Privacy Policy
Last updated: January 1, 2025
We collect only what we need. We don't sell your data. Your videos are deleted after 48 hours. That's the short version — read on for the details.
1. Who we are
Katto is based in Japan. This Privacy Policy explains how we collect, use, and protect your personal data when you use Katto at katto.tech.
Contact: [email protected]
2. What data we collect
| Data | Why we collect it | How long we keep it |
|---|---|---|
| Email address | Account creation, login, transactional emails | Until account deletion |
| Password (hashed) | Authentication | Until account deletion |
| Videos you submit | Processing to generate clips | Deleted after 48 hours |
| Generated clips | Download by you | Deleted after 48 hours |
| Job metadata (timestamps, status) | Processing history, debugging | 90 days |
| Usage data (clips kept/ignored) | Improving our detection algorithm | Anonymized after 90 days |
| Billing information | Payment processing via Stripe | Per Stripe's policy |
| IP address | Security, fraud prevention | 30 days |
3. How we use your data
We use your data to:
- Provide and improve the Katto service
- Send transactional emails (receipts, processing complete notifications)
- Improve our clip detection algorithm (anonymized usage signals)
- Prevent fraud and abuse
- Comply with legal obligations
We do not use your data for advertising. We do not sell your data to third parties. Ever.
4. Third-party services
We use a small number of trusted third-party services to operate Katto:
- Stripe— payment processing. Stripe handles all billing data.
- Cloudflare R2— temporary video storage. Files are deleted after 48 hours.
- Supabase— authentication and database.
- Cloudflare Turnstile— bot and spam protection on our forms. It verifies you are human without tracking you across websites and does not use cookies for advertising. Its use is subject to Cloudflare's Privacy Policy and the Turnstile Privacy Addendum.
We do not use Google Analytics, Facebook Pixel, or any advertising trackers.
5. Video content
Videos you submit are processed on our servers. They are:
- Never shared with third parties
- Never used to train AI models
- Never viewed by our team unless required for debugging a specific reported issue (with your consent)
- Automatically deleted 48 hours after processing
6. Cookies
We use only essential cookies required to operate the service (session cookies for authentication). We do not use tracking or advertising cookies.
7. Your rights
You have the right to:
- Access the data we hold about you
- Correct inaccurate data
- Delete your account and associated data
- Export your data in a portable format
- Object to certain processing of your data
To exercise any of these rights, email [email protected]. We respond within 30 days.
8. Data security
We protect your data using:
- HTTPS encryption for all data in transit
- Hashed passwords (never stored in plain text)
- Signed URLs for file access (files are not publicly accessible)
- Automatic deletion schedules to minimize data retention
9. International transfers
Katto is operated from Japan. Your data may be processed on servers located in the US (Cloudflare, Railway) and the EU (Hetzner, Germany). By using Katto, you consent to these transfers. We ensure all processors meet adequate data protection standards.
10. Children
Katto is not intended for users under 18. We do not knowingly collect data from minors. If you believe a minor has created an account, contact us at [email protected] and we will delete it promptly.
11. Changes to this policy
We may update this Privacy Policy from time to time. We will notify you by email at least 14 days before significant changes take effect. The “Last updated” date at the top of this page reflects the most recent revision.
12. Contact
Privacy questions or requests: [email protected]
We respond within 48 hours on business days.