Privacy Policy
Wahvo Inc. (“we”, “us”) runs Klaboo. This policy explains what personal information we collect, why, who we share it with, where it is kept, how long we keep it, and what rights you have. We follow Canada’s privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA). You can reach the person responsible for privacy at Klaboo at support at klaboo.com.
What we collect
- Your account. Your name, email address, whether your email is verified, and a sign-in reference from Auth0 (and from Google, if you sign in with Google). We never see your password.
- Your membership and billing. Your plan, billing period, status, dates, the price you pay, and your Stripe customer and subscription references. We send Stripe your email address and an internal account reference. Stripe collects your payment details and billing address itself. Card details never reach us.
- Your work. What you put into Klaboo: scene descriptions, prompts, Library items and descriptions, uploaded files (pictures, video and audio), Project knowledge and rules, saved scene plans, cuts, exports, generated videos, small still pictures made from them, and workspace names. This can include personal information about you or about other people. You decide what to upload.
- Your provider keys. The keys you save for video providers, stored encrypted.
- Generation, spending and planning records. For each generation you approve: the request as saved (including the prompt you wrote and the settings), the provider and model, the estimated price, the times, the status and result, and the provider’s job reference. Also your monthly spending cap setting, and for each AI planning run the model, the time taken and the cost (without the text of your scene).
- Consent and preferences. Which version of these documents you accepted and when. Your theme, last workspace and dismissed notices.
- Security and technical data. Sign-in sessions (when they started and ended). To limit repeated sign-in attempts we use your IP address, and we keep only a scrambled (hashed) form of it, for a short time, in a counter. Our activity logs record a reference, the kind of request, its result and its timing, and do not hold names, email addresses, prompts or files. Our hosting and sign-in providers also see IP addresses and similar technical data as part of delivering their services.
- Emails. A record that we sent you a service notice (which one, when, and whether our email provider accepted it). We do not keep the text of the notice in that record.
- Feedback and support. If you use Send feedback in the app, we email what you wrote to the Klaboo team, together with your name, your email address and the page you were on. If you write to support at klaboo.com, we keep your message and our reply.
- If we cannot let you in. If you try to sign up while sign-up is closed, or we cannot offer you a plan, we may email ourselves your name and your email address (only if it was verified) so we can follow up.
- Counts. We count things in our own records, such as how many accounts add a key and make a first video, and how many videos are made with each provider. These are totals, not tied to your name in the reports we look at. On the klaboo.com website we also count visits to each page and which site or link brought you there. To count a visitor once a day without cookies, we keep a scrambled (hashed) form of your IP address and browser that changes every day and can’t be traced back to you; we never store the IP address itself. Apart from the Meta Pixel on our website (below), we use no third-party analytics.
- Ad measurement (Meta), only if you accept. If you accept our cookie banner, the klaboo.com website and the Klaboo app’s sign-up and payment pages use the Meta Pixel, a tool from Meta (the company behind Facebook and Instagram), to measure our ads. Your browser then sends Meta the address of the page, the page you came from, the time, your IP address, technical details of your browser and device, and an identifier kept in a cookie, with what happened: that you viewed a page or our Pricing page, created an account, started a checkout, or paid for a plan (with the plan’s amount and currency). The events from the app carry a scrambled (hashed) reference to your account and to the checkout, not the reference itself. If you are signed in to Facebook or Instagram in the same browser, Meta can link the visit to your Meta account. Klaboo’s studio pages (Create, the Library, Generations, the Editor, your settings) never load the Pixel, and we never send Meta your name, your email address, your prompts, files or videos, or the names of your workspaces. If you reject, or have not chosen, nothing is sent to Meta. We plan to also send the account and payment events from our own server (Meta’s Conversions API), only with your consent; we will update this policy before we do.
How we use it
To provide Klaboo and make the videos and plans you ask for; to process your membership and payments; to keep your account and the service secure and to prevent abuse and fraud; to support you; to send service emails about your account (such as sign-in, billing and membership notices, and the reminders after a membership ends); to improve Klaboo using feedback and counts; to keep business, billing and tax records; and to meet legal duties. If you accept our cookie banner, we use the Meta Pixel to see how many people come to Klaboo from our ads on Facebook and Instagram, to show our ads to people who may be interested, and to improve those ads. We do not sell your personal information, show ads in Klaboo, or use your content to train AI models.
By creating an account and accepting these documents you consent to these uses. Each time you approve a generation, you ask us to send your prompt, settings and chosen files to the video provider you picked.
