Privacy policy

01Who we are

Cherry Cowboys Inc., a Delaware corporation at 1314 Magnolia Ave, Los Angeles, CA 90006, runs Keta and decides how your data is used. This policy covers the Keta site, sign-in, checkout and the studio.

02What we collect

• Account: your email address and when you sign in.
• Payments: plan, amount, coin, network, transaction hash and status.
• Studio: your uploads, prompts, settings and the videos you make.
• Groupbuys: the code you use, or the request an admin sends.
• Support and reports: what you write and the contact details you give.
• Visits and sign-ins: IP address, device, browser and rough location, for security.
• Connected apps: the apps you approve and what they send for you.

03Your uploads and videos

Uploads are stored privately, in a folder only your account can open. Other Keta users can’t see them. A file you upload twice is kept once.

To make a video, the uploads that render uses are copied to the file storage of Keta’s processing backend, a third-party storage service, for the render. Each copy sits at a public link that can’t be guessed.

The backend sends your prompt and those copies to the video model provider, which renders the video. The finished video comes back to your library.

04Training

Keta doesn’t train AI models on your uploads, prompts or videos.

The video model provider’s terms let it use content sent to it to improve its models, unless an enterprise agreement says otherwise. So treat what you send to render as shared with that provider for that purpose.

05Who holds it for us

• Supabase: accounts, orders, uploads and studio records.
• Paymento (Prokey Technologies Inc.): crypto invoices and payment status.
• Cloudflare: hosting, bot checks and the country of each visit.
• Railway: hosts Keta’s processing backend, which sends your renders to the video model provider.
• A third-party storage service used by that backend: copies of the uploads a render uses.
• The video model provider: prompts and uploads, to render your videos.
• Resend: the emails we send you.
• Your browser’s push service (Google, Mozilla, Apple or Microsoft), only if you turn on notifications: the address it gives your browser, and each notification, encrypted so only your browser can read it. Turn them off any time in Settings.
• OpenAI’s moderation service: prompts sent from connected apps, and images they add to your library, checked before rendering or storing.

Apps you connect, such as ChatGPT or Claude, also get what they ask Keta for, at your request. Their makers hold it under their own privacy policies, not for us. See connected apps.

We don’t sell your data or share it for advertising. We give data to authorities only when the law requires it, or to report child sexual abuse material.

06Location and sanctions checks

Cloudflare tells us roughly where each visit comes from, worked out from the IP address. Checkout uses the country to keep out sanctioned regions. We never ask for your precise location.

Rate limits use a salted hash of your IP address. Security records keep the address itself; see the next section.

07Devices and sign-ins

To keep accounts safe, prevent fraud and allow one active session per account, we record each sign-in, each video you start in the Studio, and each time a session moves to a new network or browser.

A record holds:

• Network: your IP address, your network provider (its ASN and name), and connection details (HTTP and TLS versions, the Cloudflare data centre that served you, and Cloudflare’s bot signals where our plan includes them).
• Location: roughly where you are, as Cloudflare works it out from your IP address (country, region, city, postal code, rough coordinates and time zone).
• Browser: the user agent (browser, operating system, device type and model), the client hints and the languages your browser sends.
• Device summary, sent by Keta’s pages: screen size and pixel ratio, time zone, languages, platform, processor threads, device memory, touch points, and a code made from these that stays the same on the same device.

Only Keta staff can see these records. We keep them for 12 months, then delete them. A new sign-in ends your other sessions.

08Connected apps

You can connect an AI app, such as ChatGPT or Claude, to your Keta account. When you do, we receive and keep:

• The connection: the app’s name, what you allowed it to do, and when you connected, last used or disconnected it.
• The browser you approved it in: a salted hash of its IP address, and its user agent.
• What the app sends for you: prompts, the library items and settings you pick, support messages and codes.
• Refusals: a prompt or an added image from an app that our checks refuse, or a prompt the video model provider blocks, and the rule it broke (we don’t keep a refused image).

Videos an app starts keep no device record; we record the browser you approved it in once, when you connect.

We use this to make the videos you ask for, to keep your account secure and to enforce the acceptable use policy. Prompts from connected apps, and images they add to your library, are also checked by OpenAI’s moderation service before rendering or storing.

The app’s provider, such as OpenAI for ChatGPT or Anthropic for Claude, receives what the app asks Keta for: your pass, today’s count, a masked email, your library’s names, your videos’ prompts, status and links, and anything else you ask about. Its privacy policy applies.

If you run a groupbuy, the app’s provider also receives its roster when you ask: each member’s initials, masked email, seat status and dates. If you’re in a groupbuy, its owner sees the same, in the Studio and in apps they connect.

