Khep Privacy Policy
Version 1.1 | Last updated: 30 October 2026
Who we are and how to contact us
Khep is operated by ODREN LTD, a company registered in England and Wales under company number 15944303, with its registered office at 7 Manchester Square, London, England, W1U 3PQ. These company details are recorded at Companies House.
In this Policy, “Khep”, “we”, “us” and “our” refer to ODREN LTD. You can contact us about privacy, data protection or deletion requests at privacy@khep.io, or write to our registered office, marked “Khep Privacy”.
This Policy explains how we handle personal data in connection with the Khep website, application and related services, including Khep-branded pages at khep.io, app.khep.io and khep.lovable.app. It covers visitors, prospective customers, account holders, authorised team members and, where applicable, people whose information customers process through Khep.
Our data protection responsibilities depend on the processing concerned and the laws that apply, including the UK GDPR and Data Protection Act 2018, as amended, the EU GDPR where applicable, and the Swiss Federal Act on Data Protection where applicable. This Policy does not remove rights you have under applicable law or make use of the service conditional on consenting to every processing activity.
Our role and our customers' role
Where ODREN LTD is a controller
We determine the purposes and means of processing information needed to operate our own business and services. This includes account administration, our customer relationships, billing, security, enquiries, website measurement and communications about Khep.
For these activities, ODREN LTD acts as the controller. The purposes, legal bases, recipients and rights described in this Policy apply to that processing.
Where Khep processes data for a customer
Customers can upload business materials, connect social and advertising accounts, create campaigns and authorise the handling of comments or messages. When we process personal data within those materials and activities on a customer's instructions, we act as its processor or, where an agency itself acts for another controller, as a subprocessor.
The relevant customer or its client determines why those individuals' data are processed and is responsible for the lawful basis, required notices and permissions for its activities. Our processing on its behalf is subject to the applicable service agreement, data processing terms and documented instructions; the distinction between controller and processor depends on the actual activity, not simply the label used in a contract (ICO guidance).
If your information appears in a business's social messages, customer files or campaigns, you should normally contact that business about its use of your information. You may also contact us at privacy@khep.io; we will identify the appropriate route and assist the responsible customer where required, rather than treating this Policy as permission to use its data for unrelated purposes.
Personal data we handle
The information involved depends on the services you use, the accounts you connect and the permissions granted. A reference to a feature in this Policy does not mean that it is enabled for every customer, platform or region.
| Category | Examples and circumstances |
|---|---|
| Account and business contact details | Name, business email, organisation, role, workspace membership, language, country and contact preferences. |
| Authentication and access information | Login and security events, account identifiers, authentication records, permissions, OAuth access and refresh tokens, and connection status. |
| Business and knowledge-base materials | Uploaded files, website links, extracted text, product information, brand guidelines, contact details in documents, indexed passages and numerical representations used for retrieval. |
| Prompts, outputs and creative assets | Instructions, scripts, generated text, images, video, audio, captions, revisions and quality-review information. Images, voices and other content may identify people. |
| Connected social account information | Account or page identifiers, profile names, handles, authorised profile information, posts, comments, permitted messages, timestamps and available engagement data. |
| Campaign and advertising information | Campaign settings, creative content, audience settings, account identifiers, budgets, results, conversion events and attribution information made available through an authorised integration. |
| Browser-assisted operation information | Where enabled and permitted, authenticated session state, cookies or tokens needed to maintain that session, pages involved in an authorised task and limited evidence of the operation. |
| Billing and transaction information | Billing contact details, invoices, subscription status, AI credit transactions, payment references, refunds and payment-method information made available to us by our payment provider. |
| Support and communications | Enquiries, support correspondence, feedback, privacy requests and information needed to investigate an issue. |
| Technical and usage information | IP addresses, device and browser information, approximate location, pages requested, referring sites, usage events, diagnostic records and security logs. |
We do not need private social-account passwords to connect accounts through OAuth. If a permitted browser-assisted workflow needs credentials or a reusable session, we use a dedicated access process; credentials must not be placed in prompts, ordinary support messages or the knowledge base.
Payment details are handled through Stripe's payment infrastructure. Khep uses the transaction, billing and payment references needed to administer the service; Stripe may separately handle payment-method and fraud-prevention information under its own role and terms (Stripe Privacy Policy).
You should not upload sensitive personal data, criminal-offence information, identity documents, medical records or financial-account credentials unless that information is necessary for an expressly supported use and the appropriate safeguards have been agreed. In particular, ordinary content-generation and marketing workflows are not a general-purpose repository for highly sensitive records.
