Last updated: September 2026
Kitsuly respects your privacy and is committed to handling personal information responsibly, transparently and securely.
This Privacy Policy explains how Kitsuly collects, receives, uses, stores, shares, protects and deletes information when you use the Kitsuly website, Kitsuly Commerce software, connected services, applications, integrations, support services, marketing services and other products or services made available by Kitsuly.
This Policy also explains how information received through third-party platforms, including Meta Platforms, Facebook and Instagram, may be processed when a user chooses to connect those services to Kitsuly.
By accessing or using Kitsuly, creating an account, installing Kitsuly software, connecting a third-party service or otherwise providing information to Kitsuly, you acknowledge the practices described in this Privacy Policy.
Where required by law, Kitsuly will obtain consent before collecting or processing particular categories of personal information.
1. Who We Are
Kitsuly provides ecommerce software, website-building tools, marketing features, customer-management functionality, integrations and related services designed primarily for WordPress-based businesses.
References in this Privacy Policy to “Kitsuly”, “we”, “our” or “us” refer to the operator of Kitsuly and the Kitsuly services.
References to “you”, “your”, “user” or “customer” may include website visitors, Kitsuly account holders, merchants, administrators, customers, subscribers, developers and other individuals who interact with Kitsuly.
Questions concerning this Privacy Policy or your personal information may be directed to:
Kitsuly Privacy & Support
Email: support@kitsuly.com
Website: https://kitsuly.com
2. Scope of This Privacy Policy
This Privacy Policy applies to information processed through:
- the Kitsuly website;
- Kitsuly Commerce;
- Kitsuly accounts;
- Kitsuly support and contact services;
- Kitsuly email and marketing systems;
- Kitsuly applications and APIs;
- integrations with third-party services;
- connected Facebook and Instagram services;
- Meta Platform APIs;
- social-media publishing tools;
- ecommerce and payment-related functionality;
- mailing-list and subscription functionality;
- analytics and diagnostic services;
- and other Kitsuly services that link to this Privacy Policy.
This Policy does not govern the independent privacy practices of third parties such as Meta, Stripe, Google, shipping carriers or other external providers.
Those providers maintain their own privacy policies and terms.
3. Information We May Collect
The information Kitsuly processes depends on which services you use and which features you choose to connect.
We may process the following categories of information.
Account Information
When you create or manage a Kitsuly account, we may receive information such as:
- name;
- business name;
- email address;
- telephone number;
- username;
- account identifiers;
- website or domain;
- account role;
- billing information;
- subscription or licence information;
- account preferences;
- and communications relating to your account.
Website and Technical Information
When you access Kitsuly services, certain technical information may be processed automatically, including:
- IP address;
- browser type;
- operating system;
- device type;
- approximate geographic region derived from an IP address;
- referring URL;
- pages visited;
- dates and times of access;
- session identifiers;
- cookie identifiers;
- application logs;
- error logs;
- diagnostic information;
- security events;
- and other technical information required to operate or protect the service.
Store and Ecommerce Information
Where Kitsuly is used to operate an ecommerce store, the relevant Kitsuly installation may process information including:
- customer names;
- billing addresses;
- shipping addresses;
- email addresses;
- phone numbers;
- order information;
- product information;
- purchase history;
- shipping information;
- transaction references;
- return and refund information;
- booking information;
- subscription status;
- account information;
- support requests;
- and customer communications.
The individual merchant operating the Kitsuly store may be independently responsible for how customer information is collected and used through that store.
4. Facebook, Instagram and Meta Platform Data
Kitsuly may allow users to connect supported Facebook, Instagram or other Meta services.
Kitsuly only requests access to information and permissions that are reasonably required to provide the features selected by the user.
Depending on the particular Meta integration and permissions authorised by the user, Kitsuly may receive or process information such as:
- Facebook or Instagram user ID;
- Page ID;
- Instagram account ID;
- Page or account name;
- profile name;
- profile picture;
- public profile information;
- Facebook Pages that the user is authorised to manage;
- Instagram Professional accounts linked to those Pages;
- Page access tokens or other authorised access credentials;
- post identifiers;
- media identifiers;
- captions;
- images or video selected for publication;
- comments or engagement data where an authorised feature requires it;
- publishing status;
- API responses;
- account connection status;
- permissions granted to the Kitsuly application;
- and other information made available through the specific Meta Platform feature authorised by the user.
