What Kleo knows
about you.
Last updated
Kleo is run by Leonardo Tonon from New Zealand. This notice covers kleooai.com, the Kleo server and its assistant integrations.
Connecting does not require an email or password. Kleo receives the requests your assistant sends to it, the images you choose to supply, and the information needed to render videos and manage credits. Buying credits, adding the optional email on your account page or contacting support can also provide your email.
The public website sets no cookies and has no advertising and no third-party analytics. It counts its own page views without cookies or identifiers, as described below. The account service uses an essential sign-in cookie. The Kleo app also keeps one short-lived cookie that remembers where your first visit came from, as described below.
What Kleo collects, and what for
- Account and connection: your account identifier, credit balance, timestamps, the signed account cookie and OAuth permissions. Kleo uses these to recognise your account and to authorise your assistant.
- Your creative request: your prompts and requirements, treatments, storyboards, narration choices, reference pictures and generated descriptions. These are used to plan and make what you ask for.
- Render records: progress, outputs, errors, credit charges and refunds. These let Kleo deliver your files, control usage and sort out problems.
- Payment records: Stripe transaction identifiers, amount, currency, status, purchased credits and the checkout email and country when provided. For a plan, also the Stripe customer and subscription identifiers, the plan, its billing period and monthly credits, the date it is paid up to, whether it is active or cancelled, and when its next credits are due, to renew the plan, add its credits and handle a cancellation. Stripe processes card and wallet payments (Apple Pay, Google Pay); Kleo does not receive the full card number.
- Support: whatever messages and contact details you choose to send us. We use them to answer you and to handle complaints.
- Where you came from: the channel in the server address you connected with (for example
?src=producthunton the MCP address), the launch code you redeem, and the referral link an account was created through, to learn which launch channels work and to credit referral bonuses. In the Kleo app (app.kleooai.com), where your first visit came from: the network or site, the tags in the link (utm_source,utm_medium,utm_campaign,utm_contentorsrc), the code of a Kleo short link, the host of the referring site (never the full address), the first page you opened (without its query) and the name of the app whose built-in browser you used, such as Instagram or TikTok. When a visit has no tag and no referring site, the network is guessed from that name. This is stored with your account when you open one, to learn which posts and links bring people to Kleo. None of this is shown to other users. - Email: the address of your account (the one you sign up or sign in with, or add on your account page) and whether you confirmed it, to send your welcome e-mails and your video links, together with a record of each e-mail sent and whether you unsubscribed.
- Business contacts: for businesses whose work is short-form video, the business address they publish on their own website, the business's name, website, city and country, the page where the address appears, and any reply, to send a short business introduction and to stop at the first answer.
- Security: the application uses a keyed fingerprint of the connecting IP address for account-creation limits. When you sign up, sign in, connect an assistant or open a payment in the Kleo app, it also records the IP address, the approximate place your connection provider reports for it (country, region, city), the network and the browser name, to prevent fraud and abuse; these records are deleted after 90 days. Hosting and network providers necessarily process connection information, and may keep their own security logs.
Kleo gets only what is sent to its tools or service, and has no open access to your whole ChatGPT or other assistant history. A tool request may carry text or images from the conversation. Leave out sensitive information your video does not need, and supply pictures of, or information about, other people only when you have the right to.
The choices you have
It is up to you whether to connect an assistant, supply references, buy credits or contact support. Kleo cannot render a video or allocate its credits without the request and account information involved. References are optional. Check the treatment, the product and the quoted credits before you authorise a render.
You can disconnect Kleo in your assistant's settings. That ends the connection, but on its own it does not delete your account, your payment records or your stored content.
Your account and its cookies
To remember your signed account identifier, the server uses an essential cookie named kleo_id, which lasts up to about 400 days. An anonymous account may hold an internal placeholder email ending in @anon.kleo.invalid, which is not a contact address.
Opening a friend's referral link (mcp.kleooai.com/r/…) sets a second cookie on the server, kleo_ref, holding only that referral code. It lasts 30 days, is read once when an account is created, to link the new account to the friend who invited it and credit the referral bonus, and is set only when a referral link is opened.
The Kleo app (app.kleooai.com) sets a cookie called __Host-kleo_src on the first page you open there, or when you open one of Kleo's short links (app.kleooai.com/r/…). It holds only where that visit came from, as listed under Where you came from, and no identifier. It lasts 7 days, is read once when you open an account, is stored with that account, and is then deleted. It is not set when you are already signed in, or when your browser signals Do Not Track or Global Privacy Control. The app also counts first visits and short-link clicks per day, network and link; these counts are totals with no cookie value, IP address or identifier in them, and are never linked to an account.
Your private Kleo key restores access from another browser, and whoever holds it can use your account and spend its credits. So keep it private, and never paste it into a public conversation or a support message. If you clear the cookie and no longer have your key, the account can become inaccessible.
Page counts on kleooai.com
The website counts its own visits. On each page view, the site’s script sends Kleo’s server the page path, the host of the referring site (for example news.ycombinator.com, never the full address), the source named in the link (utm_source or ref) and the browser’s language; the server adds the country from its hosting provider’s connection header. These are stored only as totals per day, page, referring host, source and country.
