Privacy policy

1Data controller

2Who this policy applies to

It covers every place where Karma Studio processes personal data:

• The public website karma.studio, its forms, the website chat and the WhatsApp button.
• Our Instagram and Facebook accounts: when you comment on our posts, mention us or send us a direct message.
• The client panel (app.karma.studio) and the team panel (admin.karma.studio): the platform from which the contracted services are managed.
• The «Karma» mobile app for iPhone and Android, in both modes: customer of a business and business owner.
• Our clients' websites where our connector runs (chat, forms, shop, pixel): there the business is the controller and Karma Studio acts on its behalf, as explained in section 9.

3What data we process

Only what each use requires. By group:

4What we use your data for

We process your data only for the purposes listed below. We do not use it for anything else without telling you first.

• Deliver the services you contracted (SEO, advertising, social media, website and invoicing) and give you access to your panel.
• Manage the contractual relationship: quotes, contracts, invoices, payments and support.
• Answer enquiries you send us by form, email or WhatsApp.
• Send you information about your services and, with your consent, commercial information. You can unsubscribe at any time.
• Run the chat and the CRM: deliver messages between each business and its customers, show the history and notify when a new message arrives.
• Send you notifications on your phone or browser only if you turn them on, and stop as soon as you turn them off.
• Give you temporary access to the panel demo when you request it: we send you a personal link by email and WhatsApp, let you know if it does not arrive and before it expires, and log your entries so nobody else uses your access.
• Knowing whether the notices we email to our customers are opened and clicked (a pixel and links that go through karma.studio), to improve what we send. Never in invoices, passwords or appointment notices, and never in emails to people who ask us for something without being customers (the audit, the report, the demo or the newsletter): those are only counted as sent.
• When you write a word in a comment on one of our Instagram posts: reply to you publicly and by direct message with what you asked for (for example, a guide), send you a reminder if you do not reply, add you as a potential client and, if you give us your email or your phone number, use them for what we told you when we asked for them and to find out whether you end up contracting any of our services. If you write to us about something else, our artificial intelligence assistant or a person from our team may reply. If you reply BAJA or STOP to our automatic messages, we stop sending you automatic direct messages. We also count how many times the files we send are opened, without cookies and without recording who opens them; to avoid counting the same opening twice we use your IP address, mixed with a key that changes every day, for half an hour at most and without storing it.

5Legal basis

Each processing activity relies on one of these bases:

• Performance of a contract: delivering and managing the contracted services.
• Consent: commercial communications, non-essential cookies and connecting your third-party accounts.
• Legitimate interest: security of our systems and improvement of the services.
• Legal obligation: retention of invoices and of tax and accounting records.
• Your request: sending you the demo access and its notices. The entry log relies on our legitimate interest in keeping the demo secure.
• Your request: replying to you with what you ask for when you comment on Instagram. Our legitimate interest in handling and measuring how we attract clients: adding you as a potential client, the reminder, checking whether you follow us, finding out whether you end up contracting and counting how many times the files are opened. You can object at any time (section 13).

6The client panel

The panel (app.karma.studio) is the platform we deliver the services from. When you use it we process:

• Your account and your business: identification, logins, business profile, contracts and subscriptions. The password is stored encrypted and is never displayed.
• Billing: quotes, invoices and payments. Payments are processed by Stripe; we never see or store your full card number. If you have contracted VeriFactu invoicing, your invoice records are sent to the Spanish Tax Agency as required by law.
• Connected accounts: the permissions you grant us over your Google, Meta, LinkedIn or WordPress accounts (detailed in section 14). Tokens are stored encrypted and deleted when you disconnect.
• Your CRM and your chat: your customers' contacts, conversations and leads arriving via WhatsApp, Messenger, Instagram, your website chat, forms or your campaigns. You are the controller of that data; we store and process it on your behalf.
• Activity logs: what has been done in your panel, when and from where, for support and security.

