Kaku Privacy Policy

Last updated: October 12, 2026 Version: 1.4

This English version is a translation of the original Spanish text, which prevails in the event of any discrepancy unless this version is more favorable to you as a consumer.

1. Data Controller

• Company name: Axis Software Solutions, S.L.
• Tax ID (NIF): B05614516
• Registered office: Avenida del Oeste, 24, planta 4, puerta 11, 46001 Valencia, Valencia, Spain
• Email: hello@kaku-app.site
• Telephone: +34 680 300 658
• Registration details: Commercial Registry of Valencia, Sheet V-237783, 1st Entry

"Kaku" is the trade name under which Axis Software Solutions, S.L. (hereinafter, "we" or the "Controller") provides the platform accessible at kaku-app.pro.

2. Scope of This Policy

This policy explains how we process the personal data of the people who register for and use Kaku (the "Users"). It is not a contract that you have to accept: it informs you, and it is supplemented by the Terms of Use.

It is important to distinguish between two levels, because the role we play in each is different:

• Your account data (identity, payments, use of the service): here we act as data controller, and this is what this policy governs.
• The content of your WordPress sites that the platform reads and modifies: there you act as controller and we act as processors on your behalf. We describe this in Section 11.

3. What Data We Process

3.1. Data You Provide When You Register

• Name and email address.
• Password, which is always stored transformed by means of a hashing algorithm (bcrypt) and which we never keep or can view in plain text.
• If you sign in with Google: Google provides us with your Google account identifier, your email address, your name, your profile picture and the language declared in your profile; we store the identifier, the email address, the name and the language. We do not receive or store your Google password.
• The language in which you use the application: when you register, that of your browser, and afterwards the one you choose.
• The date and version of the Terms of Use that you accepted when creating the account.
• Your consent to commercial communications, if you give it: when you gave it, the text you accepted, where you gave it and, where applicable, when you withdrew it (Section 4.1).

3.2. Payment Data

Paid plans and credit packs are purchased through Stripe, by means of its Managed Payments service. Under that service, a subsidiary of Stripe, Sold through Link, LLC ("Link"), acts as merchant of record: it is the party that charges you, calculates and passes on the taxes and issues your invoice. That is why the charge appears on your statement as LINK.COM* KAKU.

• What Stripe asks you for on its payment page: your name, your billing address, your payment method details and, if you provide it, your tax identification number. That page is hosted by Stripe and we do not store that data in Kaku: when Stripe notifies us of the payment it includes your name and your address, but we do not keep them. The data remains in our Stripe account, where we can consult it to handle a payment issue. We never see your card details.
• What we provide to Stripe: your email address and an internal identifier of your account, in order to associate the payment with it.
• What we receive from Stripe: the customer and subscription identifiers, the plan purchased, the billing option (monthly or annual), the status and dates of the billing period, whether the subscription is scheduled to be canceled and, for pack purchases, the pack, the quantity, the amount and, if you are refunded, when and how many credits are removed as a result.

Stripe and Link process the data they collect at payment as independent controllers, in accordance with their own policies (Section 5.2).

3.3. Data about Your Sites and Your Configuration

• The URL of each WordPress installation that you connect, its name and its connection status.
• The plugin version installed and technical data about your site's environment (PHP and WordPress versions, detected plugins), which we use for diagnostics.
• The configuration that you define for each site: industry, business description, tone, languages and tool preferences.
• Your site's domain, when the welcome credits are obtained with it (Section 7).

3.4. Service Usage Data

• Credit consumption by tool and period, necessary to apply your plan's limits.
• Technical logs of the operations that you run (generations, synchronizations, publications), including their errors.

3.5. Technical Connection Data

• IP address and user agent (browser and operating system), associated with your active session.
• Your IP address is also used, temporarily, to limit the number of registration, sign-in and password recovery attempts from the same source, as an anti-fraud measure.
• The country you connect from, inferred from your IP address or, where that is not possible, from your browser's regional settings, to show you prices in its currency. We do not store the country: we store the billing currency when you purchase a subscription.
• The origin of your visit, if you arrive at Kaku from one of our campaign pages: the campaign the link comes from (source, medium, name, term and content), the page you came from and what you chose in its cookie notice. If you accepted marketing cookies there, also the ad click identifier. We remember it during your session and store it in your account when you create it.

3.6. Communications with Us

When you write to us from the contact form, we store the message, its reason and the technical context that the application collects automatically (active site, plan, plugin version, language and user agent). If you reply by email to one of our responses, we also store the text of your reply, the address you write from and the names of the attached files.

