google gives us your name, verified email address, account identifier and profile picture. We never receive your Google password.
- Billing: invoicing details (company or personal name, VAT number or tax code, address, e-invoicing recipient code or PEC), history of subscriptions, top-ups and invoices. Card details are collected and processed directly by Stripe and never pass through our servers.
- Work content: projects, brand information (name, website, logo, colours, fonts, tone of voice, notes), images, videos, audio and voice recordings, texts, editorial plans, calendars, comments, notes and approvals you upload or generate in the Service (“Content”).
- Communications: messages you send us for support or requests.
- Partner program: data needed to calculate and pay commissions, including the tax and bank details you give us to receive payments.
Data we receive from services you connect
- Instagram (Meta): when an Instagram account is connected to a project we receive its identifier, username, profile picture, access tokens, published content and the account and content insights (such as reach, interactions, followers) that Meta makes available through its APIs.
- YouTube (Google): if you connect a channel we receive the channel details and the tokens needed to publish the videos you choose.
- Canva: if you connect Canva we store the tokens needed to open and import your designs.
- Brand websites: when you ask the AI to learn a brand, we read the public pages of the website you provide (text, logo, colours, fonts).
Data collected automatically
- Technical and security data: IP address, browser and device type, date and time of requests, pages and features used, errors, sign-in events. We need these to run the Service, protect it and fix problems.
- AI token usage: which AI features you use and how many tokens they consume.
- Cookie consent log: the choice made on the banner, the cookie policy version, your anonymised IP address and browser, as proof of consent.
- Site browsing statistics: only if you accept analytics cookies, Google Analytics collects pages viewed, where the visit came from, device, browser and approximate location (city), which we only see in aggregate.
- Cookies and similar technologies: see the cookie policy.
Data of Users’ Clients
When a User sends an approval or connection link, we process the data needed for that feature: the notes and approvals left, date and time and, to connect an Instagram account, the email address we send the confirmation code to. For this data, and for any personal data in the Content, the User is the controller and Kelp Studio acts as processor (see “When we act on behalf of Users”).
Why we process it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and managing the account, providing the Service and its features (AI, editors, calendar, approvals, publishing) | Performance of a contract (Art. 6(1)(b) GDPR) |
| Connecting and using Instagram, YouTube and Canva at your request | Performance of a contract (Art. 6(1)(b)) |
| Handling payments, subscriptions, invoices and tax and accounting obligations | Performance of a contract and legal obligation (Art. 6(1)(b) and (c)) |
| Sending service messages (security, renewals, changes to terms or prices) | Performance of a contract (Art. 6(1)(b)) |
| Sending customers emails about Service news and features | Legitimate interest (Art. 6(1)(f) GDPR and Art. 130(4) Italian Privacy Code); you can object at any time |
| Keeping the Service secure, preventing abuse, fraud and misuse of tokens and promo codes | Legitimate interest (Art. 6(1)(f)) |
| Improving the Service through aggregated feature usage statistics | Legitimate interest (Art. 6(1)(f)) |
| Establishing, exercising or defending legal claims | Legitimate interest (Art. 6(1)(f)) |
| Running the partner program and paying commissions | Performance of a contract and legal obligation (Art. 6(1)(b) and (c)) |
| Site browsing statistics (Google Analytics) and other analytics or marketing cookies | Consent (Art. 6(1)(a)), which you can withdraw at any time |
| Answering support requests | Performance of a contract or pre-contractual steps (Art. 6(1)(b)) |
Providing the data marked as required is necessary to use the Service: without it we cannot create the account or provide the requested feature.
Artificial intelligence
To generate text, images, voice-overs, captions and transcriptions, the Content and instructions you enter are sent to OpenAI through its API. Under OpenAI’s API terms, data sent through the API is not used to train their models. We do not use your Content to train artificial intelligence models.
The AI produces content suggestions: we do not take decisions based solely on automated processing that produce legal effects on you within the meaning of Art. 22 GDPR.
Background removal from images runs directly in your browser: the image is not sent to third parties for this feature.
