Privacy Policy

Version of October 28, 2026 (English translation of the Russian policy; the Russian text prevails)

Kaito-SMM (the "Service") is a service for managing publications and analytics on social networks and marketplaces on behalf of our customers. The data controller is sole proprietor Valery Vladimirovich Temnikov (TIN 183473922748, OGRNIP 322183200057442), Russia. This page describes what data we process and how we use it.

What data we process

Access tokens to social networks and marketplaces that the customer connects in their account (Telegram, VK, Instagram, YouTube, Wildberries, Avito and others), so that we can publish content and read analytics on the customer's behalf;
Content that the customer prepares for publication (texts, links to images, videos);
Instagram Direct messages for accounts that the customer has connected, so the customer can reply to followers from one panel;
Basic account data of the customer (name, plan, contact details).

How we use the data

We use data only to run the Service: posting on a schedule, reading statistics (views, orders, impressions), receiving and sending Instagram Direct messages for the connected account. We do not use customer data for advertising and do not sell it. Some data is passed to the processors listed in "Who receives the data" below.

Data received from Google (YouTube and Google Drive)

If a customer connects their YouTube channel or Google Drive, Kaito-SMM receives only what is needed to provide the Service:

youtube.upload — to publish, on the customer's own channel and at the time the customer chose, videos that the customer created or approved in Kaito-SMM;
youtube.readonly — to read only the channel name and ID, to show which channel is connected and to check that access still works;
drive.file — to work with files created by the Service itself and with a folder the customer selected. This permission is requested separately from YouTube.

We do not read comments, subscribers or other personal data of the Google account. Data received from Google APIs is used only for these features. We do not sell it, do not transfer it to third parties, do not use it for advertising and do not build user profiles from it. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. A customer can disconnect YouTube or Drive in their account at any time (the stored access token is deleted immediately) or revoke access in their Google Account settings.

Website analytics

Yandex Metrika (Yandex LLC, Russia) is a web analytics service that uses cookies and collects anonymous visit data (pages viewed, referrer, device and browser type, approximate region, time on site). It is enabled only after consent in the cookie banner. Session recording (Webvisor) is disabled. Our site also stores a "ks_src" cookie for 60 days with the name of the source you came from; it contains no personal data and is attached to your project card if you register.

Where data is stored

Data is stored in Netlify Blobs. Access to the admin panel is protected by a password with brute-force lockout and, optionally, a second factor. Access tokens are encrypted and are never shown in the interface.

Advertising

The Service lets users plan advertising campaigns as cards in the CRM, but never spends an advertising budget automatically — only after the customer's explicit confirmation for each campaign.

Who receives the data

Only the amount needed for the Service, on the controller's instructions:

hosting and storage — Netlify, Inc. (USA);
text, image, video and voice generation — OpenAI (USA), Anthropic (USA), kie.ai, BytePlus (ByteDance), HeyGen (USA), JSON2Video, Microsoft Azure: only texts, materials and tasks needed for a specific generation;
public data of social accounts for analysis — HikerAPI, Apify: links and names of public accounts;
transactional email — Resend (USA): email address and message text;
payments — YooMoney NKO LLC (YooKassa, Russia): amount, description, email or phone for the receipt; we do not receive card data;
publishing and analytics — the social networks and Google Drive / Yandex Disk accounts that the user connects, with the user's permission;
web analytics — Yandex LLC (Yandex Metrika), only after cookie consent.

Some processors are located outside Russia (cross-border transfer); users consent to this at registration.

Face photos for videos: if a user uploads a photo or video of a person for a video (trends, hero replacement, avatar), it is passed only to the generation provider creating that video and used only for it. We do not use such images to identify people and do not build biometric templates. The user confirms that the person is themself or has agreed to the use of their face. A photo for a trend video is kept by us only while the video is being created and is deleted right after it is ready (or fails for good); the provider may keep a temporary copy for up to three days under its own rules.

Data deletion

A customer can disconnect any social network in the CRM at any time — its access token is deleted immediately. To delete the account and all related data (tokens, content, message history, data received from Facebook and Instagram), email info@kaito-smm.ru; we delete it within 30 days. Details: Data deletion.

Your rights and retention

You may ask what data about you is processed, request correction, blocking or deletion, and withdraw consent by emailing info@kaito-smm.ru; we reply within 10 business days. Data is kept while the account is active and deleted within 30 days after account deletion or withdrawal of consent, except information the law requires us to keep longer (for example, payment records).

Contact

For questions about data processing write to info@kaito-smm.ru.