3.7. Google Search Console Data

If you connect your Google Search Console account, Google provides us, with the permission you grant: the email address of the connected Google account, the permissions granted, the access tokens (which we store encrypted), the Search Console properties that you link to your sites and the search metrics that we query from them (queries, pages, clicks, impressions and average position), which we cache for a maximum of one hour. We do not send that data to the artificial intelligence provider or use it for advertising.

The use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. You can withdraw the permission whenever you wish from the integrations section of your account or from your Google account.

4. Why We Process Your Data and on What Legal Basis

We do not disclose your data to third parties for commercial purposes or use it for advertising by other companies. The only disclosure related to advertising is the one we make to Google Ads to measure and personalize our own ads, and only if you consented to it (Section 5.2). The only commercial communications you could receive are about Kaku, under the terms of Section 4.1.

We do not carry out profiling or automated decision-making that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR).

4.1. Commercial Communications

Not all the emails we send you are the same, and the difference matters:

• Service emails. The confirmation of your account, password recovery, the confirmation of each purchase, the notice before an annual plan renews, notices of changes to the service or to these documents, and the acknowledgment of and replies to your queries. They are part of the service you have contracted, so you will receive them for as long as you have an account, and it is not possible to unsubscribe from them separately. Receipts and invoices for your payments are sent to you by Link, not by us.
• Commercial communications. News, improvements and offers from Kaku. We will only send them to you if you have given us your consent, by ticking the box on the sign-up form or turning them on in your profile. It is not required to use the service, and if you do not give it you will not receive any.

You can withdraw that consent at any time and free of charge: from the email preferences section of your profile and, in each commercial message you receive, through a direct unsubscribe link. Unsubscribing does not affect service emails, your subscription or anything you have already contracted.

We never send third-party advertising or give your address to anyone so that they can do so.

4.2. Which Data Is Mandatory

To create the account we need your name, your email address and a password (or your Google account), and for you to accept the Terms of Use: without them we cannot provide you with the service. To buy a plan or a pack, Stripe needs the payment details it asks you for on its page. The rest—the configuration of your sites, the connection with Search Console, the messages you write to us—you provide if you want to use that part of the service.

5. Who Else Has Access to Your Data

To provide the service we rely on providers that act as data processors on our behalf, or as independent controllers where their own relationship with you so determines. They only receive what they need for their function:

5.1. Artificial Intelligence Provider

The AI tools are provided through Google (Gemini API). This is the most far-reaching processing on the platform, so it is worth being precise about what leaves your site and what does not.

What is sent to it. The content of the pages, articles, product pages and images of your sites on which you run a tool, together with their URLs and titles; the catalog data of those product pages (price, stock, categories and attributes); the links on your pages with their text, when the linking is analyzed; as context, parts of other pages of your site—when links are proposed, the title, the headings and some paragraphs of the candidate pages; when a topic is suggested for an article, the titles of your posts and pages, drafts included, so as not to repeat them—; the instructions you write; your site's address and the configuration you define for it (industry, description of your business, tone and languages); and, when a post is updated, the top Google results for its keyword, with the title and snippet of the third-party pages that appear in them.

Most of it is already public. Almost all of that content is published on the internet: anyone can read it, and search engine crawlers have been doing so for a long time. Sending it to the provider does not make it available to anyone who could not already consult it.

But not all of it. There are four cases in which content that the public cannot see does leave your site:

• Draft posts, pages and product pages. The platform synchronizes them together with the published ones, so that you can work on them before publishing them.
• Your entire media library, including the images you uploaded and never used on any page.
• Password-protected published posts. For WordPress their status is still "published", so they are included like any other post even though their content is protected.
• Published content restricted to registered users by a membership or restricted-content plugin: the platform reads the content of the post as it is stored, without going through those restrictions.

Private posts, posts pending review, scheduled posts and posts in the trash are never read or sent.

Nothing is filtered or anonymized. The content travels exactly as it is on your site. If it contains personal data of third parties—testimonials, biographies, published contact details, photographs of people—that data is transmitted as well, whether it is published or not.

We do not transmit your identity to it. The request does not include your name, your email address, your user identifier or your IP address: it is made by our server and authenticated with a single platform key, not with a credential of yours. As stated above, your site's address and the business description you have written do travel.