Who we share it with
Only what each one needs to do its job. We do not sell personal information.
| Service | What it does | What it gets |
|---|---|---|
| Auth0 (Okta) | Sign-in | Your email, name and password (which Auth0 scrambles), and your Google profile details if you use Google. Auth0 keeps its own sign-in records. |
| Sign-in, if you choose it | Whatever Google receives when you sign in with it. | |
| Stripe | Payments, tax and fraud prevention | Your email, an internal account reference and the payment details you enter. If you accepted Meta’s cookies, also the Meta Pixel’s cookie identifiers and your browser’s technical details, kept with the checkout to measure our ads. Stripe is the merchant of record for your purchase. Stripe uses this under its own privacy policy. |
| Railway | Hosting: the app, the database and file storage | Everything we store, including your work, as our hosting provider. |
| Amazon Web Services | Off-Railway backup | An encrypted copy of our database, kept in Canada (Montréal). We hold the key, so Amazon cannot read it. |
| OpenRouter and the AI model provider it sends planning requests to | AI scene planning | What section 7 of the Terms lists. |
| The video provider you connect (fal.ai, Replicate, OpenRouter or Atlas Cloud) | Making your videos | Your approved prompt, settings and chosen files, with your key. It uses them under its own privacy policy. The model’s maker may also receive your request, and may process it outside North America. For example, ByteDance makes the Seedance models, and your provider may send your request to ByteDance’s service. |
| Meta (Meta Platforms) | Measuring and showing our ads on Facebook and Instagram, through the Meta Pixel, only if you accept | What the Meta Pixel sends (see “What we collect”). Never your name, email address or work. Meta uses it under its own privacy policy and terms, to give us reports, to show and measure ads, and to improve its own services. |
| Resend | Sending email | Your email address, your name, and the text of the notices and feedback emails. |
| Our email host | The support at klaboo.com mailbox | Messages you send to us and our replies. Our mailbox host is Hole in the Wall. |
Our Discord community. Klaboo has a community on Discord for announcements and for members to talk about bugs. Joining is up to you. Discord’s own terms and privacy policy apply there, and what you post is seen by the other members. We don’t give Discord your Klaboo account details, and we don’t link your Discord account to your Klaboo account. Don’t post a key, an email address or payment details there; for anything about your own account, write to support at klaboo.com.
We may also disclose information when the law requires it, to our professional advisers, or to a successor if our business is transferred, on the same terms as this policy.
Our administrators can see account details (such as your name, email, plan, dates, and usage and spending figures) to run and support the service. The admin tools do not show the contents of your work. The people who run our systems can reach stored data technically, so we limit who has that access. We do not look at your work except to fix a problem you ask us to look at, to investigate abuse or a security issue, or where the law requires.
Where your information is stored
Our production service is hosted by Railway in the United States (Virginia), so your information is stored and processed there. An encrypted copy of our database is kept in Canada (Montréal). Several of the services above store or process data outside Canada, mainly in the United States; the maker of the video model may process your request elsewhere (see the video provider above). Sign-in records are kept by Auth0 in the United States. If you accept, Meta receives what the Meta Pixel sends in the United States and may process it in other countries. When your information is in another country, the laws of that country apply, and courts, law enforcement and national security authorities there may be able to get access to it. We rely on each provider’s own terms and on the safeguards below to protect it.
How long we keep it
| What | How long |
|---|---|
| Your account details, consent record and preferences | While your account is open. |
| Your work on a paid plan | Until you delete it. Deleted videos, scenes and Library items are erased after 7 days. A deleted workspace is removed after 7 days. |
| Your work after a membership ends | Read-only for 90 days, then your account and everything in it is deleted. |
| Free videos | Each is erased 24 hours after it was made. Reference files are removed once the video is done. Files uploaded and never used are removed after 24 hours. |
| The record of each generation, and your Free history | The record of each request (the prompt, settings, estimated price, time and result) stays in your account’s history, and the prompt and scene text in it is emptied when the workspace is deleted. If nobody signs in to a Free account, or to an account that never started a plan, for 12 months, we delete the account and its history. |
| Your saved provider keys | Until you remove them or delete your account. |
| Deleted-account record | After an account is deleted we keep your name, your email address, the date of deletion and your Stripe customer reference for 6 years, for our business, billing and tax records and to answer questions about charges. Only Klaboo administrators can see it. After 6 years we remove them. We do not keep your sign-in reference: the same sign-in can start a new, empty account. |
| Billing and membership records | Stripe keeps payment records under its own policy and the law. Our own record (plan, billing period, dates and amounts paid) is kept 6 years after the account is deleted, for tax and accounting. |
| Spending, approval, planning-usage and audit records | They show amounts, times and results, refer to an internal account number rather than your name once the 6-year record is cleared, and hold no files. They are kept 6 years after the account is deleted, then removed. |
| Sign-in and security data | Ended sessions are removed after 30 days (we keep the newest record of each account’s last sign-in). Sign-in attempt records are removed after 7 days. Counters used to limit repeated attempts are removed within about a day. |
| Website visit counts | Kept up to 13 months. Each is a page, the site or link that brought the visitor, a date and that day’s scrambled visitor code. No IP address is kept. |
| Activity logs | Short lines with no names, emails, prompts or files, kept by our hosting provider for a limited time. |
| Emails | Our record of a notice we sent is kept 2 years. Resend and our email host keep messages under their own policies. Feedback and support emails are kept 2 years, then deleted. |
| Meta Pixel data and your cookie choice | Your choice (accept or reject) is kept in a cookie for a year. If you accept, the cookie the Meta Pixel sets on klaboo.com lasts up to 90 days after your last visit, unless you reject later or clear your cookies. Meta keeps what it receives under its own policy. |
| Backups | About 35 days. See below. |
Backups. We keep backups of our database, and the copy in Canada is encrypted. Data you delete can stay in them for about 35 days and then expires. We cannot remove single items from a backup, so we do not change a backup once it is made. Your uploaded files and generated videos are not in these backups. Providers you connect, and Auth0, Stripe and Resend, keep their own records under their own policies, and deleting in Klaboo does not delete those.
