KarthosKarthos
Privacy Policy
Karthos is a professional tool. This page explains, in plain words, what the platform records, why, with whom, for how long, and how to exercise your rights.
Key points
- Karthos sells no data, shows no ads, sets no cookies and uses no audience-measurement tools.
- We process what the service needs: your account, your agency's content and the requests sent to artificial intelligence.
- To run, Karthos relies on providers based in the United States: Cloudflare (hosting), Anthropic, Google and OpenAI (artificial intelligence), Higgsfield (videos, when your agency makes one), Resend (emails).
- To access, correct or delete your data: wassimbenarab@gmail.com. We reply within 30 days. You can also delete your account yourself, in Settings > Account.
Contents
Who we are
Karthos (karthos.pages.dev) is a web platform that helps communication agencies plan and produce their social media content with artificial intelligence agents, and follow it up as a team.
The data controller is Wassim Ben Arab, Tunisia. For any question about your data: wassimbenarab@gmail.com.
Who this policy is for
- members of agencies who have a Karthos account;
- people who request access;
- visitors of the karthos.pages.dev website.
The content your agency enters (brand profiles, briefs, deliverables) remains your agency's. If it contains information about people, for example a contact at a client, your agency must be entitled to use it; Karthos only processes it to provide the service to your agency.
The data we process
Your account
Name, email address, role in the agency (owner, admin or member), agency, interface language, account creation date and last sign-in date. Your password is never stored in clear text: we only keep a hash of it (PBKDF2-SHA-256, random salt, 100,000 iterations).
Your access request
Email address, name, agency name, requested plan, hash of the chosen password or Google identifier if you use Google, request status and, where applicable, the reason for refusal.
“Continue with Google”
Google sends us a proof of identity. When you sign in, we check that your email address is confirmed by Google, then find your account by that address; nothing else is stored. If you request access with Google, your request keeps your email address, your name and your Google identifier; your name is then used to identify you within your agency. Karthos has no access to your mailbox, your files or any other Google service.
Your sessions
When you sign in, a random session token is created; it is kept in your browser and on our server and expires after 30 days. We also record the type of device derived from the browser (for example “Chrome on Windows”) and the sign-in dates, to show you your open sessions: an account has only one active session at a time. Your browser also keeps a randomly drawn identifier, sent when you sign in, to recognise a new sign-in from the same browser (it says nothing about you and stays tied to the session). We do not store your IP address in our database. Our host processes it to route requests, our server keeps it in memory to limit the number of requests per minute, and it may appear in our server's technical logs, kept by the host and erased within 7 days at most.
Your agency's content
Brand profiles (identity, tone, audiences, networks, volumes, links), brand memory, briefs, produced deliverables (editorial calendars, stories, visuals, activations, reports…), statuses and remarks of the monthly board, learned corrections and rules, the Planner's remarks and the agents' confidence alerts (the latest 300 and 200), production log (who launched what and when), key dates of the month and the agency template.
Images (generated visuals, logos, brand reference photos; PNG, JPEG or WEBP up to 10 MB) and videos made from a visual (MP4) are stored under an address that cannot be guessed. Anyone who has this address can view the image or video. Brand reference documents imported by the team (PDF, Excel, Word, PowerPoint, CSV, text or photo, up to 25 MB) are stored the same way and can only be downloaded. A photo, capture or document removed by the team is deleted from storage within the following hours, unless it is used elsewhere.
Your exchanges with Karthos, written and spoken
Written messages and the transcript of what you say to Karthos are sent to the artificial intelligence service that prepares the answer.
For voice, Karthos uses your browser's speech recognition, which sends the audio to its online service to transcribe it: Google for Chrome, Microsoft for Edge; Apple for Safari and for every browser on iPhone and iPad, which may also transcribe on the device depending on the model and language.
Listening for “Hello Karthos” is off by default: it only starts if you turn it on yourself in Settings > Account, on the “Passive listening” line, and have allowed the microphone for Karthos; the browser then shows its recording indicator. While it is on and the Karthos tab is displayed, what is said near the microphone, including by other people, is continuously sent to that service, and Karthos only looks for the words “Hello Karthos” in the transcribed text. Listening stops as soon as the tab goes to the background or the window is minimized, and only resumes when you come back to the tab. You can turn it off at any time in the same place and talk to Karthos only by clicking its button.
To read its answers aloud, Karthos prefers the browser's most natural voices. Some of them work online: the text of the answers is then sent to the same service.
Use of the service
The number of requests to artificial intelligence services and the volume used, per month, per agency and per user, to apply the limits of your plan.
Your profile photo
It stays only in your browser.
What is stored on your device
Karthos sets no cookies and uses no advertising and no audience-measurement tools. It uses browser storage (localStorage, sessionStorage and IndexedDB) for:
- your session and your account information;
- your preferences: language, theme, sound, keyboard shortcuts, “Hello Karthos” listening;
- a local copy of your agency's data, so the platform stays fast;
- the profile photo described above.
Signing out deletes your session, but not this local copy. To erase everything from a device, delete the site data of karthos.pages.dev in your browser settings.
When loading the pages, your browser also contacts Google Fonts (typefaces), Google Identity Services (the “Continue with Google” button) and cdnjs or jsDelivr (the library that creates PowerPoint files). As with any website, these services receive your IP address and your browser's technical information. The “Continue with Google” button is displayed by Google in a frame of its own page: Google may use its own cookies there, under its own rules.
