Privacy Policy

Who we are

Kallydo is operated by TURING SOFTWARE SOLUTIONS, SSM Reg. No. 202603059778 (TR0338455-P), a business registered in Malaysia. For the personal data described in this policy, we are the data controller — the party that decides why and how it is processed. You can reach us at hello@kallydo.com.

What we collect

Your account. When you sign in we receive your email address, your name, and (if you sign in with Google) your profile picture, from our authentication provider. We store your email and name so we can identify your account and contact you about the service. We never receive or store your Google password.

Your content. The whiteboards, pages, folders and documents you create are stored so they sync across your devices. We treat this as yours: we do not read it, sell it, share it, or use it to train machine-learning models.

Your subscription. If you start a free trial or subscribe, we store your subscription’s plan, status and dates, and the identifiers Creem assigns to your customer record and subscription, so the app knows what you have access to. Your card and billing details are collected by Creem on its own pages; Kallydo never sees your card number.

Operational records. We keep a log of changes to your own content (what changed, when) so that sync works correctly and so we can investigate problems. We also keep a record of each action taken on a subscription — a trial started, a plan changed, a cancellation, an email sent — so we can show you what happened if you ask. Our servers also produce ordinary technical logs, which may include IP addresses, for security and reliability.

Product analytics. We record which pages you visit, and a small, fixed set of events about how the app is used — a sign-in finishing, a document being created, a drawing session ending — so we can see where Kallydo is confusing or broken, and how people find us. Alongside each of these we record the address of the page, the site or link you arrived from, and your browser and device type. These events carry counts, categories and identifiers only. They never carry your drawing content, your document titles, or anything you type. Once you sign in, your events are associated with your account and your email address; nothing else about you is attached to them.

We do not use cookies for this. The identifier that ties your events together is kept in your browser’s local storage, and clearing your browser’s site data removes it. If your browser sends a Do Not Track or Global Privacy Control signal, we collect no analytics from it at all.

We do not run advertising, we do not sell personal data, and we do not use session-recording or screen-replay tools. Nothing we run records your canvas or plays your session back.

Why we process it

We process your data only where the law allows us to. For your account, content and subscription, the basis is our contract with you: storing and syncing your whiteboards is the service itself, and so is knowing what your account has access to. For technical logs and security measures, the basis is our legitimate interest in keeping the service safe and working. The same basis covers the product analytics described above: understanding how the app is used is how we improve it, and the events are deliberately narrow so that interest does not override yours. Where we are legally required to keep or disclose something, the basis is that legal obligation. Where we rely on your consent, you can withdraw it at any time.

Emails about your trial and subscription

We email you about the trial or subscription you started, because the emails are part of it: one when your 7-day free trial starts, a reminder 24 hours before it ends, on yearly plans a reminder 15 days and 7 days before each renewal, and a confirmation after each cancellation. Creem sends the receipts and any notice of a failed payment. We send no marketing email.

Where your data lives

Kallydo runs on Railway, with servers and databases in Singapore. Authentication is handled by WorkOS. Traffic is served through Cloudflare. Product analytics are processed by PostHog, in their European region. Error reports — what broke in the app, never your content — are processed by Honeybadger, also in their European region. The trial, renewal reminder and cancellation emails are sent through Resend. If you sign in with Google, Google handles that sign-in step. These providers process data on our behalf so the service can run. This means your personal data is stored and processed outside Malaysia — and possibly outside the country you live in.

Payments are different. Creem is our merchant of record: it is the seller of your subscription, not a processor acting on our behalf, and it collects your card and billing details on its own hosted pages under its own privacy policy. Kallydo stores your subscription’s plan, status and dates, and never sees a card number.

A copy of your content is also stored in your browser so the app works offline and loads quickly. Clearing your browser’s site data removes it.

How long we keep it

We keep your account and content while your account is open. Items you delete go to Trash and are permanently removed after 7 days. Product analytics events are kept for up to 12 months and then deleted. If you ask us to delete your account, we remove your account, its content and its subscription records from our live systems, and cancel any trial or subscription on it; residual copies may persist in encrypted backups for a short period before those backups expire.

Two kinds of billing record are kept longer, because tax and consumer law ask us to be able to show what happened: the record that a trial, renewal or cancellation email was sent is kept 7 years and survives account deletion; it holds no email address and no user id. Records of billing actions, which hold no email address, are kept 7 years and survive account deletion.

Your rights

You have the right to access the personal data we hold about you, to have it corrected, to receive a copy of it in a portable format, to object to or restrict certain processing, and to have it erased. You can withdraw consent at any time, and closing your account is always available to you. Email us at hello@kallydo.com and we will respond within 21 days.

If you are unhappy with how we handle your data, you can complain to the Personal Data Protection Commissioner in Malaysia (JPDP) or, depending on where you live, to your local data protection authority.

Security

Connections are encrypted in transit. Access to production systems is limited to people who need it. No service can promise perfect security, but if a breach affects your personal data we will notify you and the relevant authorities as required by law.

Children

Kallydo is for adults: you must be 18 or older to use it. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If we learn that an account belongs to someone under 18, we will close it and delete its data. If a teacher uses Kallydo to prepare lessons, we still only hold the teacher’s account data, not their students’.

Changes

If we change this policy we will update the date above, and for significant changes we will tell you by email or in the app before they take effect.

Contact

Questions about this policy: hello@kallydo.com.