You can set aside what you do not want to send. From the settings of each site you can mark pages, images or product pages as excluded from AI processing. Whatever you mark stops being sent to the provider in all the tools at once, until you unmark it: neither its title nor its address travels as context for another page that links to it or that uses the same image. The mark is kept when you synchronize the site again, including if the post goes through the trash or stops being published and later comes back. What the exclusion cannot prevent is the sending of what another, non-excluded page contains: if its text cites the excluded page, links to it or embeds one of its images, that forms part of that other page. This is the intended route for content that must not leave your WordPress: a legal notice, a product page with third-party data, a page under a confidentiality agreement.

What Google does with it. We use the paid Gemini API. According to its terms, Google does not use the requests or the responses to improve its products or to train its models; it retains them for a maximum of 55 days, solely to detect and prevent prohibited uses and to respond to legal requests, and it may store them in any country where it operates. With respect to that content, Google acts as data processor.

You are responsible for deciding on which content you run the tools.

5.2. Other Providers

In addition, in order to operate on your sites, the platform communicates directly with your WordPress installation, and when checking your site's links it makes requests to the external domains that you link to.

6. International Transfers

Some of the above providers are established outside the European Economic Area, or may access the data they process from outside it:

DataForSEO (Estonia) and Bunny Fonts (Slovenia) are located in the European Union.

These transfers are covered by the safeguards provided for in Chapter V of the GDPR: the recipient's adherence to the EU-U.S. Data Privacy Framework, where it exists, and otherwise the European Commission's standard contractual clauses incorporated into its terms. You can ask us for a copy of those safeguards by writing to hello@kaku-app.site.

7. How Long We Keep Your Data

While your account is active, we keep the data necessary to provide you with the service.

When you delete your account, the following are deleted immediately: your account data, your connected sites and all the content associated with them—including the generated articles, their images and the copies of your sites' content that the platform had stored—, your support messages, your open sessions on any device and any pending password recovery links. At the same time, we cancel your paid subscription, if you have one, and revoke the Search Console access you had granted us.

Exceptions and specific periods:

• Payments: the data that Stripe and Link collect at payment, and the invoices they issue, are kept by them in accordance with their own obligations and policies, independently of your Kaku account. The customer record with your email address also remains in our Stripe account and is kept together with those payments.
• Invoices issued by Kaku: if at any time we issue you an invoice of our own, it is kept for the period required by commercial and tax legislation, even after you delete your account. The right to erasure does not extend to it (Art. 17(3)(b) GDPR). When the account is deleted, the invoice is no longer linked to it; what remains is the tax data already printed on the invoice itself.
• Welcome credits: we store the domain of the site with which they were obtained, linked to your account while it exists. When you delete it, we keep only the domain, without any data that identifies you: this is what prevents the same site from obtaining them again, and it is kept for as long as we offer those credits.
• Support notifications: each message you write to us also reaches us as an email notification; those copies may remain in our mailbox after the account is deleted.
• Session: your session expires after 30 days of inactivity. If you check "Remember me" when signing in, the browser keeps you signed in for up to 400 days.
• Link analyses: the three most recent analyses of each site are kept, with the address, the title and the text of the links on each analyzed page, even if the page was deleted afterwards; earlier ones are deleted automatically. The linking suggestions you generated are kept for as long as the site exists.
• Cached copies: temporary working copies expire after one hour, with three exceptions: the internal link map of an analysis and the list of categories of your catalog last up to 24 hours, and the icons of the sites, up to 7 days. What has expired is physically deleted within the following hour.
• Application technical logs: these are kept for 7 days in our hosting provider's logging service and are deleted automatically. They record which operation was run and how it ended—your site's address, your user identifier and, when your WordPress or a provider responds with an error, the beginning of that response—and are used to diagnose incidents.
• Failed jobs: when a background operation does not succeed, its record is kept for 14 days so that it can be retried and we can find out what happened; it is then deleted. It mainly contains references to what was being processed and the error message, although in some cases it includes fragments of its content: the instructions for an article revision, or titles or addresses of pages.
• Password recovery: the links expire after one hour and are deleted daily.
• Backups: the database has backups that allow its state to be restored for 7 days. Whatever is deleted ceases to exist in them, at the latest, at the end of that period.

8. Your Rights

You can exercise the following rights at any time:

• Access: to know what data of yours we process.
• Rectification: to correct data that is inaccurate. You can do this yourself from your profile.
• Erasure: to delete your account and your data, from your account settings or by writing to us.
• Objection: to object to processing based on our legitimate interest; to commercial communications, directly from your profile.
• Withdrawal of consent: where processing is based on your consent, to withdraw it whenever you wish, without affecting the lawfulness of the processing carried out before its withdrawal.
• Restriction: to request that we suspend the processing while a complaint is being resolved.
• Portability: to receive your data in a structured, commonly used format.