The exact information available to Kitsuly depends on the permissions approved by Meta and explicitly authorised by the user.
Kitsuly does not request a user's Facebook or Instagram password.
Authentication is handled through Meta's authorised login and permission systems.
5. How Meta Platform Data Is Used
Information obtained from Facebook, Instagram or other Meta services may be used only for legitimate Kitsuly functionality associated with the user's chosen integration.
This may include:
- connecting a Facebook Page or Instagram account to Kitsuly;
- confirming that the user has permission to manage the selected account;
- displaying connected accounts inside Kitsuly;
- allowing a user to select a destination for social-media content;
- creating or preparing social-media posts;
- publishing authorised posts, images or videos;
- displaying publication status;
- retrieving information needed to manage authorised content;
- displaying embedded Facebook or Instagram content;
- assisting with social-media campaign management;
- diagnosing connection or permission problems;
- refreshing authorised access credentials where permitted;
- preventing fraud, abuse or unauthorised access;
- and complying with applicable Meta Platform requirements.
Kitsuly does not use Meta Platform Data for purposes that are unrelated to the feature for which the data was obtained.
6. Meta Access Tokens and Authentication Information
Some Meta integrations require access tokens or similar credentials.
Where Kitsuly processes such credentials, they are used only to communicate with the authorised Meta Platform services and provide the requested integration.
Kitsuly will not knowingly disclose Meta access tokens, application secrets or equivalent credentials to unauthorised third parties.
Access credentials should be protected using appropriate technical and organisational security controls.
Where a connection is revoked, expires or is no longer required, associated credentials may be deleted, invalidated or allowed to expire in accordance with the relevant platform requirements.
Meta's current Developer Data Use Policy requires developers to protect access tokens and user IDs and restrict their transfer or disclosure. Meta Developers
7. Social Media Publishing
If a user authorises Kitsuly to publish content to a third-party social-media service, Kitsuly may transmit information selected by that user to the relevant service.
This can include:
- text;
- links;
- images;
- videos;
- product information;
- campaign information;
- captions;
- hashtags;
- scheduled publication information;
- and other content selected for publication.
Kitsuly will only attempt to publish content to an account that the user has connected and authorised.
Once content has been published to a third-party platform, that platform's own privacy policy and terms apply to the published information.
8. Information You Provide Directly
You may provide information to Kitsuly when you:
- contact support;
- submit a feature request;
- register for beta testing;
- join a mailing list;
- submit a contact form;
- purchase a product;
- create an account;
- request a refund;
- request deletion of your information;
- report a security issue;
- communicate with Kitsuly;
- or otherwise interact with the service.
This information may include the contents of your message and any files, screenshots or attachments you voluntarily provide.
9. Why We Process Information
Kitsuly may process personal information for purposes including:
- providing Kitsuly services;
- operating accounts;
- authenticating users;
- providing ecommerce functionality;
- processing transactions;
- providing customer support;
- enabling integrations;
- publishing authorised social-media content;
- providing marketing functionality;
- administering subscriptions;
- maintaining security;
- preventing fraud;
- resolving technical problems;
- improving products;
- communicating service information;
- maintaining records;
- complying with legal obligations;
- enforcing applicable agreements;
- and protecting Kitsuly, its users and third parties.
Where applicable, personal information may be processed on the basis of consent, contractual necessity, legal obligations, legitimate interests or another lawful basis recognised by applicable privacy law.
10. Payments
Where payments are processed through Kitsuly, payment transactions may be handled by third-party payment providers such as Stripe.
Kitsuly does not intend to store raw payment-card numbers, card security codes or equivalent sensitive card information directly within WordPress.
Payment providers may collect and process payment information according to their own privacy policies, security standards and contractual terms.
Kitsuly may retain transaction references and related information needed for:
- order management;
- payment reconciliation;
- accounting;
- refunds;
- dispute handling;
- fraud prevention;
- and legal or taxation obligations.
11. Mailing Lists and Marketing
A user may voluntarily subscribe to a Kitsuly mailing list or another mailing list operated using Kitsuly functionality.