Where the information comes from
We obtain information directly from you when you register, contact us, upload materials, provide instructions or use the application. We also receive it from an organisation or agency that invites you to a workspace or supplies information for its campaigns.
Other sources include connected social and advertising platforms, people interacting with a customer's accounts, authorised payment and infrastructure providers, and public websites used for relevant research. Public availability does not, by itself, make personal information unrestricted or authorise every subsequent use.
Where a customer supplies information about another person, the customer must have the necessary authority and provide the notices required for that activity. Where we collect information indirectly for our own purposes, we provide the information required by applicable transparency rules, including the source and relevant categories, subject to any applicable exception (ICO transparency guidance).
Why we use personal data
The following table describes processing for which ODREN LTD determines the purpose. For personal data processed solely on a customer's behalf, the customer's lawful basis and instructions apply; a contract between Khep and a company is not automatically a contractual legal basis for processing every employee's or follower's data.
| Purpose | Legal basis where the UK or EU GDPR applies |
|---|---|
| Create and administer an individual's account, provide requested services and manage their subscription | Performance of our contract with that individual, or steps taken at their request before entering into it. |
| Manage a corporate customer's relationship and authorised team members | Our legitimate interests in administering business relationships and providing the service to the subscribing organisation. |
| Process payments, reconcile AI credit, handle invoices and resolve payment issues | Contract where applicable; legitimate interests in administering corporate customer accounts; legal obligations for accounting and taxation. |
| Authenticate users, protect accounts, prevent fraud or abuse and investigate incidents | Our legitimate interests in protecting the service, customers and others; legal obligations where applicable. |
| Answer enquiries, provide support and resolve complaints | Contract or pre-contractual steps where applicable; otherwise legitimate interests in responding and resolving issues. |
| Measure use of our website and improve its reliability and usability | Legitimate interests in understanding aggregate service use, where appropriate; consent where required for the technology or processing involved. |
| Send requested or permitted marketing about Khep | Consent where required; otherwise legitimate interests only where applicable marketing law permits the communication, with an effective opt-out. |
| Comply with legal requests, establish or defend claims and maintain required records | Legal obligations and, where appropriate, legitimate interests in protecting legal rights. |
Where we rely on legitimate interests, we consider necessity and the impact on individuals' rights. Where consent is the basis, you may withdraw it without affecting the lawfulness of processing carried out before withdrawal.
We distinguish essential service communications, such as security, billing or account notices, from optional marketing. Choosing not to receive marketing does not prevent essential communications about a service you use.
AI agents, knowledge retrieval and automated activity
Khep uses AI to analyse business context, retrieve relevant knowledge, prepare strategies, generate and review content, assist with community responses, and recommend or carry out authorised campaign actions. This may involve sending selected prompts, excerpts, media and context to the AI provider used for that feature.
For LinkedIn API data, the LinkedIn section below governs: this description of AI and retrieval does not authorise transmission to providers, training or derived databases that LinkedIn restricts.
Our knowledge-base features can extract text, divide documents into passages and create numerical representations, commonly called embeddings, so that relevant information can be retrieved. These derived records can still relate to identifiable people and are not automatically anonymous; retrieval of customer material is not, by itself, the training of a general-purpose model.
AI can produce inaccurate or incomplete results and may infer information such as message intent, sentiment or likely content relevance. Customers should review material where accuracy matters and must not use the service to make unsupported claims about individuals.
Khep's own purposes do not include using private customer files or conversations to train a general-purpose model for unrelated customers. The handling of information by an external AI provider also depends on the relevant commercial agreement, endpoint and account configuration; we do not describe all AI processing as having zero retention or make an unrestricted no-training guarantee on behalf of every provider.
For example, OpenAI describes API data as excluded from training by default unless the customer opts in, while Anthropic's commercial terms restrict training on Customer Content; these statements concern those providers' applicable business services, not every AI service or consumer account (OpenAI business-data information, Anthropic Commercial Terms).
Using Khep is not blanket consent to unrelated model training. Any materially different use of personal data must have an appropriate legal basis, be communicated before it starts and, where required, receive a separate choice or consent.
Automated decisions and human review
The service can automate publication, scheduling, permitted replies, budget controls, usage limits and other actions within a customer's mandate. Depending on the information used, some analysis may amount to profiling; it is not accurate to describe every AI feature as non-profiling.
