Khula Privacy Policy
Last updated: 23 October 2026
This Privacy Policy explains what personal information Khula collects, why we collect it, who we share it with, how long we keep it and the choices you have. It covers our website at khula.app, the Khula app at beta.khula.app, and the emails we send you.
Khula is operated by Khula Technologies Limited, a company registered in Nigeria with RC number 9741707 ("Khula", "we", "us", "our"). We are the data controller for the personal information described in this policy. If you have any question about it, email us at support@khula.app.
Summary
- You give us your account details and the posts you create. We use them to schedule and publish your posts to the social media accounts you connect.
- You connect Facebook, Instagram, X (Twitter), TikTok, LinkedIn and YouTube through each platform's own login screen. We never see or store your passwords for those platforms.
- We only publish what you schedule, at the time you choose.
- We do not sell your personal information.
- Card payments are handled by Paystack. We never see or store your full card number.
- If you use the AI caption generator, the text and image you give it are sent to OpenAI to write the caption.
- We use Google Analytics, the Meta Pixel and error monitoring tools to understand how Khula is used and to measure our ads.
- You can disconnect accounts, delete workspaces and ask us to delete your account at any time.
1. Information we collect
1.1 Account information
When you sign up, we collect your name, email address and password. Your password is stored by our sign-in provider as a one-way hash, so nobody at Khula can read it.
If you sign up with Google, Google shares your name, email address and profile picture with us instead of a password.
When you sign up with email, we also ask how you heard about Khula. For every new account, we record how you first reached us: the website that sent you, any campaign label on the link you followed, the first page you opened, and your approximate location (country and city). We use this only to learn which places people find Khula through.
In Settings you can change your name, email address, password and profile picture.
1.2 Content you create
- Workspaces and their names
- Posts: captions, separate captions for each platform, images, videos, cover images, the date and time you schedule them for and the accounts each one goes to
- Post settings for a specific platform, such as Instagram collaborators you tag (by username) or the TikTok privacy setting you choose
- Drafts and content ideas
- Posting goals, and the posting streak we work out from your activity
- Your time zone and light or dark theme preference, which are kept in your browser
1.3 Connected social media accounts
To connect an account, you sign in on the platform's own page and choose to give Khula permission. The platform then gives us an access token, and usually a refresh token, which let Khula act for you within the permissions you granted. We store these tokens together with the account's ID, name, username, profile picture and the permissions granted.
| Platform | Permissions we ask for | What we use them for |
|---|---|---|
| Your public profile and email address, the list of Pages you manage (including Pages managed through Meta Business Manager), engagement on your Page posts, and publishing to your Pages | Finding your Pages, publishing the posts you schedule, and showing reactions, comments, shares, impressions and reach for posts published through Khula | |
| Instagram (Professional accounts) | Your basic profile (ID, username, account type and profile picture) and publishing content | Publishing the posts you schedule and adding any collaborators you name |
| X (Twitter) | Your profile, reading and writing posts, and staying connected (offline access) | Publishing the posts you schedule. Offline access keeps you connected without signing in again |
| TikTok | Your basic profile (display name, profile picture and ID), and uploading and publishing videos | Publishing the posts you schedule, and reading your username and the privacy options TikTok allows for your account |
| LinkedIn (personal profile) | Sign-in with LinkedIn (your name, email address and profile picture) and posting on your behalf | Publishing the posts you schedule to your profile |
| LinkedIn Pages | The same as above, plus the list of company Pages you administer and posting on their behalf | Publishing the posts you schedule to the company Pages you administer |
| YouTube | Uploading videos, viewing your YouTube account, and your basic Google profile (name and picture) | Uploading the videos you schedule, showing your channel name and picture, and showing views, likes and comments for videos uploaded through Khula |
We do not use these permissions to read your private messages, your followers' details, or posts you made outside Khula.
Access tokens expire, so we refresh them automatically and check regularly that each connection still works. If an account needs to be reconnected, we email you.
1.4 Publishing records and post results
For every post, we keep a record of when it was published, which account it went to, the post's ID and link on the platform, and any error the platform returned. For Facebook and YouTube, we also collect the performance numbers listed in the table above for posts published through Khula.
1.5 Payment and billing information
Payments are processed by Paystack. When you subscribe, we send Paystack your email address, the plan you chose and the amount. You enter your card details on Paystack's payment page, not on Khula.