Information processed may include:
- name;
- email address;
- subscription date;
- mailing-list membership;
- signup source;
- subscription preferences;
- campaign interactions;
- and unsubscribe status.
Marketing communications will contain an unsubscribe mechanism where required.
When a recipient unsubscribes, their information may be moved to an unsubscribe or suppression record so that the system can honour the request and avoid sending further marketing communications for the relevant list.
An unsubscribe record may need to be retained for the limited purpose of ensuring that the individual is not inadvertently resubscribed or contacted again.
12. Cookies and Similar Technologies
Kitsuly websites and services may use cookies or similar technologies for purposes including:
- authentication;
- session management;
- preferences;
- security;
- analytics;
- performance;
- fraud prevention;
- and maintaining essential service functionality.
Third-party integrations may also place or access cookies subject to their own policies.
Where legally required, users will be provided with appropriate choices concerning non-essential cookies.
13. Sharing of Personal Information
Kitsuly may disclose information where reasonably necessary to service providers that help operate Kitsuly.
These may include providers of:
- website hosting;
- infrastructure;
- cloud services;
- email delivery;
- payment processing;
- analytics;
- error monitoring;
- customer support;
- security;
- communications;
- and connected APIs.
Such providers should only process information as required to provide their contracted services.
Kitsuly may also disclose information:
- where required by law;
- in response to valid legal process;
- to prevent fraud or abuse;
- to protect the safety or rights of users;
- to investigate a security incident;
- or in connection with a legitimate business transfer, merger or restructuring, subject to applicable law.
Kitsuly does not sell Meta Platform Data.
14. Data Retention
Kitsuly does not intend to retain personal information indefinitely.
Information may be retained for as long as reasonably necessary to:
- provide the requested service;
- maintain an active account;
- fulfil transactions;
- maintain business and accounting records;
- comply with taxation or financial reporting requirements;
- maintain security records;
- resolve disputes;
- enforce agreements;
- honour unsubscribe requests;
- and satisfy legal obligations.
Meta Platform Data should be deleted when it is no longer necessary for the functionality for which it was collected.
Meta's current Developer Data Use Policy requires User Data to be deleted without undue delay when a user requests deletion, an account is deleted, the data is no longer required, Meta requests deletion, or applicable law requires it. Meta Developers
15. Information Security
Kitsuly uses reasonable administrative, organisational and technical safeguards intended to protect personal information from:
- unauthorised access;
- loss;
- disclosure;
- alteration;
- destruction;
- misuse;
- and unauthorised processing.
Measures may include:
- access controls;
- authenticated administration;
- encrypted connections;
- restricted credentials;
- secure API communications;
- software updates;
- logging;
- vulnerability management;
- and other appropriate safeguards.
No internet-connected system can be guaranteed to be completely secure, and users should also maintain appropriate security practices for their own accounts, WordPress installations and connected services.
16. International Processing
Kitsuly and its service providers may process information using systems located in countries other than the user's country of residence.
Where required, Kitsuly will take reasonable steps to ensure appropriate protections are applied to international transfers of personal information.
17. Your Privacy Rights
Depending on your location and applicable law, you may have rights concerning your personal information, including rights to:
- request access;
- request correction;
- request deletion;
- withdraw consent;
- object to certain processing;
- request restriction of processing;
- request data portability;
- complain to a relevant privacy regulator;
- and request information about how your data is being processed.
These rights may be subject to lawful limitations and exceptions.
Kitsuly does not charge a fee merely for making a legitimate request to delete personal information.
Meta specifically requires that the ability to request deletion be available to users regardless of their region. Meta Developers
18. User Data Deletion
Your Right to Request Deletion
You may request deletion of personal information that Kitsuly has collected or stored about you.
This includes information received through Facebook, Instagram or other Meta Platform integrations where Kitsuly retains that information.
A deletion request may be made at any time.
How to Request Deletion
Send a request to:
support@kitsuly.com
Use the subject line:
User Data Deletion Request
Please include enough information to allow Kitsuly to identify the relevant account or information, such as:
- your name;
- email address;
- Kitsuly account email address;
- store domain, where relevant;
- Facebook or Instagram account/page name, where relevant;
- and a brief description of the information you want deleted.
