Privacy · Effective July 2, 2026
What we collect, what we never collect, who sees what, and how to ask us to change or delete it.
Account information you give us (name, email, workspace role), workflow records the platform produces (productions, services, assignments, documents, announcements, acknowledgements, requests, holds, quotes, contracts, invoices, settlements, messages, audit-log entries), profile fields you publish, and operational logs needed to run the system (request IDs, timestamps, IP addresses on rate-limit checks). We collect what the platform needs to do its job — nothing extra.
We do not embed third-party advertising or tracking pixels in public pages or in your workspace, and we do not use advertising or tracking cookies. We do use cookieless, aggregate performance and usage analytics from our hosting provider (Vercel Analytics and Speed Insights) to understand page performance and which pages are used — these do not use cookies, do not identify you across sites, and are not shared with ad networks. We do not collect device fingerprinting beyond what is necessary to detect abuse. We do not buy contact data and we do not enrich your records from external providers.
To run the workflow you signed up for — show you the right dashboards, deliver notifications, manage member access, record acknowledgements, calculate subscriptions or applicable commissions, and settle invoices. To protect the platform from fraud and abuse. To meet our own audit and compliance obligations. To respond when you ask us for help.
You and your workspace teammates. Members, substitutes, guest artists, agencies, presenters, and counterparties see only what is needed for their role, assignment, production, document rule, or engagement. Internal notes stay inside your workspace; client-visible messages cross the boundary. Operations staff see what is needed to maintain the platform, under role-scoped access with audit.
Hosting and database providers, document storage, email delivery (Resend), durable background jobs (Inngest), bot protection on public forms (Cloudflare Turnstile), and operational monitoring tools, all contracted under standard data-processing terms. Where AI drafting assistance is enabled, the specific text being drafted is sent to a configured AI provider that does not train on your data; outputs are always a draft a person reviews. Payment processing, where it applies, runs through the established payment processor configured for your workspace — funds typically move bank-to-bank without Kalinklo holding them. The full, current sub-processor list lives on our /security page and in the downloadable DPA.
Strictly the cookies needed for authentication, language/preference persistence, and security (anti-CSRF). No advertising cookies. No third-party tracking cookies. Local-storage usage is limited to UI state for signed-in users.
Active workspace data is retained while your account is open. Audit log entries are retained for the period required by our obligations and to support dispute resolution. On account closure you have thirty days to export; after that, personally identifying fields are anonymised and only minimum audit-trail records remain.
Access, correction, export, and deletion are available to you. Signed-in users can self-serve the two most common requests directly from account settings (Settings > Your data): "Download my data" returns a complete machine-readable export of what we hold about your account, and "Delete my account" permanently anonymises your personal data. EU/UK residents have the rights granted by the GDPR; California residents have the rights granted by the CCPA. For correction or any request you cannot complete in-app, write to the office via /help - we acknowledge receipt promptly and complete the request within the period required by the applicable law.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising - there is nothing to opt out of because we never do it. We have not sold or shared personal information in the preceding twelve months, and we do not sell or share the personal information of minors. California residents (and residents of states with equivalent laws) retain the right to know, delete, correct, and to limit the use of sensitive personal information; exercise these via the in-app "Your data" controls or by writing to us via /help. We will not discriminate against you for exercising any privacy right.
Some processors operate outside your jurisdiction. Where international transfer is required, we rely on standard contractual clauses or equivalent safeguards as appropriate. If you have specific transfer concerns, raise them when applying and we will address them in the agreement.
Kalinklo Ltd, Hong Kong. Privacy enquiries: via /help, addressed to the privacy office. We acknowledge formal requests promptly; we will not commit to a fixed response window during the charter beyond what the applicable law requires.
Exercise a right
To exercise any of these, write to the office via the help centre. See also the terms of use and security practices.