Khep is not designed to determine creditworthiness, eligibility for employment, insurance or other comparable high-impact outcomes. If an automated action concerning your Khep account affects you, or you believe a decision has a legal or similarly significant effect, contact privacy@khep.io to explain the issue and request human consideration and the safeguards available under applicable law.
Where a customer uses the service to make decisions about its own customers or followers, that customer is responsible for the relevant decision and its legal basis. We assist with requests concerning processing we carry out on its behalf.
Connected accounts, permissions and browser sessions
We access connected platforms only through the permissions and mechanisms available for the relevant account and feature. Connecting an account does not give Khep unrestricted access to all personal accounts, private conversations or data held by that platform.
Customers can withdraw access through the relevant platform's security or connected-app settings and can ask us to disconnect an integration. Revocation stops future authorised access, but it does not automatically remove a post already published on a social platform or erase records that the platform holds independently.
Where browser-assisted operations are enabled, the authenticated session is used for the authorised task rather than as permission to browse unrelated information. Session material is sensitive, and retaining a session does not authorise recording all activity, bypassing security controls or ignoring platform restrictions.
Customers should tell us promptly if an account is compromised or an authorised person leaves their organisation. We may need to disable access, stop pending tasks or request renewed authentication to protect the account.
Where a LinkedIn integration is enabled, Khep may access only the accounts and Pages separately authorised by the customer, through available and approved APIs and permissions, for the applicable approved use cases. Data categories depend on the enabled function: account or Page identifiers, permitted profile information, content, comments, reactions and available statistics. This does not mean that private messaging, advertising or any other capability is universally available.
Before a customer connects through OAuth, the application must explain the specific data requested, purposes, frequency of access, any retention, and how to revoke access and request deletion. Acceptance of this Policy is not unlimited consent. These are requirements for the integration, not a statement that a particular connection flow or LinkedIn approval has already been verified. Revocation stops future access; it does not automatically delete posts already published on LinkedIn. For data retained by Khep, contact privacy@khep.io.
LinkedIn API data and retention
Data retrieved through LinkedIn APIs is distinct from materials independently supplied by the customer. Customer-supplied materials follow the applicable contractual and legal arrangements; supplying an API-derived copy does not remove the restrictions that apply to that data. Under the LinkedIn data storage requirements:
| LinkedIn API data category | Maximum permitted duration |
|---|---|
| Other members’ profile data | Up to 24 hours of caching only; not persistent storage. |
| Members’ social activity, including posts, comments, reactions and associated metadata | Up to 48 hours. |
These limits do not apply indiscriminately to all LinkedIn data. Other categories follow their own applicable rules; embedded member data remains subject to its category’s restrictions. Where requirements overlap, the shortest applicable deadline prevails. A permitted storage duration is not permission for an unrelated use.
Under section 4.2 of the LinkedIn Marketing API Terms, Stored Marketing Data held for a client must be permanently deleted within 10 days or less when the client stops receiving the relevant services and the data is no longer needed for its business needs or data-retention obligations, or when the client or Account Manager requests deletion. LinkedIn-requested deletion follows LinkedIn’s instructions. Other obligations may require faster deletion; termination of those Terms requires immediate deletion of stored Member Data, subject to the stated exceptions for Lead Form Response Data and Page Messaging Data. The applicable contractual hierarchy and more restrictive requirements govern; 10 days is not a general retention allowance.
General backup cycles, service closure, export-request periods and the time for answering a privacy request do not extend LinkedIn’s deadlines or permit prohibited exports. Applicable deletion obligations must cover retained copies and must not be postponed until a general request-response deadline.
LinkedIn data, AI and recipients
Generating content from independently supplied customer materials is different from processing LinkedIn API data. LinkedIn profiles, comments and other member data, including restricted derivatives, must not be treated as freely transferable to AI providers or freely usable for model training, CRM enrichment, targeting or knowledge bases shared across unrelated customers. Every use or transfer must fit the authorisations, purposes, category-specific restrictions and express exceptions that actually apply. Customer consent and a provider’s no-training promise do not override those restrictions.
The general AI, knowledge-retrieval, recipient and international-transfer provisions of this Policy do not grant additional rights over LinkedIn data. The Marketing API Terms and restricted uses must be assessed for each data flow; this Policy does not certify an unverified AI flow as authorised or compliant. The API Terms and applicable Community Management app review requirements also govern access. Listing LinkedIn does not claim that Khep is approved, certified or a LinkedIn partner. Khep must not collect LinkedIn passwords or use scraping or browser automation to bypass unavailable APIs, restrictions or app review.
