Privacy policy

This policy explains what personal data Kowl SAS collects, why, how we protect it and the rights you hold over it. It applies to the Kowl website, Kowl Manager and Kowl One.

1. Who we are

Kowl SAS (“Kowl”, “we”, “us”), a company registered in Paris, France, operates the Kowl Manager platform, Kowl One and the kowl.tech website (together, the “Services”). Kowl SAS is the data controller for the personal data described in this policy, except where we process data on behalf of a customer as a processor.

Contact for any privacy question: privacy@kowl.tech.

2. Data we collect

We collect only the data needed to provide and secure the Services:

• Account data — name, work email address, company, role, password hash and plan information.
• Roster and configuration data — the artists, assets, scoring weights, views, alerts and reports you create in Kowl Manager.
• Public platform data — publicly available metadata about the artists, tracks and profiles you choose to track on third-party platforms such as Spotify, Instagram, YouTube and TikTok (for example follower counts, stream counts, public video statistics, engagement metrics and posting activity). We never collect private messages, passwords or the personal data of listeners or followers.
• Data from connected accounts — if you choose to connect a third-party account (for example a TikTok account through TikTok’s official authorization flow), we receive only the data covered by the permissions (scopes) you approve, and store the access tokens needed to retrieve it.
• Usage and device data — IP address, browser type, pages viewed, actions in the product, log and error data, and, only with your consent, anonymous analytics (see our cookies policy).
• Communications — messages you send us, demo and free-trial requests, and your marketing preferences.

3. TikTok data

Where you connect a TikTok account or we display TikTok data, we access it through TikTok’s official APIs and only for the permissions you grant. We use this data solely to compute scores, analytics, alerts and reports for you. We do not sell it, share it with advertisers or data brokers, or use it to build profiles of individuals or for any purpose unrelated to the Services.

You can disconnect your TikTok account at any time from Kowl Manager or from your TikTok settings (Settings and privacy > Security and permissions > Apps and services). When you disconnect, we stop collecting and delete the associated tokens immediately, and delete the data retrieved through that connection within 30 days unless you ask us to delete it sooner. Your use of TikTok remains subject to TikTok’s Privacy Policy.

4. Google and YouTube user data

If you connect a YouTube channel to Kowl through Google’s official authorization flow (OAuth), we access Google user data through the YouTube Data API, only within the permissions you approve. This section describes how we handle that data (“Google user data”).

Data we access.

• Channel information — your YouTube channel ID and channel name, to confirm which channel is connected.
• Videos — the list of videos on your channel and their basic metadata, to show them in Kowl.
• Content you publish — the videos and metadata (title, description, privacy status) that you choose to upload to YouTube from Kowl.
• OAuth tokens — the access and refresh tokens Google issues, so we can act on your behalf only when you ask.

How we use it. We use Google user data solely to let you publish and manage videos on your own YouTube channel from Kowl. We do not use it for advertising, we do not sell it, we do not use it to build profiles of individuals, and we do not use it to develop, improve or train generalised artificial intelligence or machine learning models.

Sharing, transfer and disclosure. We do not share, transfer or disclose Google user data to third parties, except:

• Google / YouTube — to carry out the uploads and actions you request through the YouTube Data API.
• Our infrastructure processors, acting only on our instructions and under data processing agreements: Supabase (database hosting, where encrypted tokens and connection records are stored, in the European Union) and Cloudflare (application hosting and network delivery). They may not use this data for their own purposes.
• Legal requirements — where required by applicable law or to protect against fraud, abuse or security threats.
• Business transfer — as part of a merger, acquisition or sale of assets, only with your prior notice and subject to equivalent protections.

We never share Google user data with advertisers, advertising networks, data brokers or information resellers.

How we protect sensitive data.

• OAuth access and refresh tokens are encrypted by our application with AES-256-GCM before they are stored, and the encryption key is kept as a server-side secret separate from the database.
• Tokens are never sent to your browser or exposed through our APIs; they are only decrypted server-side, at the moment a request you initiated is sent to Google.
• Access to a connection is restricted to the authenticated Kowl account that created it, and staff access is limited to a small number of authorised people on a need-to-know basis.
• All data is encrypted in transit with HTTPS/TLS and at rest by our hosting providers.
• We request only the YouTube permissions needed to publish and manage your videos.

Retention and deletion. We keep Google user data only while your YouTube channel is connected to Kowl. You can revoke Kowl’s access at any time from your Google Account permissions, and you can ask us to delete your Google user data by writing to privacy@kowl.tech. We then delete the stored tokens and the data retrieved through that connection within 30 days. Videos you published remain on YouTube and are managed from your YouTube account.

Limited Use. Kowl’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Your use of YouTube remains subject to the YouTube Terms of Service and the Google Privacy Policy.

5. Why we use your data and our legal bases

Under the GDPR we rely on the following legal bases:

• Performance of a contract — to create and manage your account, deliver the Services, compute scores, alerts and reports, and provide support.
• Legitimate interests — to secure the Services, prevent fraud and abuse, fix errors, improve the product and send operational messages, balanced against your rights.
• Consent — for optional measurement cookies, marketing emails and connecting third-party accounts. You can withdraw consent at any time without affecting prior processing.
• Legal obligation — to meet accounting, tax and other regulatory requirements.

We do not sell personal data, and we never use your roster data to benefit other customers.

6. Who we share data with

We share personal data only with service providers acting on our instructions (“processors”) and only as needed: cloud hosting in the European Union, email delivery, customer support, payment processing and error monitoring. We may also disclose data where required by law or to protect our rights, and in connection with a merger or acquisition, subject to equivalent protections. We do not allow processors to use your data for their own purposes. Google user data obtained through a connected YouTube channel is shared only as described in section 4.

7. International transfers

Data is hosted in the European Union. If a provider processes data outside the European Economic Area, we ensure an adequate level of protection through an adequacy decision or the European Commission’s Standard Contractual Clauses, together with supplementary measures where needed.

8. Retention

We keep account and roster data for the duration of your subscription plus 12 months, then delete or anonymise it unless the law requires longer retention (for example invoicing records, kept for 10 years). Public platform data tied to your roster is deleted with it. Server logs are kept for up to 12 months, and analytics cookies for 13 months. Backups are purged on a rolling 90-day cycle.

9. Security

Data is encrypted in transit (TLS) and at rest, access is restricted on a need-to-know basis, and access tokens for connected accounts are stored encrypted. We maintain procedures to detect, handle and, where required, notify personal data breaches to the CNIL and to affected users without undue delay. No system is perfectly secure, but we work to keep yours that way.

10. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, object to the processing of, and obtain a portable copy of your personal data, to withdraw consent at any time, and to give instructions about your data after your death.

To exercise these rights, write to privacy@kowl.tech. We respond within 30 days and may need to verify your identity. You also have the right to lodge a complaint with the French data protection authority, the CNIL (cnil.fr), or with your local supervisory authority.

11. Children

The Services are intended for professionals and are not directed to anyone under 18. We do not knowingly collect personal data from minors; if you believe we have, contact us and we will delete it.

12. Changes to this policy

We may update this policy as the Services or the law evolve. We will change the date above and, for material changes, notify you by email or in the product before they take effect.

13. Contact

Kowl SAS, Paris, France — privacy@kowl.tech or contact@kowl.tech. See also our Terms of Service.