7The «Karma» mobile app

The app is available for iPhone and Android and has two modes: «I'm a customer of a business», to follow your conversations with businesses that use Karma, and «I have my business on Karma», to handle your inbox. What you need to know:

• Data: in customer mode, your email (verified with a one-time code), your name, your phone if you provide it, and the messages. In owner mode, the same data as in your panel. We ask for nothing else.
• Notifications: if you turn them on, the device generates a notification identifier (Expo token) that we store to alert you of new messages. Alerts travel through Expo, Apple (APNs) and Google (Firebase); they only carry the sender's name and an excerpt of the message. You can turn them off in the app's or the system's Settings, and we then delete the identifier.
• Permissions: the app only asks for the notifications permission. It does not access your location, contacts, camera, microphone or photos, does not use advertising identifiers, and contains no ads or third-party trackers.
• On your device: the app keeps your session in the system's secure storage and a local copy of the messages you have already seen, so they open offline. They are deleted when you sign out.
• Deleting your account: in customer mode you can delete your account from Settings › Privacy and data. Your account, your devices and your contact details are erased; the businesses you talked to keep the conversation without your name or email, because the history belongs to them. A business account is cancelled from the panel or by writing to us, subject to the retention periods in section 11.
• The app and the panel are not aimed at children under 14 and we do not knowingly collect data from minors. If you believe a minor has given us their data, write to us and we will delete it.

8Artificial intelligence

Part of the work is done by artificial-intelligence systems we run with external providers (Anthropic, Google and, for the chat assistant, Scaleway): writing content for your website and social media, proposing adjustments to your campaigns, helping answer enquiries and classifying messages. These providers act as processors, do not use your data to train their models, and only receive what is strictly necessary for each task. Decisions that affect your money (publishing, changing a budget, replying on your behalf) are reviewed by a person or approved by you from the panel; the chat assistant only replies for you if you switch it on.

9When we process data on behalf of a client

If you write to a business through its website (chat, form, order, booking) or its ads, the controller of your data is that business. Karma Studio receives, stores and processes it following its instructions, as a processor (Article 28 GDPR), under the data-processing agreement signed with each client. We do not use it for our own purposes or share it between businesses.

To exercise your rights over that data, contact the business you talked to; if you write to us, we will forward your request and help them handle it.

10Who helps us deliver the service

We only share data with providers that work on our behalf, under contract and only for the purpose stated. This is the complete list, which is also the list of sub-processors for our clients:

• Clouding.io · Spain
  Servers for the platform, the websites we host and email
• Scaleway · France
  Backups and the chat AI assistant (the messages of our clients and of anyone who writes to us)
• Stripe · EU and USA
  Subscription billing and payments; we never see your card
• Meta · Ireland and USA
  WhatsApp, Messenger, Instagram, pages and ads we manage for you. If you accept advertising: the website pixel and its Conversions API (hashed email and name, IP, browser and its cookie identifiers) when you leave us your details or sign up
• Google · Ireland and USA
  Services you connect (section 14) and Google Ads. If you accept analytics, Google Analytics measures your visit and may receive the hashed email and phone you type in our forms; if you also accept advertising, Google Ads measures whether our ads work. Gemini (AI) and Firebase (app notifications)
• Anthropic · USA
  Artificial intelligence: drafting and reviewing content (section 8)
• Kie.ai · USA
  Generating the images and videos for posts. It only receives presenter photos if you upload them to create one
• OpenProvider · Netherlands
  Registering and renewing domains in your name (registrant data)
• Expo and Apple · USA
  Delivering mobile app notifications
• Sentry · USA
  Logging technical errors on the platform
• Spanish Tax Agency (AEAT) · Spain
  VeriFactu invoicing records, as required by law

Providers outside the European Economic Area receive data with the safeguards required by the GDPR: the EU-US Data Privacy Framework when the provider is certified or, failing that, the standard contractual clauses approved by the European Commission. You can ask us for a copy of those safeguards. We do not sell personal data to anyone.

11How long we keep it

We keep your data for as long as the contractual relationship lasts and then, blocked, for the legal periods: six years for commercial and accounting records (Commercial Code) and four years for tax records (General Tax Law). If you write to us (form, audit, report, chat or WhatsApp) and do not become a client, we keep your data to handle your enquiry and stay in touch with you, until you ask us to delete it. If you comment on our Instagram posts and do not become a client, we keep your record and the conversation until you ask us to delete them; if you reply BAJA, we keep a record of the opt-out so that we do not write to you again. Your newsletter subscription lasts until you unsubscribe; after that we only keep your email on the unsubscribe list, so we never write to you again. If you request the demo and do not become a client, we delete your data after 12 months, and the demo access log after 90 days. Client-mode app accounts are deleted as soon as you delete them; notification identifiers, as soon as you turn notifications off.