From Paystack we receive and store:
- Your Paystack customer and subscription references
- A reusable authorisation code, which lets us charge the card you saved for renewals and plan changes you agree to
- Your card brand, the last four digits of the card and its expiry month and year
- A record of each payment: amount, currency, plan, billing period, status and reference
We use the country your internet connection comes from to decide whether to show prices in naira or US dollars.
1.6 Support conversations
When you use the in-app support form, we collect your name, the email address you enter, the topic, your message and any files you attach. We add your current plan and the time you sent it, and the message is emailed to our support inbox. Our staff may also keep internal notes on your account about a support issue.
If you contact us on WhatsApp, we see your WhatsApp name, phone number and messages, and WhatsApp's own privacy policy applies.
1.7 Technical and usage information
When you use Khula, our systems and the providers listed in section 6 automatically receive:
- Your IP address, browser, device type and operating system
- Your approximate location (country or city), worked out from your IP address
- The pages you visit, the features you use and the date and time of each request
- Page load and performance measurements
- Error reports, including what you were doing when the error happened
- For about 1 in 10 sessions, and for any session where an error happens, a session replay: a reconstruction of how the page changed while you used it. By default, replays hide the text on the page and anything you type, and block images and videos.
- The number of AI captions you generate each day, so we can apply your plan's limits
1.8 Advertising measurement
We advertise Khula on Facebook and Instagram. To learn which ads lead to sign-ups, the Meta Pixel in our app reports the pages you visit to Meta, and tells Meta when a new account starts a free trial. When that happens, our server also sends Meta, through Meta's Conversions API, a scrambled (hashed) copy of your email address and Khula account ID, your IP address, your browser details and Meta's own cookie IDs, so Meta can match the sign-up to an ad.
We do not send your posts, connected accounts or payment details to Meta for advertising.
2. How we use your information
We use your information to:
- Create and run your account and sign you in
- Schedule and publish your posts at the times you choose, and retry a post that fails
- Keep your connected accounts working, and tell you when one needs to be reconnected
- Show you how your published posts are performing
- Write caption suggestions when you ask the AI caption generator
- Process payments and renewals, send receipts and prevent payment fraud
- Send you emails about your account, such as your welcome email, trial reminders, receipts, failed payment notices, plan changes, posts that did not go out, reconnection notices and replies to your support messages
- Give you support and fix problems. When fixing a problem, our support team may retry a post that failed, which publishes the content you already scheduled.
- Measure and improve Khula, using analytics, performance data and error reports
- Measure how well our ads work
- Keep Khula secure, prevent abuse and enforce our Terms of Service
- Meet our legal obligations, such as tax and accounting rules and lawful requests from authorities
We do not use your posts, or the data we receive from your connected social media accounts, for advertising, and we do not use them to train AI models.
We do not currently send marketing newsletters. If we start, every one will have an unsubscribe link.
Legal bases
The Nigeria Data Protection Act 2023 and, where they apply to you, the EU and UK General Data Protection Regulations require us to have a legal basis for each use of your information.
| What we do | Legal basis |
|---|---|
| Running your account, publishing your posts, keeping connections working, AI captions you ask for, payments, account emails and support | Performing our contract with you |
| Analytics, learning how people find Khula, performance monitoring, error reports and session replays, security, fraud prevention, staff activity logs and improving Khula | Our legitimate interest in running a reliable and secure service |
| Ad measurement with the Meta Pixel and Conversions API | Our legitimate interest in understanding which of our ads work |
| Keeping tax and accounting records and responding to lawful requests | Legal obligation |
3. The AI caption generator
When you use the AI caption generator, we send OpenAI:
- The description you type, the tone you choose and the platform the caption is for
- The caption you want to improve and your instructions, if you are refining one
- The image you choose, if you generate a caption from an image
We do not send your name, email address or any details of your connected accounts. OpenAI uses this information to write the caption and send it back to us. Under OpenAI's terms for its API, it does not use this information to train its models, and it may keep it for up to 30 days to monitor for abuse.
Captions are suggestions. Nothing is published until you add the caption to a post and schedule it.
4. Google and YouTube data
Khula uses YouTube API Services. By connecting a YouTube channel to Khula, you agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.
What we access. If you sign in with Google: your name, email address and profile picture. If you connect a YouTube channel: your channel's ID, name and profile picture, permission to upload videos, and the view, like and comment counts for videos you upload through Khula.
How we use it. Only to provide the features you see in Khula: signing you in, uploading the videos you schedule, showing which channel is connected and showing how your uploaded videos are performing.