Your rights and choices
- Access. You can ask for a copy of the personal information we hold about you. You can see and download most of your work in the app.
- Correction. You can change your details in your account or at Auth0, and you can ask us to correct anything that is wrong.
- Withdrawing consent. You can stop using Klaboo, cancel your membership, remove your provider keys, and delete your account at any time. If you withdraw consent we may not be able to give you the service.
- Ad measurement. Nothing is sent to Meta unless you accept. You can change your choice at any time with “Cookie choices” at the bottom of every page of our website, or under “Cookies and your browser” below; rejecting stops the Meta Pixel and removes its cookies from klaboo.com. You can also choose in your Meta ad preferences whether Meta uses information from other websites to show you ads, and block or clear cookies in your browser.
- Deletion. The supported way is to delete your account in the app. You can also ask us at support at klaboo.com. We keep what the table above says we keep, and backups expire as described.
- Asking. Write to support at klaboo.com. We may need to check it is you. We will answer within 30 days, and we do not normally charge for an answer. If we cannot give you something, we will tell you why.
- Complaints. If you are not happy with our answer, you can write to our privacy contact above, and you can complain to the Office of the Privacy Commissioner of Canada (www.priv.gc.ca).
If you live outside Canada, the law where you live may give you more rights, and you can use the contact above to ask.
Security
We use encrypted connections. We store your provider keys encrypted. Our database is reached only on a private network, with its certificate checked, and we encrypt the copy kept outside Railway. We keep production separate from our testing, and we limit who can reach data. No system is perfectly secure. If a breach of security safeguards creates a real risk of significant harm to you, we will tell you and the Office of the Privacy Commissioner of Canada as the law requires.
Cookies and your browser
The klaboo.com website asks before it uses any advertising cookie. Its one advertising tool is the Meta Pixel (see “What we collect”), which it loads only if you press Accept on its banner. Then it loads a script from Meta and Meta sets a cookie on klaboo.com (named _fbp, and _fbc when you arrive from one of our ads) that tells Meta it is the same browser on a later visit; if you are signed in to Facebook or Instagram, Meta’s own cookies in your browser may also be sent. Your choice is kept in a cookie on klaboo.com (named klaboo_ads_consent), so the website and the app’s sign-up and payment pages know it. The website keeps one more note in your browser’s local storage, not a cookie and never sent anywhere, so the logo animation plays only on your first visit.
Changing your choice. Use “Cookie choices” at the bottom of any page of our website, or the button below. Your choice is kept in this browser only, so make it again in another browser or after clearing your browser’s data. If your browser sends Global Privacy Control, we treat it as Reject and don’t ask. Browsers that block third-party scripts or cookies also stop the Pixel.
You accepted Meta’s cookies in this browser.
You rejected Meta’s cookies in this browser.
You have not chosen yet in this browser: nothing is sent to Meta.
Your browser sends Global Privacy Control, so nothing is sent to Meta here.
The Klaboo app uses cookies and your browser’s local storage to keep you signed in, to protect the sign-in process, and to remember your settings and unsaved work. Only its sign-up and payment pages use the Meta Pixel, and only if you accepted, as above; its other pages use no advertising or tracking cookies.
Children
Klaboo is for people 18 and over. We do not knowingly collect information from children.
Changes
If we make a material change to this policy, we will email you at least 30 days before it applies and, where we can, ask you to accept the new version in the app before you continue.
Contact
Privacy questions or requests: support at klaboo.com.