Google and YouTube
When the YouTube integration is enabled, Khep uses YouTube API Services. Depending on the permissions granted, this can involve channel and video information, publication management, comments and replies, and available performance information; Google handles information under the Google Privacy Policy.
Khep's use and transfer of information received from Google APIs must adhere to the Google API Services User Data Policy, including the Limited Use requirements where applicable. Data subject to those restrictions is not used or transferred for prohibited advertising, resale, creditworthiness or other unrelated purposes; permitted customer-directed advertising-account management is governed by the applicable advertising API's permissions and terms.
You can revoke access through your Google account security permissions and request deletion from Khep at privacy@khep.io. Deleting Khep-held data does not delete information held independently by YouTube.
For YouTube API data, user-requested deletion and revocation through Khep are handled as soon as possible and within seven calendar days; revocation through Google's settings is handled within the applicable YouTube deadline, no later than 30 calendar days. Other stored API data must be refreshed or deleted when required by the relevant data category, and authorisation must be rechecked where the policy requires it (YouTube Developer Policies).
Who receives information
We disclose information where necessary to provide the requested service, carry out instructions, protect the service or meet a legal obligation. Access is limited according to the purpose and role concerned, rather than sharing every customer's complete workspace with every provider.
For LinkedIn API data, the LinkedIn section’s category-specific use and transfer restrictions govern every recipient listed here; listing a provider is not permission to send it member data.
- Your organisation and authorised collaborators: workspace owners, administrators and assigned team members can access information within their permissions. An agency may manage information for its client, subject to their agreement and instructions.
- Connected social and advertising platforms: LinkedIn, Meta services including Facebook and Instagram, TikTok, Google and YouTube receive content, settings and other information needed for the actions you authorise.
- Infrastructure and operational providers: hosting, authentication, storage, databases, delivery, security and communications providers receive information needed to operate the service. Vercel provides hosting, and Lovable provides the analytics described below.
- AI and automation providers: relevant features can involve Anthropic, OpenAI, Runway, Exa, ElevenLabs and Browserbase. The information disclosed depends on the function, for example text or document excerpts for analysis, media for generation, public-research queries, or session data for an authorised browser task.
- Payment providers: Stripe handles payments, payment-method information, fraud controls and associated transaction processing.
- Professional advisers and authorities: advisers, auditors, insurers, courts, regulators and public authorities may receive information where necessary and lawful.
- Business transactions: information may be disclosed in a proposed or completed reorganisation, investment, merger or asset transfer, subject to appropriate confidentiality, purpose limitations and any additional notice or consent required by law or platform rules.
Service providers acting on our behalf must process personal data within the applicable contractual arrangements. Some providers also act as independent controllers for particular activities, such as their own security, legal compliance or account administration; Vercel and Stripe describe role distinctions in their respective terms (Vercel DPA, Stripe Privacy Policy).
Rendering software such as Remotion is not, merely by being installed, a separate recipient of all rendered content. Hosting or rendering-infrastructure operators may nevertheless process the relevant media where those operations run on their systems.
We do not sell private customer files or conversations to data brokers. Sending campaign content or authorised audience information to an advertising platform for a customer's campaign is a distinct activity and remains subject to that customer's instructions, applicable law and platform restrictions.
You may request information about the providers relevant to your workspace and our data processing arrangements by emailing privacy@khep.io. Where we act as a processor, changes to subprocessors are governed by the applicable data processing terms and authorisation process.
Website analytics, cookies and similar technologies
Lovable Analytics
We use Lovable Analytics to understand visits, page views, traffic sources, device categories, approximate country-level distribution and general engagement with the website. Lovable describes the analytics for published apps as using no cookies or browser storage, assigning a temporary random identifier to a visit and discarding that identifier when the visit ends, without following a visitor across separate visits (Lovable Analytics documentation).
Lovable states that it processes published-app usage information on the app operator's behalf for analytics and recommendations and may create de-identified information for service improvement and comparative insights. This published-app measurement is distinct from the analytics and cookies Lovable uses on its own developer-facing website (Lovable Privacy Policy).
“Cookieless” does not mean that no personal data are processed at any stage. Technical information needed to deliver a request, security records and other service components must be considered separately from the aggregate analytics reports.
We use these statistics to understand and improve Khep, not to describe visits as identified individuals. Where the law requires consent or a particular objection mechanism for a technology or use, that requirement applies regardless of the product label.
