Privacy Policy

Who we are

Kross is the personal information controller for the data described here, under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173). Our Data Protection Officer can be reached at support@kross.ph.

What we collect

• Account details from Google when you sign in: your name, email address and profile picture.
• Workspace and team data: workspace names, the people you invite (their email addresses) and what each person may do.
• Your content: captions, photos, videos and links you upload, schedules, review notes and team discussion on posts.
• Connected accounts: the access tokens or keys you give us for each social platform, and what the platform returns: post results, views, reactions, comments, shares and follower counts.
• Comments on your posts, pulled into Comments: the commenter’s public name, the comment and when it was made, so you can reply.
• Direct messages (Pro and Business), pulled into Messages: the sender’s name and handle, and the conversation, so you can reply.
• Billing records: plan, seats, invoices and the last four digits and brand of the card. Card numbers go to Lemon Squeezy and never reach us.
• Messages you send us through the contact form.
• Technical data needed to run the service, such as server logs with IP addresses and browser type.

Why we use it

• To provide Kross: sign you in, publish and schedule posts, show results and statistics, sync comments and send replies.
• To run the approval flow and notify the right people.
• To bill paid plans and keep invoices.
• To keep the service secure, fix problems and answer your messages.

Our legal bases are the contract with you (providing the service you signed up for), our legitimate interest in running and securing it, legal obligations (such as keeping tax records), and your consent where we ask for it.

We don’t sell personal information, we don’t show ads, and we don’t use your content or comments to train AI models.

AI replies

When you use Write with AI, test a reply, or turn on an AI auto-reply rule, we send the comment, the post’s caption, the commenter’s name and your reply tone to Anthropic, which writes the reply with its Claude models. Anthropic processes this to return the reply and doesn’t use it to train its models. Nothing is sent to an AI model unless you use one of these features.

Who we share it with

Only the service providers we need to run Kross, each bound to protect the data:

• Supabase: database, sign-in and media storage.
• Vercel: hosting the website and app.
• Lemon Squeezy: checkout, payments, tax and invoices (it acts as the seller of record).
• Google: sign-in.
• Anthropic: AI replies, as described above.
• The social platforms you connect: we send them the posts and replies you publish, and read back results, statistics and comments.

Some of these providers process data outside the Philippines. We share data with authorities only when the law requires it.

Google and YouTube data

Kross’s use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. When you connect YouTube, Kross also follows the YouTube Terms of Service and the Google Privacy Policy. You can remove Kross’s access at any time from your Google account permissions.

How long we keep it

• Photos and videos are deleted a set time after the post is published (up to 7 days on Free, 180 on Pro, 365 on Business, or sooner if you choose). Uploads that never become a post are deleted after a day.
• Posts, results and statistics are kept while your workspace exists.
• Comments are deleted a year after they were made, and conversations a year after their last message.
• When you disconnect a platform in Settings, its tokens, comments and messages are deleted straight away.
• Invoices are kept for as long as tax law requires, even after an account is closed.
• When you ask us to delete your account or workspace, we delete it within 30 days, except what the law requires us to keep.

Cookies

Kross uses only the cookies it needs to work: the sign-in session, the workspace you last opened, and where to return after sign-in. There are no advertising or tracking cookies. Page visits are counted with Vercel Web Analytics, which sets no cookies and doesn’t identify you.

Security

Data is encrypted in transit (HTTPS) and at rest. Platform tokens and keys are stored on the server only and never sent back to the browser. Access inside each workspace follows the permissions its admins set. If a breach affects your personal information, we’ll notify you and the National Privacy Commission as the law requires.

Your rights, and deleting your data

Under the Data Privacy Act you can ask to be informed, to access your data, to correct it, to object to its processing, to have it erased or blocked, to receive a copy (data portability), and to be compensated for damages. You can also complain to the National Privacy Commission (privacy.gov.ph).

To delete your data:

• Disconnect any platform in Settings to delete its tokens, comments and messages straight away.
• Delete posts and library files yourself at any time.
• Email support@kross.ph from the address you sign in with to delete your account, or (if you’re an admin) the whole workspace. We confirm when it’s done.

Comments and messages pulled from social platforms belong to the people who wrote them; they can ask us the same way to remove theirs from Kross.

Children

Kross is for businesses and isn’t meant for anyone under 18.

Changes

If we change this policy in a way that matters, we’ll tell workspace admins by email or in the app before it takes effect. The date at the top shows the latest version.

Contact

Questions or requests: support@kross.ph.