Who we share data with
We do not sell your data. We share it only with the parties needed to provide the Service, acting as our processors or as independent controllers:
| Provider | What it does | Location / transfer |
|---|---|---|
| Hetzner Online GmbH, Shellrent S.r.l. | Servers, database and file storage | EU |
| OpenAI, L.L.C. / OpenAI Ireland Ltd | Generating text, images, audio and transcriptions | USA, with appropriate safeguards |
| Stripe Payments Europe Ltd | Payments, subscriptions, fraud prevention | Ireland and USA |
| Meta Platforms Ireland Ltd | Connecting and publishing to Instagram, insights | Ireland and USA |
| Google Ireland Ltd / Google LLC | Sign in with Google, connecting and publishing to YouTube, Site statistics (Google Analytics, only with your consent) | Ireland and USA |
| Canva Pty Ltd | Opening and importing Canva designs | Australia and USA |
| Pexels GmbH | Stock photo and video search (receives only search terms) | Germany |
| Sendinblue SAS (Brevo) | Sending informational emails to customers | France |
| Postmark (ActiveCampaign), Resend, Amazon Web Services | Sending service emails | USA, with appropriate safeguards |
| Slack Technologies | Internal notifications to our team (such as new sign-ups or errors) | USA, with appropriate safeguards |
We may also disclose data to tax, legal and accounting advisers bound by confidentiality, to public authorities where required by law and, in the event of corporate transactions (merger, transfer of the business or part of it), to the successor, who will be bound by this policy.
Instagram, YouTube, Google and Canva are connected only on your initiative: when you use them, their own privacy policies also apply.
Transfers outside the European Economic Area
Some providers process data outside the EEA. In these cases the transfer relies on a European Commission adequacy decision (including the EU-US Data Privacy Framework, for certified providers) or on the standard contractual clauses approved by the Commission, with any supplementary measures needed. You can ask for a copy of the safeguards at info@kelpstudio.it.
When we act on behalf of Users
For personal data in the Content (for example data, photos or voices of the User’s clients or of third parties) and for the data of Users’ Clients collected through approval and connection links, the User is the controller and Kelp Studio is the processor under Art. 28 GDPR, according to the data processing agreement in the terms and conditions.
The User is responsible for informing their clients, having a valid legal basis and handling their requests. If you are a User’s client and want to exercise your rights, contact the User; if you contact us directly, we will forward your request to the User.
How long we keep data
- Account and Content: for as long as the account exists. After the account is deleted they are erased within 30 days; backup copies are overwritten within a further 30 days.
- Instagram, YouTube and Canva tokens: until you disconnect the service or delete the project or account.
- Billing and accounting data: 10 years, as required by Art. 2220 of the Italian Civil Code and tax law.
- Technical and security logs: up to 12 months, unless needed to investigate abuse or defend a legal claim.
- Site browsing statistics: 14 months in Google Analytics.
- Cookie consent log: for the duration of the consent and as long as needed to prove it.
- Informational emails: until you object or close your account.
- Support requests: up to 24 months after the request is closed.
- Partner program: for the duration of the program, then 10 years for accounting data.
We may keep data longer where needed to comply with a legal obligation, an order from an authority or to defend a legal claim, only for as long as strictly necessary.
Your rights
At any time you can ask us for:
- access to your data and a copy (Art. 15);
- rectification of inaccurate data (Art. 16);
- erasure (Art. 17);
- restriction of processing (Art. 18);
- portability of your data in a structured format (Art. 20);
- to object to processing based on legitimate interest, including informational emails (Art. 21);
- to withdraw consent you have given, without affecting the lawfulness of earlier processing.
You can do much of this yourself in the Service: from the settings you can download a copy of your data, change your cookie preferences and delete your account. For anything else write to info@kelpstudio.it. We reply within one month, extendable by two months for complex requests. We may ask you to confirm your identity.
You also have the right to lodge a complaint with the Italian Garante per la protezione dei dati personali (www.garanteprivacy.it) or with the authority of the EU country where you live or work.
Deleting Instagram, YouTube and Google data
- Instagram: you can disconnect the account from the project in the Service, or remove Kelp Studio from the authorised apps and websites in your Instagram or Facebook settings. To ask us to delete the data received from Meta, write to info@kelpstudio.it naming the account: we delete it within 30 days and confirm the deletion.
- Google and YouTube: you can revoke access at any time from your Google account security page (myaccount.google.com/permissions).
Kelp Studio’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. YouTube content is also subject to the YouTube Terms of Service and the Google Privacy Policy.
Security
We take technical and organisational measures appropriate to the risk: encrypted connections (HTTPS), hashed passwords, passkey support, access limited to staff who need it, backups and access logs. No system is 100% secure: if a personal data breach puts you at risk, we will notify you in the cases and timeframes set out in Articles 33 and 34 GDPR.
You are responsible for keeping your credentials and the approval and connection links you share confidential.
Changes to this policy
We may update this policy, for example for new features or providers. The date at the top shows the latest version. If the changes are significant we will tell you by email or in the Service before they apply.
The Italian version of this policy prevails in case of any inconsistency with this translation.