Do not send your Facebook password, Instagram password, access token or other sensitive credentials.
Kitsuly may request reasonable verification before completing a deletion request so that information is not deleted at the request of an unauthorised person.
19. Facebook and Instagram Data Deletion
Users who have connected Facebook or Instagram to Kitsuly can request that data obtained from Meta be deleted.
After a valid request is received, Kitsuly will take reasonable steps to delete or de-identify applicable Meta Platform Data associated with that user or connected account.
This may include:
- Meta user identifiers;
- connected Page identifiers;
- Instagram account identifiers;
- stored access credentials;
- connection metadata;
- authorised account details;
- publishing-related records where they are not otherwise required;
- and other Meta Platform Data held by Kitsuly.
Where information is stored by a service provider acting on Kitsuly's behalf, Kitsuly will take reasonable steps to ensure that the relevant information is also deleted where required.
20. Removing Kitsuly From Facebook
A user may also remove Kitsuly's access through their Facebook or Meta account.
The exact wording of Meta's interface may change, but users can generally manage connected applications through their Facebook or Meta Apps and Websites settings.
Removing the Kitsuly application from Meta prevents further authorised access using that connection.
Removal of the application from Facebook does not necessarily delete information that Kitsuly was previously required to retain for lawful purposes.
If you want previously stored information deleted as well, submit a User Data Deletion Request using the procedure above.
21. What Happens After a Data Deletion Request
After Kitsuly receives and verifies a valid deletion request, we will identify information associated with the requesting user and delete, anonymise or otherwise permanently disassociate that information where appropriate.
Where technically and legally possible, deletion will include information stored in active systems.
Some information may remain temporarily in secure backups until those backups are rotated or expire.
Information may also be retained where necessary for purposes such as:
- legal compliance;
- taxation;
- accounting records;
- fraud prevention;
- dispute resolution;
- security investigations;
- enforcing legal rights;
- maintaining an unsubscribe suppression record;
- or another purpose permitted or required by law.
Where information cannot legally or reasonably be deleted, it will be retained only for the applicable purpose and should not continue to be used for unrelated purposes.
Meta's privacy requirements expressly expect a privacy policy to explain the deletion path and justify cases where deletion may not be fulfilled. Meta Developers
22. Confirmation of Deletion
Where appropriate, Kitsuly will provide confirmation when a verified deletion request has been completed.
A confirmation may state that:
- the deletion request was received;
- the relevant account or information was identified;
- eligible information was deleted or anonymised;
- connected Meta credentials were removed or invalidated where applicable;
- and any information that must legally be retained has been restricted to the relevant retention purpose.
23. Data Deletion Requests Received From Meta
If Meta sends Kitsuly a valid request or callback indicating that a user has requested deletion of information associated with a Kitsuly Meta integration, Kitsuly will process the request in accordance with applicable Meta Platform requirements.
Where the Kitsuly application uses an automated Meta data-deletion callback, the application may:
1. receive a signed deletion request from Meta;
2. validate the request;
3. identify the relevant Meta user;
4. remove associated Meta Platform Data from Kitsuly systems;
5. generate a confirmation code or deletion-status record where required; and
6. return an appropriate confirmation response to Meta.
Where a manual deletion-instructions URL is used instead, the publicly available deletion instructions described in this Privacy Policy will apply.
24. Deletion of a Kitsuly Account
Where Kitsuly provides an account-deletion facility, deleting an account may result in deletion or de-identification of personal information associated with that account.
Certain records may continue to be retained where required for legitimate legal, accounting, taxation, fraud-prevention or security purposes.
Deleting a Kitsuly account may also disconnect associated third-party integrations.
25. Data Held by Independent Kitsuly Merchants
Kitsuly software may be installed and operated by independent ecommerce merchants.
In those circumstances, customer data may be stored within the merchant's own WordPress website or other systems controlled by that merchant.
Kitsuly may not have direct access to that information.
If you are a customer of an independent store using Kitsuly and want information held by that store deleted, you should first contact the store operator.
Where appropriate, Kitsuly may provide the merchant with functionality or technical assistance to respond to lawful privacy requests.