Essential technologies and other tracking
Authentication, account security, session continuity, payment operations and selected preferences may use cookies or similar technologies where necessary for the requested service. Where we introduce optional analytics, advertising pixels or other non-essential technologies requiring consent, they must not operate before the required choice has been made.
You can manage browser storage through your browser, although blocking necessary technologies may affect login or other requested functions. You may contact privacy@khep.io to object to processing based on legitimate interests or ask about the technologies in use; accepting this Policy or continuing to browse is not, by itself, consent to optional tracking.
The applicable UK rules contain specific exceptions with conditions, rather than a blanket exemption for all analytics. For example, the statistical-purpose exception requires the relevant conditions and a simple, free means of objection; advertising and individual tracking are not covered merely by calling them analytics (ICO storage-and-access guidance).
Web fonts and third-party content
Where a page loads fonts through Google Fonts, the browser sends a request to Google that includes technical information such as an IP address, requested resource, browser headers and referring page. Google states that its Fonts API does not set or log cookies and does not use the information to build end-user profiles or for targeted advertising (Google Fonts privacy information).
Other embedded content or links may connect you to a third party under its own privacy information. A link to a social platform does not, by itself, mean that Khep has permission to access your account there.
International processing and transfers
ODREN LTD is established in the United Kingdom, and our provider arrangements may involve processing outside the country where you live. Relevant providers include businesses in the United States and Sweden, and their infrastructure or subprocessors may operate in further locations; Vercel and Lovable describe international processing in their respective documentation (Vercel DPA, Lovable Privacy Policy).
Choosing a European hosting region does not, by itself, establish that every log, support operation, AI request or onward transfer remains in Europe. The locations and safeguards for the actual services involved must be considered separately.
For transfers subject to restrictions, we use the transfer mechanism required for the relevant route, such as an applicable adequacy decision or appropriate contractual safeguards. These may include EU Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, and appropriate Swiss adaptations, together with the assessments and supplementary measures required for the circumstances (EU GDPR, Chapter V, ICO transfer safeguards).
You can ask privacy@khep.io for information about the destination countries and safeguards relevant to your data, including a copy of applicable safeguards subject to necessary redactions. Agreement to this Policy is not treated as a general consent to all international transfers.
Where Swiss law applies, the required information includes the destination countries and the relevant protection or safeguards, not simply the statement that data may go “abroad”. The applicable customer information and transfer records must reflect that requirement (FDPIC guidance).
How long information is kept
We retain personal data for the purpose for which it was collected and for applicable legal, security or contractual requirements. We consider the type and sensitivity of information, whether the service or task remains active, customer instructions, unresolved issues and any binding platform-specific deletion rules.
For LinkedIn API data, the shorter category-specific limits and deletion obligations in the LinkedIn section govern this table, backups, service closure and any export. A general backup cycle or preservation practice cannot extend those deadlines.
| Information | Retention period or determining criteria |
|---|---|
| Account and workspace administration | For the active relationship and the time needed to complete closure, resolve outstanding matters and retain required evidence. Ongoing billing records are separated from content that no longer needs to be kept. |
| Uploaded files, knowledge-base passages and derived retrieval records | For the customer's authorised use, until a valid deletion instruction or the applicable end-of-service deletion process, subject to the agreed data processing terms and any lawful preservation requirement. |
| Social content, comments and permitted messages | Only for the authorised handling, reporting or retention purpose; customer instructions and platform-specific expiry, refresh and deletion rules may require earlier deletion. |
| Browser access and session material | While needed for the authorised connection and task; access must be disabled and relevant session material removed when the connection is withdrawn or no longer authorised. |
| AI prompts, outputs and operational records | For the requested workflow, troubleshooting, security and justified evidence of the operation; providers may have separate service, abuse-prevention or legal-retention periods under the applicable terms. |
| Support and privacy requests | For handling the request, verifying its resolution and keeping proportionate evidence of the response or any continuing dispute. |
| Security and diagnostic logs | For the limited period needed to detect or investigate incidents, maintain reliability and protect legal rights; longer retention is restricted to a justified incident or preservation need. |
| Accounting, tax and invoice records | Normally six years from the end of the last company financial year to which they relate, and longer where a specific tax, investigation or other legal requirement applies (UK government guidance). |
| Unused AI credit and related ledger records | Minimum information needed to recognise the remaining balance and administer it, together with applicable accounting requirements; this does not justify keeping unrelated files or conversations indefinitely. |
Customer-content retention is also governed by the relevant data processing terms. You may ask privacy@khep.io for the retention arrangements applicable to a particular workspace or category of data.