How we share it. We do not share Google user data with anyone, except the hosting and database providers that run Khula for us, YouTube itself when you publish a video, or where the law requires it.
How we store it. Access tokens and channel details are kept in our database, which is encrypted at rest, and access to it is restricted.
Limited Use. Khula's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- We do not use Google user data for advertising, including personalised, retargeted or interest-based ads.
- We do not sell Google user data.
- We do not use Google user data to train generalised AI or machine learning models.
- No person at Khula reads your Google user data unless you give us permission, it is needed for security or to comply with the law, or it is aggregated and anonymised for internal operations.
Revoking access and deleting your data. You can disconnect your YouTube channel in Khula at any time, which deletes its access tokens immediately. You can also remove Khula's access on your Google security settings page. To have the rest of your Google data deleted, see section 10.
5. Meta, TikTok, X and LinkedIn data
We use the data we receive from these platforms only to provide the features you use in Khula, and in line with each platform's developer terms. We do not sell it, use it for advertising, or share it with anyone except the providers that run Khula for us and the platform itself when you publish.
Khula is not affiliated with, endorsed by or sponsored by Meta, TikTok, X, LinkedIn or Google.
As well as disconnecting an account in Khula, you can remove Khula's access from the platform itself:
- Facebook: Settings and privacy > Settings > Business integrations
- Instagram: Settings > Apps and websites
- TikTok: Settings and privacy > Security and permissions > Apps and services permissions
- X: Settings > Security and account access > Apps and sessions > Connected apps
- LinkedIn: Settings > Data privacy > Permitted services
- Google and YouTube: Google security settings
6. Who we share information with
We do not sell or rent your personal information.
Service providers. We use these companies to run Khula. They may only use your information to provide their service to us.
| Provider | What they do for us | Information involved |
|---|---|---|
| Supabase | Database, sign-in and file storage | Everything stored in your account, including access tokens |
| Vercel | Hosts the website and app, and measures page speed (Speed Insights) | Every request to Khula, including your IP address and country |
| Cloudflare | Stores and serves the images and videos you upload | Your media files |
| OpenAI | Writes AI caption suggestions | What you give the AI caption generator (section 3) |
| Paystack | Processes payments | Your email address, plan, amount and card details |
| Resend | Sends our emails | Your name, email address and the email's contents |
| Sentry | Error monitoring and session replay | Technical and usage information, error details and replays |
| Google (Analytics) | Measures how Khula is used | Pages visited, device and approximate location, Google Analytics cookie IDs |
| Meta (Pixel and Conversions API) | Measures our ads | Page views, the sign-up event, hashed email address and account ID, IP address and browser details |
Social media platforms. When you publish, we send your content to the platform and account you chose. Once it is published, that platform's own terms and privacy policy apply to it.
Legal reasons. We may share information if the law requires it, or to protect the rights, property or safety of Khula, our users or others, including to prevent fraud.
Business transfers. If Khula is merged with or bought by another company, your information may be transferred as part of that deal. We will tell you before your information becomes subject to a different privacy policy.
7. Cookies and browser storage
| Name | Set by | Purpose | How long it lasts |
|---|---|---|---|
| sb-...-auth-token | Khula (Supabase) | Keeps you signed in | Until you sign out |
| oauth_state, oauth_code_verifier | Khula | Secures the process of connecting a social media account | 10 minutes |
| khula_start_trial | Khula | Tells the Meta Pixel that a new account was created with Google sign-in | 10 minutes, deleted after first use |
| khula_first_touch | Khula | Remembers how you first reached Khula (the website or link that sent you), so it can be recorded if you sign up | 90 days |
| khula_cookie_notice | Khula | Remembers that you have seen our cookie notice | 1 year |
| _ga, _ga_* | Google Analytics | Tells visits apart so we can measure usage | Up to 2 years |
| _fbp, _fbc | Meta | Ad measurement | Up to 90 days |
We also keep your theme preference and time zone in your browser's local storage, and Sentry uses your browser's session storage to record session replays. Vercel Speed Insights does not use cookies.
The cookie notice in the app tells you about these cookies. Google Analytics and the Meta Pixel load when you open Khula. You can block or delete cookies in your browser settings or with a content blocker. Khula needs the sign-in cookies to work, but blocking Google Analytics or Meta cookies will not affect how Khula works for you. You can also use the Google Analytics opt-out add-on and manage how Meta uses your data in your Meta ad preferences.
