Privacy policy

1. Who we are

Kaso, Inc., a Delaware corporation ("Kaso", "we") runs joinkaso.com and app.joinkaso.com. This policy says what personal data Kaso collects, why, who sees it and what you can do about it. It applies to visitors of the site, to brand and agency users and to creators. Questions and requests go to contact@joinkaso.com.

2. What Kaso collects

Account data. Your name, email address and password (stored hashed), the account type, and for a business its legal name, website, industries and contact email. If you sign in with Google, Google gives Kaso your name, email and profile picture.

Creator data. The handles and public profile details of the social accounts you verify (name, picture, follower count, the author id the platform shows), the links of the videos you submit, and the public view counts Kaso reads from each video's page once a day while its campaign runs. Kaso never asks for a social password, never receives a login or session, and never reads a private post.

Money data. Deposits, campaign budgets, earnings and payouts, as amounts and dates. Bank details, identity documents and taxpayer numbers are collected and held by Stripe, Kaso's payment processor, under Stripe's privacy policy; Kaso sees whether an account is verified and can be paid, the last four digits of a bank account and a fingerprint that tells two accounts apart, never the full details.

Content you give. Campaign briefs, product assets, reference links, updates to creators, dispute messages and reports.

Usage data. Pages visited, buttons clicked, the browser and device, and the IP address, through PostHog. In the app, Kaso records sessions (what is on the screen, with every text field masked) to fix problems and improve the product; it never records the screens that show bank details or money movements, and it never records the public site. Errors are reported to Sentry with the page or route where they happened, never the request's contents. Kaso's hosting provider keeps access logs.

Referral data. If you reach Kaso through an affiliate's link, a cookie remembers that link for 90 days and Kaso tells Tolt, its affiliate platform, when a referred creator is first paid, with the creator's email and the amount.

3. Why Kaso uses it

To run the service: to open and secure accounts, run campaigns, verify social accounts, count views, pay creators, bill brands, send the emails the service needs (confirmations, approvals, payouts, alerts) and answer support. To prevent fraud: to spot fake views, duplicate accounts and abuse. To meet legal duties: tax filings, record keeping and lawful requests. To improve Kaso: to see how the product is used and where it breaks. Marketing emails go only to people who opted in, and every one has an unsubscribe link.

Kaso's legal bases, where a law asks for one, are performing its contract with you, its legitimate interest in running and protecting the service, its legal obligations, and your consent for marketing.

4. Who sees it

Brands see the handles, the videos, the view counts and the earnings of creators in their campaigns, never a creator's email, bank details or taxpayer number. Creators see a campaign's public details and the brand's assets and updates, never the brand's balance, deposits or what it paid anyone else. When a campaign ends, its totals are public: budget spent, views, the number of videos and of creators who earned, cost per 1,000 views. No individual creator's earnings are published.

Kaso's service providers process data for Kaso under contract: Stripe (payments, identity, tax forms), Supabase (database and authentication), Vercel (hosting), Cloudflare (file storage), Resend (email), ScrapeCreators (reads of public social pages), PostHog (analytics and session recordings), Sentry (error reports), Tolt (affiliate referrals and their payments) and Google (sign-in, if you use it). Kaso shares what each needs and nothing more.

Kaso also shares data when the law requires it, to protect Kaso's rights or anyone's safety, and with a successor if Kaso is sold or merged. Kaso does not sell personal data and does not share it for cross-context behavioral advertising.

5. Cookies

Kaso sets the cookies the service needs: the session that keeps you signed in, one that remembers your last workspace, one that remembers a list view, one that remembers an affiliate link for 90 days, and PostHog's cookie that tells one visit from the next. There are no advertising cookies. Browser settings that block cookies stop the app from keeping you signed in.

6. How long Kaso keeps it

Account data is kept for as long as the account exists. Money, campaign and tax records are kept for at least seven years after the transaction, as tax law requires. View readings and video files are kept with their campaign's records.

Data held by Kaso's providers is kept under each provider's retention settings: session recordings for 30 days, and analytics events and error reports for up to a year. Stripe keeps its own records of payments, payouts and identity under its legal duties.

When a creator deletes their account, Kaso removes the name and email from the profile, closes the login, signs out every session and stops every email and notification. Kaso keeps the money and tax records it must keep; the records and files of the creator's videos, so that licenses already granted and payments already made stay accounted for; the social handles the account verified; a record of the deletion itself, with the name on the account, kept to answer disputes; and the name, email and picture Google provided at sign-in, stored with the closed login. Data already sent to Kaso's providers stays under their retention settings.

7. Your rights

You can see and change your account details in Settings and unsubscribe from marketing in any email. A creator deletes their account in Settings; a brand or agency account is closed by writing to contact@joinkaso.com. You can ask Kaso for a copy of your personal data, to correct it, to delete it (subject to the records Kaso must keep) and to limit how it is used, by writing to contact@joinkaso.com; Kaso answers within 45 days and never treats you differently for asking. Residents of California and of other states with privacy laws have these rights under those laws, including the right to know what is collected and the right to opt out of sale or sharing, which Kaso does not do. Residents of the European Economic Area and the United Kingdom may also complain to their data protection authority; note that Kaso is a US service and keeps its data in the United States.

8. Security, children, changes

Kaso protects data with encryption in transit and at rest, access controls, row-level security in its database and two-factor authentication for its own staff. No system is perfectly secure; tell Kaso at once if you think your account was used without you. Kaso is for people 18 and older and does not knowingly collect data from children. Kaso will email you about a material change to this policy before it takes effect.