Privacy Policy

Khuume is a creator link-in-bio platform operated by Khuume, Inc., a Delaware corporation, with operations based in Thailand (together, “Khuume,” “we,” “us”). This Privacy Policy explains how we handle personal data when you use khuu.me, your creator pages, and related services (the “Service”).

Because we operate from Thailand and offer the Service to people in Thailand, the EU/UK, the United States, and elsewhere in Southeast Asia, this policy is written to meet a high baseline drawn from the Thai Personal Data Protection Act (PDPA), the EU/UK GDPR, and applicable US state laws. Where a local law gives you stronger rights, that local law controls.

We handle personal data in two distinct capacities, and your rights depend on which applies:

• As a controller — for data about our own users: creator account holders and visitors to khuu.me. We decide how and why this data is used, and this policy governs it.
• As a processor — for data a creator collects from their own audience through Khuume (for example, names and emails submitted through a booking or a poll on a creator’s page). The creator is the controller of that data; we process it on their behalf under our Data Processing Addendum. If you submitted information to a creator, please contact that creator to exercise your rights.

• Account data — email address, password (stored only as a salted hash), display name, handle, and account settings.
• Profile and creator content — the links, text, images, polls, booking configurations, media kits, and other content you publish on your Khuume page.
• Usage and device data — IP address, approximate location, browser and device type, referring pages, and interactions such as page views and link clicks. We use IP addresses for security and rate limiting.
• Social sign-in data — if you create your account or sign in using Google or LINE, we receive from that provider your name, email address, profile picture, and that provider’s user identifier for you. We use this to create and authenticate your account. We never receive your password for that provider.
• Connected accounts — when you connect a platform account to Khuume (TikTok, YouTube, Instagram, or Facebook), we store the access and refresh tokens that platform issues to us, together with the profile and content statistics you authorize us to retrieve — typically your account or channel identifier, display name, follower or subscriber count, view and post counts, and aggregate engagement figures. We request read-only access and never post, edit, or delete content on your behalf. See YouTube API Services below for what we take from YouTube specifically.
• Payment data — subscription payments are processed by Stripe. We receive billing metadata (plan, status, last four digits, country) but do not store full card numbers. Stripe handles payment data under its own privacy notice.
• Communications — messages you send us at support@khuu.me and related correspondence.

We use personal data to provide and secure the Service, process subscriptions, communicate with you, analyze and improve the product, and comply with law. Depending on the activity and your region, our legal basis is one or more of the following:

• Performance of a contract — to operate your account and deliver the Service you signed up for.
• Consent — for non-essential analytics and marketing cookies, and for connecting third-party accounts. You can withdraw consent at any time.
• Legitimate interests — for security, fraud prevention, and basic product analytics, balanced against your rights.
• Legal obligation — to meet tax, accounting, and regulatory requirements.

Some features of the Service use artificial intelligence — for example, AI-assisted translation and text analysis. To provide these, we share the relevant input and output with third-party AI providers (which may include OpenAI, Anthropic, and Google), who process it on our behalf to deliver the feature. Our agreements with these providers prohibit them from using your content to train their own models. We do not use AI to make decisions that produce legal or similarly significant effects about you without human involvement.

We use strictly necessary cookies to run the Service and, with your consent, analytics cookies to understand usage. You can manage your choices through our consent banner and your browser settings. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.

We do not sell your personal data. We share it only with service providers who process it on our behalf under contract, and where required by law. Our current sub-processors include:

• Vercel — application hosting and content delivery.
• Neon — managed PostgreSQL database hosting.
• Stripe — subscription billing and payments.
• OpenAI, Anthropic, and/or Google — AI providers powering translation and text-analysis features.
• Google — separately from its role as an AI provider above: sign-in with Google, and the optional YouTube channel connection you choose to make. Google handles this data under the Google Privacy Policy.
• Meta (Instagram and Facebook) — for the optional Instagram or Facebook connections you choose to make.
• TikTok — for the optional TikTok connection you choose to make.
• LINE — for optional LINE account linking and, where you enable them, LINE notifications.
• Cloudflare — object storage for images and files you upload (R2), and anti-spam verification on our public forms (Turnstile).
• Resend — transactional email delivery.
• Sentry — error monitoring and diagnostics, which may include your IP address and technical details of a failed request.
• PostHog — product analytics (usage measurement).