8. Where your information is stored
Khula is based in Nigeria, but our service providers store and process information in other countries, including the United States, and Cloudflare serves media from data centres around the world. When we transfer your information outside Nigeria, or outside the EU or UK if you live there, we rely on the safeguards the law allows, such as the standard contractual clauses in our providers' terms, or on the transfer being necessary to provide the service you asked for.
9. How long we keep information
| Information | How long we keep it |
|---|---|
| Your account, workspaces, posts, drafts, content ideas, media, connected account details and post results | For as long as your account exists, including after a trial ends or you cancel, so you can pick up where you left off. You can delete most of it yourself at any time (section 10). |
| Access tokens for social media accounts | Until you disconnect the account, delete its workspace or delete your Khula account |
| Data used while connecting an account | 10 minutes |
| Payment records | For as long as tax and accounting laws require, even after your account is deleted |
| Support messages and staff notes | For as long as your account exists, or longer if we need them to resolve a dispute |
| Records of staff actions on accounts | For as long as we need them for security and to investigate problems |
| Error reports and session replays | Up to 90 days |
| Analytics and advertising data | According to Google's and Meta's own retention periods |
| Backups | Deleted copies stay in our provider's backups until those backups are replaced on their normal cycle |
10. Deleting your data
Disconnect a social media account. Go to Settings > Workspaces and disconnect the account. Its access tokens are deleted immediately. Posts already published stay on the social media platform; delete them there if you want them removed.
Delete a workspace. Go to Settings > Workspaces and delete the workspace. This permanently deletes its scheduled posts, drafts, content ideas, posting goals and connected accounts. This cannot be undone.
Delete your Khula account. Email support@khula.app from the email address on your account, with the subject "Delete my account". We will cancel any active subscription first so you are not charged again, then delete your account and everything in it, including your workspaces, posts, media, connected accounts and access tokens, within 30 days. We keep payment records only as long as the law requires.
Remove Khula from a platform. See the links in section 5.
11. How we protect your information
- All connections to Khula are encrypted with HTTPS.
- Our database and file storage are encrypted at rest by our providers.
- Each account can only read its own workspaces, posts and connected accounts, which is enforced inside the database.
- You connect social media accounts through each platform's official login, so we never handle your passwords for those platforms. Your Khula password is stored as a one-way hash.
- Card details are handled by Paystack, which is certified to the PCI DSS card security standard.
- Only a small number of Khula staff can access account information, and only to provide support and run the service. Sensitive actions, such as viewing billing details or changing a plan, are logged with the name of the staff member who did it.
Images and videos you upload are stored at long, random web addresses, because social media platforms need to fetch them from a link when we publish. These links are not listed or searchable, but they are not password protected: anyone who has the exact link can open the file.
No system is perfectly secure. If a data breach affects your personal information, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, and notify you without undue delay where the law requires.
12. Your rights
Under the Nigeria Data Protection Act 2023 and, depending on where you live, other laws such as the EU and UK GDPR, you have the right to:
- Access the personal information we hold about you and get a copy of it
- Correct information that is wrong or incomplete. You can change your name, email address, password and profile picture yourself in Settings.
- Delete your information (section 10)
- Receive your data in a structured, machine-readable format, or have it sent to another service
- Object to us using your information on the basis of our legitimate interests, including for ad measurement
- Restrict how we use your information while a concern is being looked into
- Withdraw your consent at any time where we rely on it
- Complain to a data protection authority
To use any of these rights, email support@khula.app. We may ask you to write from the email address on your account to confirm it is you. We will reply within 30 days, and it is free.
If you are not happy with our answer, you can complain to the Nigeria Data Protection Commission. If you live in the EU or UK, you can also complain to your local data protection authority.
13. Children
Khula is only for people aged 18 and over. We do not knowingly collect information from anyone under 18. If we learn that we have, we will delete it. If you believe a child has given us personal information, email support@khula.app.
14. Automated decisions
Khula does not make decisions about you through automated processing that have legal or similarly significant effects on you. Automated features such as publishing at your scheduled times, applying your plan's limits and renewing your subscription follow the settings and plan you chose.
15. Changes to this policy
When we update this policy, we will change the "Last updated" date at the top. If a change is significant, we will email you or show a notice in the app before it takes effect.
16. Contact us
Khula Technologies Limited
RC 9741707
8 Abudu Odusanya Street, Magodo Phase 1, Lagos, Nigeria
Email: support@khula.app