For LinkedIn API data, the shorter category-specific limits and deletion obligations in the LinkedIn section govern this table, backups, service closure and any export. A general backup cycle or preservation practice cannot extend those deadlines.
Where we must preserve particular records for a legal duty, dispute or security incident, we restrict their use to that purpose. Platform rules, including the YouTube deadlines stated above, take precedence over a longer general retention practice for the data they govern.
For LinkedIn API data, the shorter category-specific limits and deletion obligations in the LinkedIn section govern this table, backups, service closure and any export. A general backup cycle or preservation practice cannot extend those deadlines.
Security and confidentiality
We apply technical and organisational measures proportionate to the information and processing involved. These include controls over account access, workspace permissions, sensitive connection material, service-provider access and the handling of incidents.
No online service can guarantee absolute security. Customers should use appropriate authentication controls, keep authorised-user access current, avoid uploading unnecessary sensitive information and notify us promptly if they suspect misuse.
Access by personnel is limited to authorised service, support, security or legal purposes. Information received through a platform with additional human-access restrictions must also be handled within those restrictions.
We assess suspected personal data breaches and, where required, notify the relevant customer, supervisory authority or affected individuals. The applicable notification duty and timing depend on our role and the circumstances; this Policy does not replace the incident provisions of a customer's data processing agreement.
Your rights and choices
Depending on applicable law and the processing concerned, you may be entitled to exercise the following rights. These rights are not absolute, and we will explain any lawful restriction or refusal rather than treating a request as automatically ineffective.
- Access: obtain confirmation of processing, a copy of your personal data and relevant information about its use.
- Correction: ask us to correct inaccurate or incomplete information.
- Deletion: ask for erasure where the relevant conditions apply.
- Restriction: ask us to limit processing in specified circumstances.
- Portability: obtain certain data in a structured, commonly used, machine-readable format or have them transferred where the right applies.
- Objection: object to processing based on legitimate interests on grounds relating to your situation.
- Direct marketing: object at any time to direct marketing, including profiling related to that marketing; we will stop that use.
- Withdrawal of consent: withdraw consent for future processing based on it, without affecting prior lawful processing.
- Automated decisions: seek information and the applicable safeguards, including human review where required, for a solely automated decision with the relevant significant effects.
For rights relating to ODREN LTD's own processing, email privacy@khep.io and explain the request. We may ask for proportionate information to confirm identity or authority, but will not request more identification than is reasonably necessary.
For UK and EU GDPR requests, we normally respond within one month, subject to applicable extensions or other legally permitted adjustments, and explain any such adjustment. Swiss access requests are generally answered within 30 days under the applicable rules (EU GDPR, Article 12, FDPIC rights guidance).
These privacy-request response periods are distinct from LinkedIn’s deletion deadlines. A longer period to answer a request does not postpone deletion required earlier by the platform.
Requests concerning customer-controlled content may need to be handled by the relevant business or agency. We assist that controller and can explain how to route the request without disclosing another customer's information.
Complaints
Please contact us if you are concerned about how personal data are handled; we will investigate and respond. You do not have to give up your right to contact a supervisory authority.
In the United Kingdom you can contact the Information Commissioner's Office. Where the EU GDPR applies, you may complain to a competent supervisory authority, including in your habitual residence, place of work or place of the alleged infringement; in Switzerland, you may contact the Federal Data Protection and Information Commissioner.
Children and sensitive uses
Khep is a business service intended for adult account holders and is not directed at children. This does not mean that a customer's public comments or messages could never contain information about a child.
Customers must apply the notices, permissions and safeguards appropriate to the people whose data they process and should not use Khep to infer sensitive traits or target children inappropriately. If we become aware of information processed outside an authorised or lawful use, we will assess appropriate steps with the relevant controller.
Required information and consequences of not providing it
Some information is needed to establish an account, authenticate access, provide a requested feature or comply with billing requirements. If you do not provide that information or the required platform permission, the relevant account or feature may not be available.
Other information, such as optional marketing preferences or additional brand materials, is voluntary. Refusing optional marketing consent does not, by itself, prevent you from using a service for which that consent is not necessary.
Changes to this Policy
We may update this Policy when the service, providers, processing activities or applicable requirements change. We will update the date and provide additional notice or obtain a new choice where required before a materially different use begins.
The latest approved version should be available through the website's legal section and the application's relevant privacy notices. Questions about this Policy or your information can be sent to privacy@khep.io.