/01
Scope
This Privacy Policy applies to kzar.io, KZAR & CO client communications and services, the Digital Presence Review, the Brand Identity Builder, and social publishing or account-management services that a client or account owner explicitly authorizes. It does not replace the privacy policies of TikTok, Meta, Threads, LinkedIn, Pinterest, Google or YouTube, X, Reddit, or other third-party services.
/02
Information we collect
Information you provide
We may collect your name, business name, email address, website URL, project goals, messages, files, brand materials, account preferences, and other information you choose to provide. Form submissions are stored by KZAR & CO on Cloudflare and kept up to 180 days unless they become a client engagement.
Website and technical information
Our hosting, security, and analytics services may process IP address, browser and device information, referring page, requested pages, timestamps, and security events. Cloudflare Web Analytics is used to understand aggregate site activity. Google Fonts may receive technical request information when your browser downloads fonts.
Client service information
If you engage KZAR, we may process business records, project communications, approvals, content, media, publishing schedules, and service history needed to perform and document the work.
/04
How we use information
- Respond to inquiries and prepare requested Digital Presence Reviews.
- Plan, design, build, operate, support, and improve client work.
- Draft, schedule, publish, verify, and report on social content after the account owner grants access and approves the work.
- Authenticate connections, maintain account security, prevent abuse, troubleshoot failures, and keep operational records.
- Comply with law, enforce agreements, and protect KZAR, our clients, platform users, and the public.
/06
Google and YouTube API data
KZAR uses YouTube API Services when an account owner authorizes a YouTube connection. When you connect YouTube, KZAR may receive your Google account identifier, YouTube channel identifiers and metadata, authorization tokens, video upload and publishing information, and channel or video analytics permitted by the scopes you approve. We use that data only to connect the selected channel, publish content you authorize, retrieve requested reporting, maintain the integration, and provide support. We do not use Google or YouTube user data for advertising.
YouTube API data is otherwise handled as described in the Social platform data, How we use information, How we share information, and Data retention and deletion sections of this policy. We share it only with service providers needed to operate the authorized service and as otherwise permitted by the Google API Services User Data Policy. Your use of YouTube is also governed by the YouTube Terms of Service and the Google Privacy Policy.
KZAR's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You may revoke KZAR's access through your Google Account permissions.
Where YouTube policies require stored API Data to be refreshed, reauthorized, or deleted within a shorter period, that shorter period controls. KZAR does not retain YouTube API Data under broader engagement, audit, or business-record periods when YouTube requires earlier refresh or deletion.
/08
Data retention and deletion
We retain inquiries and project records for as long as reasonably needed to respond, provide services, document approvals, meet contractual or legal obligations, resolve disputes, and maintain appropriate business records. Form submissions are stored by KZAR & CO on Cloudflare and kept up to 180 days unless they become a client engagement. This covers the Digital Presence Review, the Brand Identity Builder and the contact form. A submission that becomes a client engagement moves into our project records and follows the retention above. Verified deletion requests are applied to stored submissions.
Social authorization tokens are retained only while the connection is active or while needed to complete an authorized service. When a connection ends, KZAR stops using the authorization, revokes it with the platform where supported or required, and deletes locally stored access and refresh tokens according to the applicable platform deadline. Short-lived credentials may expire naturally only when revocation is unavailable and no further access is attempted. Content, publishing records, and analytics are retained only as long as reasonably needed for the engagement, security, audit, or legal purpose.
When information is no longer needed, we delete or anonymize it using reasonable operational processes. Residual copies may remain temporarily in restricted backups or where retention is required by law. See our Data Deletion Instructions for a direct request process.
/09
Security
We use reasonable administrative, technical, and organizational safeguards appropriate to the information and service, including access controls and restricted credential storage. No internet transmission or storage system can be guaranteed completely secure.
/10
Your choices and rights
You may ask to access, correct, or delete personal information KZAR controls, subject to identity verification and lawful exceptions. You can disconnect a social account in the applicable platform or revoke KZAR's access directly through that platform. Residents of jurisdictions with additional privacy rights may exercise those rights by contacting us. We will not discriminate against you for making a lawful privacy request.
/11
Children
KZAR's website and services are directed to businesses and adults. They are not intended for children under 13, and we do not knowingly collect personal information from children under 13.
/12
International processing
KZAR is based in Michigan, United States. Information may be processed in the United States or other locations where our service providers or social platforms operate. Those locations may have different data-protection laws than your location.
/13
Changes to this policy
We may update this policy as our services, providers, or legal obligations change. We will post the revised policy here and change the effective date. Material changes will receive additional notice when appropriate.
/14
Contact
For privacy questions or requests, email info@kzar.io. Please do not send passwords, access tokens, or other authentication secrets. KZAR & CO is based in Detroit, Michigan, United States.
/03
Social platform data
When an account owner authorizes KZAR to connect a social account, we may receive and process the data permitted by the approved scopes. Depending on the platform and service, this can include:
We use authorized social platform data only to provide the requested publishing, content, reporting, support, and account-management services. We do not use it to build unrelated advertising profiles or sell it to data brokers. Access is limited to the scopes and destinations needed for the service.