Privacy Policy

Last updated: February 21, 2026

1. Introduction

Plus Ultra Industries LLC (“Company”, “we”, “us”, or “our”) operates Kanvify (the “Service”), a social media scheduling and management platform available at kanvify.com. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our Service. By accessing or using Kanvify, you consent to the data practices described in this policy. If you do not agree, please discontinue use of the Service.

2. Information We Collect

We collect information in several ways to provide and improve our Service:

Information You Provide Directly

Account registration data: name, email address, and password (hashed and salted — we never store plaintext passwords)
Profile information: avatar, timezone preferences, and display name
Content you create, schedule, and publish through our platform, including text, images, and videos
Billing and payment information (processed and stored by Stripe, our payment processor — we do not store credit card numbers)
Communications with us, including support requests and feedback
Social media account credentials provided via OAuth tokens (encrypted at rest — we never receive or store your social media passwords)

Information Collected Automatically

Usage data: pages visited, features used, actions taken, and interaction patterns
Device information: browser type, operating system, screen resolution, and device identifiers
Log data: IP address, access times, referring URLs, and error logs
Cookies and similar tracking technologies (see Section 12 below)

Information from Third Parties

Profile information from connected social media platforms (e.g., page names, follower counts, profile images) obtained through official APIs
Analytics data from service providers that help us understand Service usage

3. How We Use Your Information

We use the information we collect for the following purposes:

To provide, operate, and maintain the Service, including processing your scheduled posts and publishing content to connected platforms
To improve, personalize, and expand our Service based on usage patterns and feedback
To communicate with you, including sending service-related notices, updates, security alerts, and support messages
To process transactions and manage your subscription and billing
To detect, prevent, and address technical issues, fraud, and security threats
To comply with legal obligations and enforce our Terms of Service
To analyze trends, administer the Service, and gather demographic information in aggregate

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data under the following legal bases:

Performance of Contract: Processing necessary to provide you with the Service you requested (Article 6(1)(b) GDPR)
Consent: Where you have given explicit consent for specific processing activities, such as marketing communications (Article 6(1)(a) GDPR)
Legitimate Interests: Processing necessary for our legitimate interests, such as improving the Service, preventing fraud, and ensuring security, provided these interests do not override your fundamental rights (Article 6(1)(f) GDPR)
Legal Obligation: Processing necessary to comply with applicable laws and regulations (Article 6(1)(c) GDPR)

We do not sell, rent, or trade your personal information. We may share your information only in the following circumstances:

Service Providers: We share data with trusted third-party providers who assist us in operating the Service (e.g., cloud hosting, payment processing, email delivery, analytics). These providers are contractually obligated to protect your data and use it only for the purposes we specify.
Social Media Platforms: When you connect social accounts and publish content through Kanvify, we transmit your content and necessary account information to those platforms via their official APIs. Each platform’s own privacy policy governs how they use this data.
Legal Requirements: We may disclose your information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of our company, our users, or the public.
Business Transfers: In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on the Service before your data is transferred and becomes subject to a different privacy policy.
With Your Consent: We may share your information for any other purpose with your explicit consent.

Kanvify integrates with third-party social media platforms (including but not limited to Facebook, Instagram, TikTok, YouTube, X/Twitter, and Threads) through their official APIs. When you connect a social media account:

We access your accounts only through official, authorized APIs and comply with each platform’s developer terms of service
We use OAuth authentication — we never receive, see, or store your social media passwords
OAuth access tokens are encrypted at rest using industry-standard encryption
Each social media platform has its own privacy policy and terms of service that govern how they collect, use, and share your data — we are not responsible for their practices
Content published to social media platforms through Kanvify remains on those platforms even if you delete your Kanvify account. You must delete published content directly from each social media platform.
We are not responsible for changes to third-party APIs, platform policies, or service interruptions that may affect your ability to publish or manage content

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

Account data: Retained for the duration of your account plus 30 days after deletion to allow for recovery
Content and post data: Retained for the duration of your account and deleted upon account deletion
Billing and transaction records: Retained for up to 7 years after the transaction for tax, audit, and legal compliance purposes
Usage logs and analytics: Retained for up to 12 months in identifiable form, then aggregated or anonymized
Support communications: Retained for up to 3 years after resolution for quality assurance and training purposes
Uploaded media files: Deleted upon account deletion; may take up to 30 days to be fully purged from cloud storage and backup systems

8. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

Encryption of data in transit using TLS 1.2 or higher
Encryption of sensitive data at rest, including OAuth tokens and credentials
Role-based access controls and least-privilege principles for internal systems
Continuous monitoring and logging of access to sensitive systems
Incident response procedures with commitment to notify affected users within 72 hours of discovering a data breach, in compliance with GDPR Article 33
Row Level Security (RLS) at the database level to ensure workspace data isolation

While we strive to use commercially acceptable means to protect your personal data, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that are different from the laws of your country. When we transfer data outside the EEA, UK, or Switzerland, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, or other legally recognized transfer mechanisms.

