Privacy Policy

Katto is based in Japan. This Privacy Policy explains how we collect, use, and protect your personal data when you use Katto at katto.tech.

Contact: [email protected]

We use your data to:

• Provide and improve the Katto service
• Send transactional emails (receipts, processing complete notifications)
• Improve our clip detection algorithm (anonymized usage signals)
• Prevent fraud and abuse
• Comply with legal obligations

We do not use your data for advertising. We do not sell your data to third parties. Ever.

We use a small number of trusted subprocessors to operate Katto. Each processes only the data it needs for its function, and — where data leaves the EU/EEA — under EU Standard Contractual Clauses. We never use your content to train AI models.

• Supabase — authentication and database. Hosted in the EU (Frankfurt).
• Cloudflare R2 — temporary storage of your source videos and generated clips.
• Cloudflare Workers & KV — runs our hosted MCP server (mcp.katto.tech). When you connect an AI agent over MCP, the short-lived OAuth handoff (a session grant, minutes-long — never your password) transits Cloudflare KV. Used only for agent connections.
• Modal — GPU processing (transcription, alignment, speaker diarization, and optional dubbing and audio cleanup). Processes your video's audio during a job. An infrastructure provider that runs our code; it does not train models on your data. US-based.
• Deepgram — fallback transcription and diarization when GPU processing is unavailable. Processes your video's audio. EU endpoint.
• Anthropic (Claude) — AI text processing on the transcript only (clip descriptions and virality analysis, proper-noun correction, hook and title generation, translation for dubbing). Does not receive your video or audio, and does not train its models on data submitted through its commercial API. US-based.
• Google (Gemini TTS) — speech synthesis for dubbing. Receives the translated transcript text only, never your video or its original audio, and only when you ask for a dub. Billed through a prepaid account, which is the tier where Google does not train on submitted data. US-based.
• Stripe — payment processing. Handles all billing data.
• Resend — transactional email (receipts, processing and trial notifications).
• Railway — application hosting (EU region).
• Hetzner — video processing servers, EU (Germany).
• PostHog & Umami — privacy-friendly product and website analytics. EU-hosted; no advertising cookies.
• Affonso — affiliate programme attribution. Active only for visitors who arrive through an affiliate link: it then sets two cookies on katto.tech for 60 days and receives the referring page, your browser's user agent, and any campaign identifiers already present in that link. If you create an account inside that window, your e-mail address is sent so the person who recommended us can be credited. A German company; its infrastructure is in Frankfurt.
• Cloudflare Turnstile — bot and spam protection on our forms. It verifies you are human without tracking you across websites and does not use cookies for advertising. Its use is subject to Cloudflare's Privacy Policy and the Turnstile Privacy Addendum.
• Residential proxy providers — used only to fetch the public video URLs you submit (e.g. a YouTube or Twitch link). They see the public URL being fetched, not your account or your uploaded files.

We do not use Google Analytics, Facebook Pixel, or any advertising trackers. We do not sell your data.

Videos you submit are processed on our servers. They are:

• Never shared with third parties
• Never used to train AI models
• Never viewed by our team unless required for debugging a specific reported issue (with your consent)
• Automatically deleted — Free-plan clips within 72 hours and source videos within 7 days; paid-plan clips stay until you delete them

When you submit a public video link (YouTube, Twitch, Vimeo, and similar), we may briefly cache the downloaded file so a popular video is fetched once rather than repeatedly. This deduplication applies only to public URLs; files you upload are private to your account and are never shared or deduplicated across accounts.

We use essential cookies to operate the service: session cookies for authentication, and one that remembers your language. Our analytics sets one too: PostHog, hosted in the EU, which recognises a browser that has been here before so the same visit is not counted twice. Umami sets none. We do not use advertising cookies, and nothing we set follows you to other websites.

One exception, and it applies only if you arrive through an affiliate link. Our affiliate programme then sets two cookies on katto.tech, affonso_referral and affonso_data, which expire after 60 days. They exist so the person who recommended us is credited if you subscribe. They are not set for anyone who arrives another way, and they are never used for advertising.

You have the right to:

• Access the data we hold about you
• Correct inaccurate data
• Delete your account and associated data
• Export your data in a portable format
• Object to certain processing of your data

To exercise any of these rights, email [email protected]. We respond within 30 days.

These rights apply under the EU/UK GDPR (for users in the EEA and UK) and under Japan's Act on the Protection of Personal Information (APPI). Wherever you live, you can exercise them by emailing the address above.

We protect your data using:

• HTTPS encryption for all data in transit
• Hashed passwords (never stored in plain text)
• Signed URLs for file access (files are not publicly accessible)
• Automatic deletion schedules to minimize data retention

Katto is operated from Japan. Your data is processed by subprocessors located in the EU/EEA (Supabase in Frankfurt, Cloudflare R2 in the EU, Railway, Hetzner, Affonso, PostHog, and Deepgram's EU endpoint) and in the United States (Modal, Anthropic, Stripe). Where personal data is transferred outside the EU/EEA, EU Standard Contractual Clauses and equivalent safeguards are the legal basis for the transfer, and we require every subprocessor to meet adequate data-protection standards.

Katto is not intended for users under 18. We do not knowingly collect data from minors. If you believe a minor has created an account, contact us at [email protected] and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you by email at least 14 days before significant changes take effect. The “Last updated” date at the top of this page reflects the most recent revision.

If you create an API key, use the Katto CLI, or connect an AI agent or assistant — for example through our hosted Model Context Protocol (MCP) server — that key or connection can access your account and act on your behalf (submit videos, read jobs and clips, read your usage) to perform the actions you request.

• API keys are secrets tied to your account. Keep them private — anyone holding a key can use your quota and access your data.
• Our hosted MCP server (mcp.katto.tech, on Cloudflare Workers) uses OAuth 2.1: no API key is stored on your device, and access is granted per session. The OAuth handoff is held only transiently (minutes) in Cloudflare KV, then discarded.
• You can revoke any API key or connected application at any time from your dashboard. Revocation takes effect immediately.
• The same monthly video quota is shared across the dashboard, API, CLI and MCP.

Content processed through the API, CLI or MCP is handled under exactly the same retention, subprocessor and no-AI-training rules as the rest of this policy. It is never used to train AI models.

Privacy questions or requests: [email protected]

We respond within 48 hours on business days.