The providers listed above are our current sub-processors; we update this policy when the list changes. We may also disclose data to comply with legal process or to protect the rights, safety, and security of Khuume, our users, and the public.

If you choose to connect a YouTube channel, Khuume acts as an API Client of YouTube API Services. That connection is governed by this policy together with the YouTube Terms of Service and the Google Privacy Policy. Connecting a channel is entirely optional; the rest of the Service works without it.

What we access, store, and use:

• Channel identity — your channel ID, title, description, and thumbnail image, so we can show you which channel is connected and display your channel on your Khuume page and media kit where you have chosen to.
• Channel statistics — subscriber count, total view count, and video count, which we store and refresh periodically so your audience figures stay current for you and for brands you choose to share them with.
• Authorization tokens — the OAuth access and refresh tokens Google issues, stored encrypted and used only to retrieve the data described above.

We request a single, read-only scope (https://www.googleapis.com/auth/youtube.readonly). We cannot and do not upload, modify, or delete videos, comments, playlists, or any other content on your channel, and we do not access your private viewing history or watch activity. We do not use YouTube data for advertising, and we do not sell it or transfer it to third parties except the sub-processors listed above who host our infrastructure on our behalf.

Limited Use. Khuume’s use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking access and deleting your data. You can disconnect your channel at any time in your Khuume integration settings, which deletes the stored tokens immediately and the stored channel statistics within 30 days. You can also revoke Khuume’s access directly through your Google account at https://myaccount.google.com/permissions. Revoking through Google stops all further access immediately; to also remove data we have already stored, disconnect in Khuume or email us. Google’s own handling of data it collects is described in the Google Privacy Policy.

Questions or complaints about how we handle YouTube data: email privacy@khuu.me.

We operate from Thailand and our infrastructure providers store and process data outside Thailand and outside your country, including in the United States and the European Union. Where personal data is transferred across borders, we rely on appropriate safeguards — such as Standard Contractual Clauses, transfer mechanisms recognized under the PDPA, or your consent where required.

We keep personal data for as long as your account is active and as needed to provide the Service, then for the period required to meet legal, tax, and accounting obligations or to resolve disputes. When data is no longer needed, we delete or anonymize it.

Subject to your local law, you may have the right to access, correct, delete, port, or restrict processing of your personal data; to object to certain processing; and to withdraw consent. Residents of the EU/UK, Thailand, and certain US states (including California) have specific statutory rights, including the right not to be discriminated against for exercising them and, where applicable, to opt out of the sale or sharing of personal data (we do not sell or share personal data for cross-context behavioral advertising).

To exercise your rights, contact us at privacy@khuu.me. You may also lodge a complaint with your local supervisory authority — for example, Thailand’s Personal Data Protection Committee (PDPC) or your EU/UK data protection authority.

If you live in a US state with a comprehensive privacy law (such as California, Colorado, Connecticut, Texas, Virginia, and others), you may have the right to confirm whether we process your personal data; to access, correct, delete, or obtain a portable copy of it; and to opt out of targeted advertising, the “sale” of personal data, or certain profiling. We do not sell or share your personal data, and we do not use it for cross-context behavioral advertising.

To exercise these rights, email privacy@khuu.me. You may use an authorized agent to submit a request; we may ask the agent for proof of authorization and may need to verify your identity before we act. If we decline your request, you may appeal by replying to our decision; if the appeal is denied, you may contact your state attorney general.

Do Not Track. Some browsers can send a “Do Not Track” signal. Because there is not yet a common standard for these signals, we do not currently respond to them; if a standard is adopted, we will update this notice.

The Service is not directed to children. You must be at least 18, or the age of digital consent in your country (and at least 13), to create an account. We do not knowingly collect personal data from children under that age; if you believe a child has provided us data, contact privacy@khuu.me and we will delete it.

We use technical and organizational measures — including encryption in transit, hashed passwords, and access controls — to protect personal data. No system is perfectly secure, but if a personal data breach is likely to result in a risk to your rights, we will notify the relevant authority and affected users without undue delay and, where required, within 72 hours of becoming aware, consistent with the PDPA and GDPR.

We may update this policy from time to time and will post the revised version here with a new “last updated” date; material changes will be communicated to account holders. Questions or requests: privacy@khuu.me.