10. Your Privacy Rights (EEA, UK, Switzerland)

If you are located in the EEA, UK, or Switzerland, you have the following rights under GDPR:

Right of Access: Request a copy of the personal data we hold about you
Right to Rectification: Request correction of inaccurate or incomplete personal data
Right to Erasure: Request deletion of your personal data (see our Data Deletion page for details)
Right to Restriction: Request that we limit how we use your data
Right to Data Portability: Request your data in a structured, commonly used, machine-readable format
Right to Object: Object to processing based on legitimate interests or for direct marketing purposes
Right to Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing
Right to Lodge a Complaint: File a complaint with your local data protection supervisory authority

To exercise any of these rights, please contact us at privacy@kanvify.com. We will respond to your request within 30 days.

11. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

Right to Know: You can request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, our purposes for collecting it, and the categories of third parties with whom we share it.
Right to Delete: You can request that we delete your personal information, subject to certain exceptions.
Right to Correct: You can request that we correct inaccurate personal information.
Right to Opt-Out of Sale/Sharing: We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising as defined under CPRA.
Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

To exercise your rights, contact us at privacy@kanvify.com or use the account settings within the Service. We will verify your identity before processing any request.

12. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience:

Essential Cookies: Required for the Service to function properly (e.g., session management, authentication). These cannot be disabled.
Analytics Cookies: Help us understand how users interact with the Service. You can opt out via the cookie consent banner displayed on your first visit.
Preference Cookies: Store your settings and preferences (e.g., language, theme).

You can manage your cookie preferences through the consent banner on our website or by adjusting your browser settings. Note that disabling certain cookies may affect the functionality of the Service. We do not use advertising or third-party tracking cookies.

13. YouTube API Services

Kanvify uses YouTube API Services to enable you to connect your YouTube channel and publish YouTube Shorts through our platform. By using Kanvify’s YouTube features, you agree to be bound by the YouTube Terms of Service and acknowledge that Google’s Privacy Policy applies to YouTube’s handling of your data.

YouTube Data We Access

When you connect your YouTube account, we access the following data through YouTube API Services:

Channel information: Your YouTube channel name, channel ID, and profile picture, used to identify your connected channel within Kanvify
Video upload capability: We upload videos to your YouTube channel on your behalf when you publish a YouTube Short through Kanvify
Video status: We monitor the processing and publication status of videos uploaded through our Service to report success or failure
Video metadata: We read and set video titles, descriptions, and privacy settings as configured by you during post creation

OAuth Permissions and Why We Need Them

We request only the minimum YouTube API permissions necessary to provide our Service:

youtube.upload — Required to upload YouTube Shorts to your channel on your behalf
youtube.readonly — Required to read your channel information (name, ID, profile picture) so you can identify and select your channel within Kanvify
youtube.force-ssl — Required to manage video metadata (title, description, privacy status) for videos published through Kanvify

YouTube Data Storage and Retention

We store YouTube-related data as follows:

OAuth tokens: Encrypted at rest and stored for the duration of your channel connection. Deleted immediately when you disconnect your YouTube channel or delete your Kanvify account.
Channel ID and channel name: Stored for the duration of your channel connection to identify your connected channel. Deleted when you disconnect the channel or delete your account.
Video IDs and metadata: Stored for the duration of your account to track published content and display publication status. Deleted upon account deletion.
Other YouTube API data (upload status, processing state): Retained for no more than 30 calendar days, then automatically deleted.

How We Use YouTube Data

We use YouTube data exclusively for the following purposes:

Publishing YouTube Shorts to your channel on your behalf, as initiated by you
Monitoring and reporting the upload and processing status of your videos
Displaying your connected channel information within the Kanvify interface
Setting video metadata (title, description, privacy status) as configured by you

We do not sell, share, or transfer your YouTube data to any third parties. Your YouTube data is never used for advertising, analytics profiling, retargeting, or any purpose other than providing the YouTube publishing features of our Service. We do not serve third-party advertisements based on your YouTube data.

Revoking Access and Data Deletion

You can revoke Kanvify’s access to your YouTube data at any time through either of these methods:

Within Kanvify: Disconnect your YouTube channel from Workspace Settings > Channels. This immediately revokes access and deletes all stored YouTube data for that channel.
Via Google: Visit your Google Account permissions page at https://myaccount.google.com/permissions to revoke Kanvify’s access independently. When we detect a revoked token, we will delete all associated YouTube data within 7 calendar days.
Deletion requests: You may request deletion of your YouTube data at any time by contacting privacy@kanvify.com. We will process deletion requests within 7 calendar days.
Account deletion: When you delete your Kanvify account, all YouTube data (tokens, channel IDs, video IDs, metadata) is deleted immediately as part of the account deletion process.

Google’s use of information received from YouTube API Services is governed by Google’s Privacy Policy.

14. Children’s Privacy

The Service is not directed to individuals under the age of 16 (or the applicable age of consent in your jurisdiction). We do not knowingly collect personal information from children. If we become aware that we have collected personal data from a child without parental consent, we will take steps to delete that information promptly. If you believe a child has provided us with personal data, please contact us at privacy@kanvify.com.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the Service. We will notify you of material changes by posting the updated policy on this page with a revised “Last updated” date. For significant changes, we will also send a notification via email or an in-app notice at least 30 days before the changes take effect. Your continued use of the Service after any changes constitutes acceptance of the updated policy.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: privacy@kanvify.com
Support: support@kanvify.com
Plus Ultra Industries LLC