Why we process it
- to create and manage your account and your agency's, and sign you in;
- to provide the service: plan and produce content, share it among agency members, keep the history;
- to send you a link if you forgot your password;
- to protect the platform (sessions, request limits) and apply the plan limits;
- to answer you when you write to us.
This processing is necessary for the service your agency requested. Voice and integrations are optional: they depend on your choice.
Karthos sells no data, does no advertising, builds no advertising profiles and does not use your content to train artificial intelligence models. Artificial intelligence providers process requests under the terms of their API offering (see below).
How long we keep it
| Data | Period |
|---|---|
| Account, agency and content | As long as the account or agency exists; erased by you in Settings or on request (see Data Deletion) |
| Session token | 30 days at most; erased when you sign out |
| Session history (device and dates) | Erased when you sign out, at the latest the day after the session expires (30 days), and when the account is deleted |
| Password reset link | 1 hour, single use |
| Items deleted from the History | Removed right away from the whole agency's History; their content, images and monthly board statuses are erased from the server 30 days later (only a technical marker without content remains, which prevents them from reappearing). Corrections made on these deliverables (before and after excerpts), which are used for the brand's learning, remain until the brand or the agency is deleted |
| Videos made from a visual | As long as the agency exists, or until a member deletes it. Those of a deleted brand are erased automatically after it, like its images; those of a deliverable removed from the History, 30 days after it. Higgsfield keeps its own copy for at least 7 days after it is made |
| Stored images | As long as the agency exists. Those of a deleted brand are erased automatically after it, usually within a few hours (a few days for a very large agency), except those still used elsewhere; the visuals of its deliverables are erased 30 days later, with them. Images stored without the brand's name (in practice, before the October 2026 update) that nothing uses any more, for example an old replaced logo or a directly generated visual, remain until the agency is deleted |
| Access requests, accepted or refused | Until the corresponding account is deleted or a deletion request. The hash of the chosen password is erased at the latest the day after the decision (for an accepted request, it has become the account's) |
| Scheduled agency deletion | The agency is closed right away and erased after 7 days; only a record without personal data remains (dates and number of items erased) |
| Our server's technical logs, kept by the host (requests, errors, IP address) | 7 days at most |
| Automatic database backups | 30 days at most |
| Data in your browser | Until you erase it |
Erasures on a fixed schedule (expired sessions, hashes of handled requests, items removed from the History more than 30 days ago, agencies at the end of the 7 days) are carried out every hour by an automatic task on our server; a large volume may take several runs, or a few days for a very large agency.
Security
- encrypted connections (HTTPS);
- passwords stored as hashes, never in clear text;
- a single active session per account;
- data separated by agency: an agency never sees another's;
- reset links valid for one hour and a single use;
- the platform's keys for artificial intelligence services stay on the server, never in the browser.
No measure is infallible. If you think an access to your account is not normal, write to us.
Your rights
You can ask to access your data, have it corrected, object to its processing on legitimate grounds or have it deleted. Write to wassimbenarab@gmail.com from your account's address; we reply within 30 days. You can also delete your account yourself, or your agency if you are its owner, in Settings > Account. Deletion is explained in detail on the Data Deletion page.
In Tunisia, personal data protection is governed by Organic Law No. 2004-63 of 27 July 2004. You can refer a matter to the National Authority for the Protection of Personal Data (INPDP). If you live in another country, you may also have the rights provided by that country's law.
Google and YouTube
- Karthos uses YouTube API Services for the channel connection described below. By using these features, you agree to be bound by the YouTube Terms of Service. The Google Privacy Policy also applies.
- You can revoke an application's access to your Google account at any time on your Google account permissions page.
- Karthos's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Minors
Karthos is a professional tool reserved for adults acting for an agency. It is not intended for anyone under 18.
Changes
This policy may change, in particular when a feature changes. The date at the top of the page shows the current version. For any significant change, we notify client agencies before it applies.
Contact
Wassim Ben Arab — Tunisia — wassimbenarab@gmail.com
11Connecting social media accounts
An owner or administrator of an agency can link to Karthos the accounts of the brands the agency manages: Facebook Pages, Instagram professional accounts and Meta ad accounts, TikTok accounts and YouTube channels (LinkedIn later). Each account is authorized through the official procedure of the platform concerned, and only the accounts ticked by the agency are linked. Karthos publishes nothing on these accounts.
What Karthos reads
business_managementpermission, used only to list them.user.info.basic,user.info.profile); follower, likes and video counts (user.info.stats); public videos of the last 30 days with their view, like, comment and share counts (video.list).What it is used for
Showing the brands' performance in Karthos (“See the figures”), answering the team's questions about these figures, preparing the agency's monthly report, helping the team fill in the brand sheet (tone, visual style, topics, hashtags) and, every month, comparing the brand's posts with one another (format, day, time, text length, hashtags) to draw rules for its next productions, proposed to the team and revocable. These figure-based findings are kept with the rules they support and erased with the brand or the agency. To do so, these figures and these posts (text and images) may be sent with the request to the artificial intelligence services described above, and appear in the deliverables saved in the agency's History. They are not sold, not used for advertising and never shared with other agencies.
Storage and security
Withdrawing access
Data received from Google APIs follows the Google API Services User Data Policy described in section 10. Meta's and TikTok's own rules also apply: Meta Privacy Policy, TikTok Privacy Policy.