We keep a connection’s record while your account is open, and refusals from apps for 12 months.

Disconnect an app any time in the Studio, under MCP, or at ketagen.com/oauth/apps/ without a pass; it loses access within seconds. Videos it made stay in your History until you delete them.

09Cookies and storage

Keta keeps a few small items in your browser. Some are needed for the site to work; the rest wait for your OK. Change your choice any time under Privacy choices, in the footer of Keta’s site and in the Studio’s account menu. Keta uses no analytics or advertising cookies.

Strictly necessary, always on:

• keta_session: Keeps you signed in. Page scripts can’t read it. Up to 30 days, or until you sign out.
• keta_consent: Remembers the privacy choices you make. 12 months.
• keta-onboarding: Holds a sign-in or payment you started in this tab. Until you close the tab.
• keta-studio-draft: Holds the Studio prompt you haven’t sent yet. Until you close the tab.
• keta-studio-rail-v1: Holds your Studio queue as this tab last showed it, so the next Studio page shows it at once. Until you close the tab.
• keta-studio-rail: Remembers whether you folded the Studio queue, in this tab. Until you close the tab.
• keta-studio-cards: Remembers the card size you picked on Create, in this tab. Until you close the tab.
• keta-studio-keys: Remembers whether single-key shortcuts are on, in this tab. Until you close the tab.
• keta-studio-chimed: Remembers which videos already played the finish sound, so none plays twice. Until you close the tab.
• Keta notifications (service worker): A small Keta script and your browser’s push address, kept only once you turn on notifications. Until you turn notifications off or sign out.
• keta-invite: Holds an invite link you opened in this tab until you claim it. Until you close the tab.
• keta-focus-carry: Tells the next step of sign-in or payment whether to move keyboard focus to its heading. Until you close the tab.
• keta_oauth: Ties an app you’re connecting to Keta to this browser while you approve it. Page scripts can’t read it. 10 minutes.
• keta_code: Carries a groupbuy code you entered through the sign-in link, so checkout shows your group’s price. 2 hours, or until it is used.
• Cloudflare Turnstile: Checks that a form or sign-in comes from a person; Cloudflare may store its own data for it. Set by Cloudflare.

Preferences, only with your OK:

• keta-theme: Your light or dark theme. Until you change it.
• keta-studio-posters: Preview frames drawn from your videos. Until you close the tab.
• keta-studio-rail-keep: Remembers whether you folded the Studio queue, on this device. Until you change it.
• keta-studio-cards-keep: Remembers the card size you picked on Create, on this device. Until you change it.
• keta-studio-keys-keep: Remembers whether single-key shortcuts are on, on this device. Until you change it.
• keta-studio-player-loop: Remembers whether Studio videos loop, on this device. Until you change it.
• ketaIntro: Plays a page’s opening motion once per visit. Until you close the tab.
• ketaStudioDemo: Plays the home page’s generator once per visit. Until you close the tab.

Referrals, only with your OK (how a referral counts: the referral program terms):

• keta_ref: The referral link that brought you here, so its owner gets credit. 30 days.

Until you choose, nothing optional is stored. Turning a group off removes what it stored. If your browser sends Global Privacy Control, we treat it as a no to both, unless you choose otherwise here.

10How long we keep it

• Account and studio records: while your account is open.
• Uploads and videos: until you delete them or close your account.
• Payment records: as long as tax and accounting law requires.
• Reports: as long as handling them, and the law, requires.
• Device and sign-in records: 12 months.
• Connected apps: while your account is open. Refusals from apps: 12 months.

11Your choices and rights

You can ask to see, correct, export or delete your data, or object to how we use it. Ask through the support form or at hello@ketagen.com, from the email on your account. We reply within one month.

In the EU, the UK and California the law gives you these rights, and you can complain to your data protection authority.

12Security

You sign in with one-time email links. Payment and storage keys stay on our servers, never in your browser. No system is perfectly safe; if a breach affects your data, we tell you.

13Where data is processed

Keta is run from the United States. Our providers may process data in the US and other countries, under the safeguards the law requires.

14Children

Keta isn’t for children under 13. We don’t knowingly collect data from them, and we delete it if we find we have. Where your country sets a higher age for agreeing to data use (up to 16 in parts of the EU), someone younger needs a parent’s or guardian’s consent.

15Changes to this policy

We post changes here and email you before a significant change takes effect.

16Contact

Email hello@ketagen.com, write through the support form, or by post to Cherry Cowboys Inc., 1314 Magnolia Ave, Los Angeles, CA 90006, United States.