Kepla ("Kepla," "we," "us," "our") operates getkepla.com and related services for photography businesses, currently in pre-launch. Kepla is the data controller for personal data described in this policy. Contact for all privacy matters: support@getkepla.com. We aim to acknowledge privacy inquiries within 72 hours.
This policy covers data processed when you visit our website, join our waitlist, use our interactive demos, connect third-party accounts (such as Instagram), or communicate with us. It does not cover third-party websites we link to, which have their own policies.
We collect no more than the following. If it is not listed here, we do not collect it.
| Category | Data | Source |
|---|---|---|
| Waitlist signup | Name, email address; optionally: studio name, role, primary shoot type, current tools, survey answers, how you heard about us | Provided by you |
| Referral | A randomly generated referral code for your signup; the referral code of whoever referred you, if any | Generated by us / your referrer's link |
| Attribution | UTM parameters and referring-page URL at the time of your visit | Your browser |
| Demo interactions | Text you submit to interactive demos and the AI responses generated | Provided by you |
| Website ingestion | Publicly available pages of a website URL you voluntarily submit to the booking demo | Public web, at your direction |
| Instagram (only if you connect) | See Section 5 | Instagram API, with your consent |
| Technical | IP address (used transiently for rate limiting and abuse prevention), coarse analytics (page views via Vercel Analytics, which does not use cookies for tracking) | Your browser |
What we deliberately do not do: we do not use third-party advertising trackers or advertising cookies; we do not buy data about you from data brokers; we do not collect payment card data during the waitlist phase; we do not knowingly collect data from anyone under 18 (our services are for business users; if you believe a minor's data reached us, email us and we will delete it promptly).
We will not use your personal data for a materially new purpose without informing you first. We do not sell personal data and have not sold personal data; we do not "share" personal data for cross-context behavioral advertising as defined by the California Consumer Privacy Act (CCPA/CPRA).
When our Instagram connection feature is available and you explicitly authorize it through Instagram's own consent screen, we access only the scopes you approve. At most, that is: your basic profile information (username, account name, account type) and your media (posts, captions, and media URLs). We commit to the following, without exception:
We use the following service providers, each bound by data-processing terms, each receiving only what its function requires. We do not permit processors to use your data for their own purposes.
| Provider | Function | Data touched |
|---|---|---|
| Vercel | Hosting, serverless functions, privacy-respecting analytics | All site traffic (transit); coarse analytics |
| Neon | Database (encrypted at rest) | Waitlist, survey, referral, demo-interaction records |
| Resend | Transactional and update email delivery | Name, email, email content |
| Google (Gemini API) / OpenAI | AI generation for demos and product features | Text you submit to demos; public website text you direct us to read |
If this list changes, we will update this page before the new processor handles personal data.
No internet service can guarantee absolute security; we commit to the measures above and to remedying gaps promptly when found.
| Data | Retention |
|---|---|
| Waitlist and survey records | Until launch onboarding completes or you request deletion, whichever is first; unconverted waitlist records are deleted no later than 24 months after our public launch |
| Demo interaction logs | Maximum 24 months from creation, then deleted or irreversibly de-identified |
| Instagram-derived data | Until disconnection or deletion request; then per Section 5 |
| IP addresses (rate limiting) | Transient, in-memory; not written to permanent logs by our application |
| Deletion-request records | Minimal record retained as evidence of compliance |
Our providers process data in the United States. Where data of EU/UK residents is transferred, our providers rely on recognized safeguards (such as Standard Contractual Clauses and, where applicable, the EU to US Data Privacy Framework). By using the service you acknowledge processing in the United States.
Regardless of where you live, we extend these rights to every user: access (a copy of your data), rectification (correction), erasure (deletion), restriction and objection (limits on our processing), and portability (a machine-readable export). Exercise any of them by emailing support@getkepla.com; identity verification and timelines are described in the Data Deletion Instructions. We will never discriminate against you for exercising privacy rights.
EU/UK residents: you additionally have the right to lodge a complaint with your supervisory authority. California residents: the rights above operate as your CCPA/CPRA rights to know, delete, correct, and opt out; as stated in Section 4, we do not sell or share personal information, so there is nothing to opt out of. We honor Global Privacy Control signals where legally required.
Waitlist members receive occasional product updates. Every email includes a plain-language way to stop them (reply "unsubscribe"); requests are honored within 10 days and typically immediately. Transactional emails (e.g., a signup confirmation you triggered) are sent as part of the service you requested.
Material changes will be posted here with a new effective date and version number. For material changes affecting data we already hold about you, we will notify waitlist members by email before the change takes effect. We keep prior versions available on request.
support@getkepla.com: for privacy questions, rights requests, complaints, or to request this policy's history.