To exercise them, write to us at hello@kaku-app.site from the address associated with your account, or by any other means that allows your identity to be verified. We will respond within one month. You can also request the data that Stripe and Link collect at payment directly from them.

In addition, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or with the supervisory authority of the European Union Member State in which you reside or work, at any time and without first having to contact us.

9. Security

We apply technical and organizational measures to protect your information. In particular:

• Passwords are stored by means of hashing and never in plain text.
• Access tokens for services that you authorize (such as Search Console) are stored encrypted.
• The data for your second authentication factor, if you enable it, is stored encrypted.
• Communication with the platform always takes place over an encrypted connection (HTTPS).
• Access to your account can be protected with two-step verification, the use of which we recommend.

No system is completely secure, so we cannot guarantee absolute security.

10. Cookies and Storage in Your Browser

Kaku does not use advertising, analytics or tracking cookies, whether third-party or first-party. There are no pixels, no analytics tools and no browsing profiling.

If you arrived from one of our ads and accepted marketing cookies on that page, we tell Google Ads, from our servers and without cookies or pixels in the application, that the click ended in a sign-up, a connected site or a purchase, to measure our ads and personalize the ones Google shows you (Section 5.2). You can withdraw that consent at any time by writing to us (Section 8).

All the cookies we use are technical cookies, necessary for the application to work, to protect it or to remember your preferences, and they are exempt from the requirement of prior consent:

The session cookie is HttpOnly (not accessible from JavaScript), travels encrypted and uses the SameSite=Lax policy.

In addition, the application stores some interface preferences in your browser's local storage (language, theme and tool options), which you can delete from your browser settings. Of these, only the language is also stored in your account, so that we can write our emails to you in it; the rest does not leave your device.

When the interface loads, your browser requests the fonts from Bunny Fonts, an external provider, which therefore learns your IP address. Apart from that, your browser communicates with our own infrastructure—including the domains of our hosting provider from which the generated images and the real-time updates are served—and with your own content: the interface loads the thumbnails of your images and products from your WordPress and, when you review a draft, the images included in the content, from wherever they are hosted. When you pay or sign in with Google, your browser goes to Stripe's or Google's page. The icons of the sites, on the other hand, are served to you by our own server.

11. The Content of Your WordPress Sites

When you connect a site, the platform reads its content and stores it in order to be able to work on it: pages and articles, image library, product catalog and link structure.

That content may include personal data of third parties (for example, of your customers, authors or persons mentioned). With respect to that data:

• You are the data controller and we act as processors on your behalf, following your instructions, under the terms of the Data Processing Agreement set out in Annex I to the Terms of Use.
• We only process that content in order to provide you with the service you request.
• As indicated in Section 5.1, that content is transmitted to the artificial intelligence provider when you run a tool on it, and you can exclude from that sending the pages, images or product pages that must not leave your site.
• You must ensure that you have a sufficient legal basis for that processing and that you have informed the persons concerned, in accordance with Section 12.3 of the Terms of Use.

This content is deleted when you delete the site from the platform or delete your account, and it is updated each time the site is analyzed: whatever you delete or unpublish in your WordPress is no longer on the platform after the next analysis, and the posts and pages that you send to the trash leave the tools immediately. Link analyses already performed keep what they saw, for the period set out in Section 7. There is one deliberate exception: if, in an analysis, the media library or the catalog arrives completely empty, what was there is kept, because an empty response from your site cannot be distinguished from a temporary failure; in that case, if you really have emptied it, delete the site or write to us.

What is your own work done in Kaku—the generated articles, the translations already published and the linking suggestions—is kept as history for as long as the site exists on the platform, even if you delete in WordPress the post from which it came.

Disconnecting a site does not delete it: it stops being synchronized and the tools stop operating on it, but what has already been copied remains stored so that you can reconnect it without losing your work. If you want nothing to remain, delete the site.

12. Minors

Kaku is not directed at minors. When you register, you declare that you are of legal age, in accordance with Section 1.4 of the Terms of Use. If we detect that an account belongs to a minor, we will delete it.

13. Changes to This Policy

We may update this policy to adapt it to legal, technical or service changes. We will publish the version in force on the platform with its update date and will inform you of substantial changes by appropriate means, with reasonable advance notice.

14. Contact

For any matter relating to this policy or to the processing of your data:

Axis Software Solutions, S.L. Avenida del Oeste, 24, planta 4, puerta 11, 46001 Valencia, Valencia, Spain hello@kaku-app.site