12Security

We apply technical and organisational measures to protect your data: encryption in transit (HTTPS), role-based access control, encrypted passwords, regular backups and activity logging. Access tokens for your third-party accounts and the platform's keys are stored encrypted and never displayed in the panel. In the app, the session lives in the operating system's secure storage.

13Your rights

You may exercise the following rights at any time, free of charge and without giving reasons:

To exercise them, tell us which right you want to exercise and we will reply within one month at the latest. If you feel your request has not been properly handled, you can complain to the Spanish Data Protection Agency (www.aepd.es). Write to us at administracion@karma.studio

14Connections to third-party services

Karma Studio works on your behalf inside platforms that belong to you. To do that we ask for specific permissions, always with your explicit authorisation and only the minimum each contracted service needs. Below is every permission, exactly what we do with it, and how to revoke it whenever you want.

Google / YouTube

• youtube.upload — upload the vertical videos we produce for you to your channel. We do not read, modify or delete any other video on your channel.
• youtube.readonly — read your channel name and ID, only to show you which channel we are publishing to.
• webmasters — read in Search Console which searches people find you with and where you rank, to guide the SEO work.
• analytics.readonly, analytics.edit — read your website traffic and, if you do not have one yet, create your Google Analytics 4 property and data stream.
• business.manage — manage your Google Business Profile: post updates, reply to reviews and read its insights.
• adwords — read and manage your Google Ads campaigns if you have that service contracted.
• indexing, siteverification — notify Google about new pages on your site and verify that the domain is yours.
• calendar.app.created, calendar.freebusy — create and read only the events Karma Studio generates. We do not access the rest of your calendar.
• openid, userinfo.email, userinfo.profile — identify you when linking the account (your name and email). Not used for anything else.

Karma Studio's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. By connecting your YouTube account you also agree to the YouTube Terms of Service.

• Google Privacy Policy
• YouTube Terms of Service

You can revoke Karma Studio's access to your Google account at any time, without giving reasons and without losing your data, from these Google pages:

• https://myaccount.google.com/permissions
• https://security.google.com/settings/security/permissions

Meta (Facebook, Instagram y Threads)

• pages_show_list, pages_read_engagement — see the list of pages you manage and read their insights.
• pages_manage_posts — publish the posts we prepare on the page you choose.
• instagram_basic, instagram_manage_insights — see your Instagram professional account and read the insights of what has been published.
• instagram_content_publish — publish the content we prepare on your Instagram.
• pages_messaging, pages_manage_metadata — receive in your panel inbox the messages people send to the page you connect for the chat, and send the replies written by you, your team or your assistant if you have it switched on. Only while the channel is active, within the 24 hours Meta allows (after that, only a person on your team, never the assistant, may reply for up to 7 days, where Meta authorises it), and never to anyone who has not written to you first. The second permission is used only to subscribe that page to notifications of new messages (and, if you have contracted ads, of the contacts from your forms).
• instagram_manage_messages — the same for direct messages to the Instagram professional account linked to that page: you receive them in the inbox and reply from there. With this permission we do not read comments, followers or posts.
• pages_manage_engagement, pages_read_user_content, instagram_manage_comments — read the comments people leave on the posts of the page and the Instagram account you connect, reply to them publicly, send one private reply to the person who commented (one per comment, within the time Meta allows) and hide the ones you decide, following the rules you set up in your dashboard. We do not post comments on your behalf outside those rules or read comments on other pages.
• threads_basic, threads_content_publish — see your Threads profile and publish the content we prepare on it.

You can remove Karma Studio at any time from Facebook (Settings › Business integrations) or from Instagram (Settings › Apps and websites). When you do, Meta notifies us and we immediately disconnect everything you authorised (social media, messages and ads) and delete its access tokens. If you ask Meta to delete your data, you get a code and a page where you can check it has been done. Messages and comments already in the business inbox belong to the business; to delete them, write to administracion@karma.studio.

LinkedIn

• w_member_social — publish the content we prepare on your LinkedIn.
• openid, profile, email — identify you when connecting the account.