Privacy policy

• Your account: email, password (stored encrypted; we never see it) and app language.
• Your media kit: name, headline, bio, photo, city and country, languages, contact details, your networks and their numbers, audience, featured content, brands and rates. What you publish is visible on your public link and your PDF.
• Brand requests: when a brand writes to you through “Let's work together”, we store their name, company, email, budget, collaboration type, message and the replies you send from Kolab.
• Views of your kit: approximate country, the site the visit came from and an anonymous identifier that changes every day (a hash of IP and browser). We don't store IP addresses.
• Payments: your plan, billing cycle (monthly or yearly) and Lemon Squeezy customer and subscription IDs. We never see or store your card details.
• Pitch generator: how many pitches you used this month. The brand and product you type are used to write the message and aren't stored.
• Security: to prevent abuse we count requests by a hash of the IP (not the IP itself) and delete those counts the next day.

Read-only. Kolab never posts, comments, sends messages or changes anything on your accounts.

• Instagram (when you type an @): we use Meta's Instagram API Business Discovery feature, which only returns public data from Creator or Business accounts: username, name, profile picture, followers, post count and, for recent posts, likes, comments, reel views, type and date. We use that to calculate your averages and engagement. We don't access your account or your messages.
• YouTube (when you type your @ or channel link): we use the YouTube Data API to read the channel name, subscribers and views of your recent public videos. By using this feature you agree to the YouTube Terms of Service (youtube.com/t/terms); Google handles data under its Privacy Policy (policies.google.com/privacy). You can revoke Kolab's access in your Google account security settings.
• TikTok (only if you connect your account): through TikTok Login Kit we request the user.info.basic, user.info.profile, user.info.stats and video.list scopes, which give your username, name, photo, followers, total likes and the list of your public videos with their views, likes and comments. Access tokens are stored encrypted. If you connect from the calculator without an account, that connection is deleted after 2 hours unless you save it to a kit.

Public Instagram and YouTube data is cached for up to 24 hours to avoid repeated requests. While your kit uses it, we refresh it automatically: daily on Pro and weekly on Free. Connected accounts show the “Verified by connection” badge.

• Building and showing your media kit, PDF and rate card.
• Calculating averages, engagement and suggested rates.
• Emailing you when a brand writes and sending your replies.
• Writing pitches with your numbers when you ask.
• Showing who views your kit (on Pro), billing your plan and preventing abuse.

We don't sell your data, we don't use it for advertising and we don't share it with brands unless you publish your kit or reply to them.

Only the providers we need to run Kolab, who process data on our behalf:

• Supabase: database, photo storage and sign-in.
• Vercel: site hosting and cookie-free usage stats.
• Resend: sending emails (notifications, replies to brands, account access).
• Lemon Squeezy: payment processor and merchant of record. It charges, issues receipts and handles taxes, and treats your payment data under its own privacy policy.
• Anthropic (Claude): when you use the pitch generator, we send your kit data and the brand name to write the message.
• Meta, Google and TikTok: we query their APIs for the data described above.

Some of these providers process data outside Colombia (mainly in the United States). By using Kolab you authorize that transfer.

As long as you have an account. Network caches last up to 24 hours, TikTok connections without an account 2 hours and anti-abuse counts one day. When you delete your account, everything tied to it is deleted; only the payment records Lemon Squeezy must keep by law remain.

You can access, update, correct and delete your data and withdraw your consent at any time (Colombian Law 1581 of 2012 and equivalent laws in your country). You can change almost everything yourself in the editor; for anything else, email kolab@cowth.co from your account email and we'll reply within 15 business days.

These are our data deletion instructions, including for data we get from Meta (Instagram) and TikTok:

• Remove a network's numbers: in your editor, Networks tab, remove the network (or its numbers) and save. They disappear from your kit and PDF right away.
• Disconnect TikTok: in the Networks tab, tap “Disconnect”. We revoke access with TikTok and delete the tokens and what we pulled from your account; numbers already on your kit are removed by deleting the network. You can also remove access from TikTok: Settings → Security → Apps and services.
• Delete public data for an Instagram or YouTube @ (even without a Kolab account): email kolab@cowth.co with the @ and we'll remove it from our cache.
• Delete your account and all your data: email kolab@cowth.co from your account email with the subject “Delete my account”. We delete your account, kit, photos, views, requests and connections within 15 business days and confirm by email. If you have an active subscription, cancel it first from “Manage subscription”.

We only use necessary cookies: your session, language, the kit you're editing and the TikTok connection while you save it. No advertising or tracking cookies; site stats are anonymous and cookie-free.

Kolab is for people 18 and older. If you're younger, use Kolab only with the permission and supervision of a parent or guardian, who is responsible for the account.

If we change this policy we'll let you know in the app or by email before it applies. The date above shows the latest version.