Kalkey CRM

Privacy Policy

Last updated: 24 July 2026

Kalkey CRM ("the Service"), operated by Kalkey ("we", "us"), is a business tool for managing customer relationships, conversations, and social media content publishing. It is used by authorized team members of the businesses we work with. This policy describes what data the Service handles and how.

Data we collect

  • Account data: name, email address, and login credentials of authorized users.
  • Business data: contacts, leads, notes, tasks, and message conversations that users store in the Service in the course of their work.
  • Connected social accounts: when a user connects a social media account (Facebook Page, Instagram, YouTube, TikTok, LinkedIn), we store the account's public profile information (name, avatar, handle) and the access tokens needed to publish on the user's behalf. Tokens are encrypted at rest (AES-256-GCM) and are never displayed to users or shared with third parties.
  • Published content: the videos and captions users create in the Service and choose to publish to their connected accounts.

How we use data

  • To provide the Service's CRM and content-publishing features to authorized users.
  • To publish content to a connected social account — only when a user explicitly initiates a post, and only to the account they select.
  • To process video and audio with AI services (transcription, caption generation). Media sent for processing is not used to train third-party models under our provider agreements.

We do not sell personal data, and we do not share it with third parties except the platform APIs listed below, acting on the user's explicit instruction.

Third-party platform APIs

The Service connects to the following platforms when a user links an account:

  • Google / YouTube: the Service uses YouTube API Services to upload videos to the user's YouTube channel. By connecting a YouTube account you also agree to the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy. You can revoke the Service's access to your Google account at any time via the Google security settings page.
  • Meta (Facebook & Instagram): used to publish reels to connected Facebook Pages and Instagram business accounts and to receive messages for connected inboxes.
  • TikTok: used to display the connected account's profile (name, avatar) and to post videos to the account when a user initiates a post.
  • LinkedIn: used to publish video posts to the connected profile or page.

Data retention and deletion

  • Disconnecting a social account from the Service deletes its stored access tokens immediately. Third-party access can also be revoked from the platform's own security settings.
  • Business data is retained while the owning workspace is active. To request deletion of your data, contact us at info@kalkey.com — we respond within 30 days.

Security

All traffic is encrypted in transit (HTTPS). Social account credentials are encrypted at rest with AES-256-GCM. Access to the Service requires authentication, and access to each workspace's data is restricted to that workspace's members.

Changes

We may update this policy; the date above reflects the latest revision. Material changes are communicated to users in the Service.

Contact

Kalkey — info@kalkey.com