Legal

Privacy Policy

Last updated: 2026-04-25

This Privacy Policy explains how Karleido ("we", "us", "our") processes personal data in connection with the use of our web application.

1. Data Controller

Michael Thomas / Jiagual Media

Selkestrasse 24, 12053 Berlin, Germany

contact@karleido.com

2. Categories of Data We Process

A. Account & Authentication Data

  • Email address
  • User ID (Supabase UUID)
  • Access tier / entitlements

Purpose: Provide access to the service Legal basis: Contract performance (Art. 6(1)(b) GDPR)

B. User-Generated Content & Session Data

  • Saved session snapshots
  • Timeline configurations
  • Export settings

Purpose: Enable saving and restoring projects Legal basis: Contract performance (Art. 6(1)(b) GDPR)

C. Project Files (Pro plan only)

Pro plan users can save named projects to the cloud. As part of this feature, the following files are uploaded and stored:

  • Audio tracks
  • Media files (images, video)
  • Texture files used in visual modules
  • Overlay assets (images, video)
  • Project thumbnails (generated screenshots)

These files are stored in a private cloud storage bucket under your user account. They are used solely to restore your projects when you reopen them. We do not analyse, process, share, or use these files for any other purpose.

You can delete individual files by removing them from your project, and delete all project files at any time by deleting your projects from the Project Browser. Upon account deletion, all project files are permanently removed from cloud storage.

Purpose: Store and restore project assets on behalf of the user Legal basis: Contract performance (Art. 6(1)(b) GDPR)

D. Security & Abuse Prevention

  • Authentication logs
  • Export validation events
  • Rate limit counters
  • IP address (processed at infrastructure level)

Purpose: Fraud prevention and system security Legal basis: Legitimate interest (Art. 6(1)(f) GDPR)

E. Anonymous Technical Telemetry

  • Export duration and resolution
  • Performance metrics
  • Feature usage counts
  • Application version
  • Device platform and browser user agent
  • Export clip/segment timing and preset references

This data is not linked to user accounts and does not include IP addresses or persistent identifiers.

Purpose: Improve reliability and performance Legal basis: Legitimate interest (Art. 6(1)(f) GDPR)

F. Usage Analytics

  • Session start and last-active timestamps, linked to your user account
  • Date of last application visit

This data is stored server-side and linked to your user ID. It is used solely to understand how the product is used — for example, session length and return frequency. No behavioural event tracking, page view tracking, or cross-device tracking takes place.

Purpose: Product improvement and retention analysis Legal basis: Legitimate interest (Art. 6(1)(f) GDPR)

G. Feedback & Error Reports

  • Free-text feedback
  • Technical context (platform and browser user agent)
  • Application state data (current module, effects, preset, audio state)

Purpose: Debugging and product improvement Legal basis: Legitimate interest (Art. 6(1)(f) GDPR)

3. Cookies

We use only strictly necessary cookies for authentication and session management. We do not use marketing or cross-site tracking cookies.

4. Data Retention

  • Account data: retained while account is active
  • Session snapshots: deleted upon account deletion
  • Project files (Pro): retained until deleted by the user or until account deletion
  • Usage analytics (session logs, last-seen timestamps): retained for 12 months or until account deletion
  • Security logs: retained 30--90 days
  • Anonymous telemetry: stored in non-identifiable form

5. Data Deletion

You can delete individual project files by removing assets from your projects, or delete entire projects from the Project Browser. All project files are permanently removed from cloud storage when a project is deleted.

You may request full account deletion at any time by contacting contact@karleido.com. Upon account deletion, all personal data including account information, project snapshots, and all project files stored in cloud storage will be permanently removed, subject to limited backup retention periods.

6. Data Processors

We use the following sub-processors under Data Processing Agreements:

  • Supabase — authentication, database infrastructure
  • Cloudflare — cloud file storage (R2) for project assets (Pro plan)

7. Your Rights

Under GDPR, you have the right to:

  • Access your data
  • Rectify inaccurate data
  • Request deletion
  • Restrict processing
  • Object to processing
  • Data portability
  • Lodge a complaint with a supervisory authority

Contact: contact@karleido.com

8. Security

We implement technical and organizational measures including HTTPS encryption, access controls, and Row-Level Security (RLS). Project files are stored in a private bucket accessible only via short-lived signed URLs generated on request.