No cookie is set, no identifier is created, the IP address is not stored, and a count is never linked to an account. The script sends nothing when your browser signals Do Not Track or Global Privacy Control, or when JavaScript is off.
Welcome e-mails. Kleo writes to the address of your account from hello@kleooai.com: one short e-mail a day in your first week, with what Kleo does and how to get a good first video, and a note if a first video failed. An account opened before these e-mails began may get one or two notes instead. They go out only between 9:00 and 20:00 where you signed in from. Every one has an unsubscribe link, and the unsubscribe button your mail app shows; one click stops them for good, and nothing else about your account changes. An address that bounces is not written to again.
Business introductions. Kleo sends a short e-mail, with at most two follow-ups, to businesses whose work is short-form video, at the business address they publish on their own website, in the United States, Canada, the United Kingdom, Australia and New Zealand. These come from a separate Kleo mailbox, which is also where Kleo reads the replies, so that it stops writing at the first answer. To be removed, reply "no", use the link in the e-mail, or write to hello@kleooai.com.
Kleo keeps a stop list of the addresses that unsubscribed, said no or bounced, and never writes to them again, from any part of Kleo.
How long we keep information
| Information | How long |
|---|---|
| Rendered files and their download links | 7 days. A scheduled cleanup then removes expired files, so download what you want to keep. |
| Reference pictures you upload or link | 30 days after they were last used, then a scheduled cleanup removes them. Using a reference again restarts the 30 days. |
| Links that authorise an upload | Valid for 48 hours. Pictures uploaded through them follow the reference-picture period above. |
| Account, prompts, storyboards and activity records | Kept with the account in the current service, and not subject to the 7-day limit on outputs. To ask for access, correction or deletion, use the contact below. |
| IP address and approximate place of sign-ins and payments in the app | 90 days, then deleted automatically. |
| Your account's email address and the record of e-mails sent | With the account until you remove it or ask for deletion. Unsubscribing stops the e-mails at once. |
| Business contacts and replies to introductions | Kept with Kleo's outreach records; ask for their deletion at any time. An address that said no stays only on the stop list. |
| Stop list (unsubscribed, declined and bounced addresses) | Kept so that the address is never written to again. Write to us if you want to hear from Kleo again. |
| Where an account came from (first visit) | With the account, and deleted with it. The cookie itself lasts at most 7 days. |
| Daily page counts, first-visit counts and short-link clicks | Kept as aggregated totals, which contain no personal information. |
| Payment, support and security records | For as long as the transaction, support, fraud prevention and applicable legal record-keeping obligations need them. Records that must be kept may remain after you ask for your account to be deleted. |
Who handles information for us
- Cloudflare: server hosting, account data, storage, security, and AI planning, picture checks and image processing.
- Vast.ai and its compute providers: run the render on rented machines, which receive what the job needs.
- ePhone AI (PULSE AI SINGAPORE PTE. LTD., Singapore): the AI model gateway that receives the requests for pictures, video clips and music — prompts, reference pictures and frames — and routes them to the model providers below. Both films and animatics use its picture generation; an animatic does not order moving clips.
- Google (Nano Banana Pro), ByteDance (Seedance 2.5) and Suno: through ePhone AI, Google generates the pictures and character sheets, ByteDance the moving footage of a film, and Suno the music track when you ask for one.
- GitHub Pages: hosts the public website and handles the connection requests that come with it.
- Stripe: handles checkout, payment processing, fraud prevention and payment records.
- PayPal: only when you choose PayPal at checkout, to complete that payment in your PayPal account.
- Cloudflare Email Service: sending Kleo's e-mails from kleooai.com: the welcome e-mails, confirmations and video links. Workers AI, also Cloudflare's, sorts the replies to business introductions.
- Google Workspace: the separate mailbox that sends business introductions and receives their replies.
- The assistant provider you choose, including OpenAI for ChatGPT: handles your conversation, tool requests and results under its own terms and privacy notice.
- Google Fonts: supplies the fonts on some pages, so Google's servers receive ordinary browser connection information. The homepage's fonts come from Kleo's own site.
These providers may process data outside New Zealand, depending on where they host and what compute is available for a job. Their own privacy terms also apply to their services. If you need to know about a particular provider or about overseas processing before you submit content, contact us.
Kleo does not sell your personal information or use your prompts and videos to train its own models. External AI and assistant providers process information under their own policies; this is not a promise about every provider's retention or model-training practices.
Your rights: access, correction, deletion, complaints
For privacy requests, write to hello@kleooai.com for access to your personal information, correction, a deletion request or a privacy complaint.
Quote your account number, video number or transaction reference, and never your private Kleo key. We may need to check that the account is yours before we disclose or delete anything. Deleting can end your access to content and credits, and applicable consumer and record-keeping rights stay in force.
New Zealand's Privacy Act 2020 gives you rights. If we cannot settle your concern, you can go to the New Zealand Office of the Privacy Commissioner. Other mandatory rights may apply where you live.
When this notice changes
The date at the top marks this version, and we update the notice when the service or its handling of data changes. Operator details are in the legal notice, and use of the service is covered by the Terms.