Privacy Policy

1. Introduction

Welcome to KAMPALO. The platform is operated by Tekreign ("we," "our," or "us"), the parent company responsible for this product. We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our unified marketing analytics and campaign management platform.

By accessing or using KAMPALO, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our policies and practices, please do not use our services.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Name and email address
• Company name and business information
• Billing information and payment details
• Profile information and preferences

2.2 Platform Integration Data

To provide our services, we access data from platforms you connect, which may include:

• Google Ads campaigns, customers, and performance metrics
• Google Search Console (SEO) and Google Analytics 4 (GA4) data you authorize
• Meta Ads account, campaign, and creative data, plus Meta Organic (Pages and Instagram) if enabled
• Shopify store catalog, orders, and commerce metrics when Shopify is enabled for your workspace
• Ad performance metrics such as impressions, clicks, conversions, spend, and related identifiers

We store a copy of synced marketing data in our database so dashboards can load without calling live provider APIs on every view. TikTok remains a roadmap integration and is not a shipping product.

2.3 Usage Data

We automatically collect information about how you interact with our platform:

• IP address and device information
• Country, looked up from your IP address on our own servers (no third party receives the IP). We store it with each sign-in and use it to show prices in your local currency. IP geolocation by DB-IP.
• Browser type and version
• Pages visited and features used
• Time and date of access
• Error logs and performance data

2.4 Cookies and Tracking Technologies

We use cookies, web beacons, and similar tracking technologies to enhance your experience. For more information, please see our Cookies Policy.

3. How We Use Your Information

We use the collected information for the following purposes:

• To provide, maintain, and improve our services
• To process transactions and manage your account
• To authenticate platform connections and sync data
• To generate analytics reports and insights
• To send you service-related notifications and updates
• To respond to your inquiries and provide customer support
• To detect, prevent, and address technical issues, abuse, and security threats (including login lockout after repeated failed sign-ins)
• To process payments and detect payment fraud through our payment processor (Stripe), including 3-D Secure where Stripe requests it
• To comply with legal obligations and enforce our terms
• To send marketing communications (with your consent)

4. Data Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

4.1 Service Providers

We may share information with third-party service providers who perform services on our behalf, such as:

• Cloud hosting and infrastructure providers
• Payment processing (Stripe). Card numbers are collected on Stripe-hosted Checkout; we store only limited card-on-file details such as brand and last four digits when you add a card
• Email and communication services
• Website analytics (Google Analytics and Microsoft Clarity). Clarity records page interactions (session replay and heatmaps) on kampalo.com and app.kampalo.com; custom user IDs are hashed in the browser before they are sent
• Connected advertising platforms you authorize (Google, Meta, and Shopify when enabled)

4.2 AI Assistants You Connect

On Starter and Enterprise plans you can connect an AI assistant, such as Claude, ChatGPT, Gemini, Grok, Glama, or Cursor, to KAMPALO through our MCP server at be.kampalo.com/mcp. You connect either by signing in to KAMPALO from the assistant (OAuth) or with a personal API key from Settings → API Keys.

• What the assistant can access: the synced marketing data in your workspace, limited by your role and plan. Campaign pauses and budget changes the assistant proposes run only after you confirm them.
• What we store: the name and redirect address the assistant registers with us, and hashed (not readable) access tokens, refresh tokens, and API keys, with when they were created and last used. We do not receive or store your conversations with the assistant, only the requests it makes to our tools. Those requests are covered by the usage and error logs in section 2.3.
• Who receives your data: results of the requests you make are sent to the assistant you connected and its provider (for example, Anthropic for Claude), which handles them under its own privacy policy.
• Retention: sign-in access tokens expire after one hour and sign-in grants after 30 days unless the assistant renews them. Removing KAMPALO from the assistant or revoking your API key stops further access. Email us to revoke a sign-in grant right away. Deleting your account deletes these records.

4.3 Legal Requirements

We may disclose information if required by law, court order, or government regulation, or to protect our rights, property, or safety, or that of our users or others.

4.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

5. Data Security

We implement security measures appropriate to a B2B SaaS product, including:

• Encryption of data in transit (HTTPS) and access controls by role inside each workspace
• OAuth 2.0 for Google, Meta, and other platform connections you authorize
• OAuth 2.1 with PKCE for AI assistant connections; API keys, access tokens, and refresh tokens are stored only as hashes
• Session tokens that can be invalidated on logout (refresh-token blacklist)
• Server-side login lockout after repeated failed sign-in attempts from the same email or IP
• Security HTTP headers (including Content-Security-Policy and Permissions-Policy) on the application and marketing site
• Stripe-hosted Checkout with 3-D Secure when Stripe requests it; payment-fraud rules are configured in Stripe Radar on our Stripe account
• Automated code and dependency scanning in our development pipeline (this is not a substitute for a third-party penetration test)

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

6. Your Rights

Depending on your location, you may have the following rights:

• Access: Request access to your personal information
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal information (right to erasure)
• Portability: Request a copy of your data in a portable format
• Opt-out: Opt-out of marketing communications
• Objection: Object to certain processing activities
• Restriction: Request restriction of processing

Deletion in the app. Workspace administrators can permanently delete stored data from Settings → Preferences (Danger Zone). You must type DELETE and re-enter your password:

• Individual: Delete account removes the admin, the tenant, and all synced marketing data we store for that workspace
• Enterprise: Delete workspace removes the agency home, every brand client, teammates, and synced data for that organization
• Team members (non-admins) cannot delete the workspace from the app
• Disconnecting an integration on the Integrations page permanently deletes the Kampalo copy of that connection's data (your accounts at Google, Meta, or Shopify are not deleted)

Step-by-step instructions are on our data deletion & disconnection page. Deletion cannot be undone from Kampalo.

To exercise access, correction, portability, or other rights, or if you are not an admin, contact us at connect@kampalo.com. We may need to verify your identity before we act.

7. Data Retention

We retain your personal information and synced marketing data for as long as your workspace remains active, unless a longer period is required or permitted by law. When an admin deletes the account or workspace, we permanently delete the Kampalo-stored copy of that data, including connections, tokens, and synced analytics. We keep a hashed copy of the deleting admin's email for up to 30 days solely to prevent immediate re-registration abuse; that hash is not used for marketing. We may still retain a limited subset where the law requires it (for example billing, tax, or security logs) only for as long as necessary. Stripe may retain payment records under its own policies even after we cancel the subscription.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws than your country. We ensure appropriate safeguards are in place to protect your information in accordance with this Privacy Policy.

9. Children's Privacy

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. We encourage you to review this Privacy Policy periodically.

11. Contact Us

If you use the KAMPALO application, read our data deletion & disconnection instructions for what happens when you disconnect integrations or delete your account—data is removed permanently and cannot be recovered from KAMPALO.

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us: