Privacy Policy

Last updated: 2026-02-24

This Privacy Policy explains how Karleido ("we", "us", "our") processes personal data in connection with the use of our web application.

1. Data Controller

Michael Thomas / Jiagual Media

Selkestrasse 24, 12053 Berlin, Germany

contact@karleido.com

2. Categories of Data We Process

A. Account & Authentication Data

• Email address
• User ID (Supabase UUID)
• Access tier / entitlements

Purpose: Provide access to the service Legal basis: Contract performance (Art. 6(1)(b) GDPR)

B. User-Generated Content & Session Data

• Saved session snapshots
• Timeline configurations
• Export settings

Purpose: Enable saving and restoring projects Legal basis: Contract performance (Art. 6(1)(b) GDPR)

C. Security & Abuse Prevention

• Authentication logs
• Export validation events
• Rate limit counters
• IP address (processed at infrastructure level)

Purpose: Fraud prevention and system security Legal basis: Legitimate interest (Art. 6(1)(f) GDPR)

D. Anonymous Technical Telemetry

• Export duration and resolution
• Performance metrics
• Feature usage counts
• Application version
• Device platform and browser user agent
• Export clip/segment timing and preset references

This data is not linked to user accounts and does not include IP addresses or persistent identifiers.

Purpose: Improve reliability and performance Legal basis: Legitimate interest (Art. 6(1)(f) GDPR)

E. Usage Analytics

• Session start and last-active timestamps, linked to your user account
• Date of last application visit

This data is stored server-side and linked to your user ID. It is used solely to understand how the product is used — for example, session length and return frequency. No behavioural event tracking, page view tracking, or cross-device tracking takes place.

Purpose: Product improvement and retention analysis Legal basis: Legitimate interest (Art. 6(1)(f) GDPR)

F. Feedback & Error Reports

• Free-text feedback
• Technical context (platform and browser user agent)
• Application state data (current module, effects, preset, audio state)

Purpose: Debugging and product improvement Legal basis: Legitimate interest (Art. 6(1)(f) GDPR)

3. Cookies

We use only strictly necessary cookies for authentication and session management. We do not use marketing or cross-site tracking cookies.

4. Data Retention

• Account data: retained while account is active
• Session snapshots: deleted upon account deletion
• Usage analytics (session logs, last-seen timestamps): retained for 12 months or until account deletion
• Security logs: retained 30--90 days
• Anonymous telemetry: stored in non-identifiable form

5. Data Deletion

Users may request account deletion at any time. Associated personal data will be removed, subject to limited backup retention periods.

6. Data Processors

We use Supabase for authentication and database infrastructure under a Data Processing Agreement.

7. Your Rights

Under GDPR, you have the right to:

• Access your data
• Rectify inaccurate data
• Request deletion
• Restrict processing
• Object to processing
• Data portability
• Lodge a complaint with a supervisory authority

Contact: contact@karleido.com

8. Security

We implement technical and organizational measures including HTTPS encryption, access controls, and Row-Level Security (RLS).