Privacy Policy

Kallysto (“we”, “the platform”) is a service that lets content creators build a personal page, receive reactions and financial support (“boosts” and PIX donations) from their audience, and subscribe to paid plans with extra features. This policy explains what data we collect when you use Kallysto, how we use it, and who we share it with, in line with Brazil's General Data Protection Law (LGPD — Law No. 13,709/2018).

Account data. Name, email, and username are required to create an account. If you sign up with email and password, the password is stored encrypted (hashed). If you sign in with Google or Twitch, we receive your account ID, name, email, and profile photo from the provider — never your Google/Twitch password.

Profile picture and banner. The image pulled from Google/Twitch on first login, or the image you upload manually (stored with our image provider).

Payout data (creators). If you set up boost payouts, we store the PIX key and key type you register, used exclusively to send payouts to you.

Payment data (supporters). When you send a boost or a PIX donation, we collect the payer's name and CPF (Brazilian tax ID) — required by our payment processor (Asaas) to issue the PIX charge.

Subscription data. If you subscribe to a paid plan, your email and an internal identifier are sent to Stripe to process billing. Your card details are entered and processed directly by Stripe — Kallysto never has access to your card number.

Public content you choose to share. Bio, social links, content links, visual theme, merch products, and other settings on your page are shown publicly to anyone who visits your profile.

Technical data. IP address (used to limit abuse/spam on reaction submissions and to log profile visits) and cookies, detailed in section 4.

• Create and authenticate your account, and keep you signed in;
• Process subscription, boost, and donation payments, and send the payouts owed to creators;
• Display your public profile and the content you chose to publish;
• Send operational emails: signup confirmation, email verification, payment failure or renewal, subscription cancellation;
• Prevent abuse, fraud, and spam (e.g. limiting how many reactions the same IP can submit in a short time);
• Comply with legal, tax, and regulatory obligations tied to payment processing.

We do not use your data for targeted advertising, and we do not sell personal data to third parties.

We use an authentication cookie to keep your session active (1-day expiry), a temporary cookie during social login (expires in 5 minutes, used only for login-flow security), and, if you arrive at Kallysto through a referral link, a cookie that stores the referral code for 30 days.

When you send a boost or donation, your name and CPF may be saved in your browser's local storage (localStorage) just to pre-fill the form on future visits — this data stays only on your device and isn't sent to us from there. You can clear it by clearing the site's data in your browser.

We don't use third-party tracking cookies or pixels (Google Analytics, Meta Pixel, etc.) — all profile-visit metrics are processed internally by Kallysto.

We only share data with service providers strictly necessary to run the platform, each responsible for protecting the data they receive:

• Stripe — subscription and card payment processing;
• Asaas — PIX charge and payout processing (receives the payer's name/CPF and the creator's PIX key);
• Image provider (Cloudinary/Bunny) — storage of profile pictures, banners, and uploaded images;
• Google and Twitch — only when you choose to sign in with those accounts (social login);
• Resend — delivery of the transactional emails mentioned in section 3.

We may also share data if required by law, court order, or to protect the rights, safety, or property of Kallysto or others.

Name, username, bio, photo, banner, ambassador badge (if any), tags, follower count, your current plan, visual theme, social and content links, merch products, and whether you have reactions enabled are visible to anyone visiting your page.

We never publicly display: email, password, social login IDs, your actual PIX key (we only show whether you have one registered, not what it is), supporters' CPF, referral code, or any identifier coming from Stripe.

We keep your data for as long as your account exists. You can delete your account at any time in settings (for password-based accounts; if you signed in only via Google/Twitch and never set a password, contact us to delete the account manually).

Deleting your account permanently erases your profile, space, boosts, donations, and visit history. Some records that involve other people — for example, a reaction you sent on another creator's page, or a referral invite you accepted — may be kept unlinked from your identity (without associating them with you), to preserve the history for whoever received them.

At any time, you can request:

• Confirmation that we process your data, and access to it;
• Correction of incomplete, inaccurate, or outdated data;
• Deletion of your personal data (subject to legal exceptions and section 7);
• Information about who we share your data with;
• Withdrawal of consent, where applicable.

To exercise any of these rights, contact us at the email below.

Passwords are stored hashed (never in plain text), connections to the platform use HTTPS, and access to sensitive data (like PIX keys and CPF) is restricted to what's needed to process payments. No system is 100% risk-free — if we identify a security incident affecting your data, we will notify you as required by the LGPD.

Kallysto is not directed at anyone under 18. If you believe an account belongs to a minor, please contact us.

We may update this policy periodically. Material changes will be communicated by email or a notice on the platform. The date at the top of this page always reflects the latest version.