26. Third-Party Services
Kitsuly may integrate with external providers including services relating to:
- Facebook;
- Instagram;
- Meta;
- Stripe;
- Google;
- shipping providers;
- analytics;
- artificial intelligence;
- email delivery;
- and other business services.
Information supplied directly to those providers is governed by their respective privacy policies.
Connecting a third-party service to Kitsuly does not make Kitsuly responsible for that provider's independent processing practices.
27. Children's Privacy
Kitsuly is intended primarily for businesses and individuals capable of entering into applicable commercial agreements.
Kitsuly does not knowingly seek to collect personal information from children in circumstances where parental or guardian consent is legally required and has not been obtained.
If you believe a child has provided personal information to Kitsuly improperly, please contact us so that the information can be reviewed and, where appropriate, deleted.
28. Legal Requirements
Kitsuly may retain, process or disclose information where reasonably necessary to:
- comply with applicable law;
- respond to valid legal process;
- protect legal rights;
- investigate suspected fraud;
- investigate security incidents;
- protect users or the public;
- or comply with lawful regulatory obligations.
Where legally permitted, Kitsuly will seek to limit disclosure to information reasonably necessary for the relevant purpose.
29. Australian Privacy
Where Australian privacy legislation applies, Kitsuly intends to handle personal information in accordance with applicable obligations under Australian privacy law, including relevant requirements concerning collection, use, disclosure, security, access and correction.
Nothing in this Privacy Policy is intended to remove rights that users may have under applicable Australian law.
30. European and United Kingdom Users
Where the GDPR or UK GDPR applies, users may have additional rights concerning:
- access;
- correction;
- deletion;
- restriction;
- portability;
- objection;
- withdrawal of consent;
- and complaints to a competent supervisory authority.
The lawful basis for processing will depend on the relevant activity and may include consent, contractual necessity, compliance with law or legitimate interests.
31. California and Other United States Privacy Rights
Residents of jurisdictions that provide additional privacy rights may exercise those rights where the relevant law applies to Kitsuly.
Such rights may include access, correction, deletion or information regarding the categories of personal information processed.
Kitsuly does not discriminate against a user merely because they exercise a privacy right available under applicable law.
32. Changes to This Privacy Policy
Kitsuly may update this Privacy Policy periodically to reflect:
- new functionality;
- changes to integrations;
- changes to legal requirements;
- changes to business practices;
- or changes to third-party platform requirements.
The current version will be published on the Kitsuly website with an updated effective date.
Material changes may also be communicated through other reasonable means where appropriate.
33. Contact Us
For privacy questions, access requests, corrections, deletion requests or concerns about how information is handled, contact:
Kitsuly
Email: support@kitsuly.com
Website: https://kitsuly.com
For deletion requests, please use the subject:
USER DATA DELETION REQUEST
We will review the request, verify identity where reasonably necessary and respond in accordance with applicable privacy obligations.
34. Meta Platform Data Commitment
Where Kitsuly accesses information through Meta Platform products, Kitsuly intends to process that information only:
- for purposes clearly disclosed in this Privacy Policy;
- for functionality authorised by the user;
- in accordance with applicable Meta Platform requirements;
- using appropriate security controls;
- for no longer than reasonably necessary;
- and subject to a clear and accessible deletion process.
Kitsuly will delete applicable Meta Platform Data when required by the user, Meta, applicable law or the end of the legitimate purpose for which the information was obtained.
IMPORTANT — I would also create this separate page
For the Meta App Dashboard, I would not rely only on the giant Privacy Policy.
Create:
/user-data-deletion/
and put this on it:
Kitsuly User Data Deletion
Kitsuly users may request deletion of personal information and data associated with Facebook, Instagram or other Meta integrations at any time.
To request deletion, email support@kitsuly.com with the subject “User Data Deletion Request.”
Please include the email address associated with your Kitsuly account and, where relevant, the Facebook Page or Instagram account connected to Kitsuly. Do not send your Facebook or Instagram password or access token.
After verifying the request where necessary, Kitsuly will delete or de-identify eligible information associated with the user, including applicable Meta user identifiers, connected-account information and stored integration credentials.
Information that must be retained for legal, accounting, fraud-prevention, security or regulatory reasons may be retained only for the required period and will not be used for unrelated purposes.
Users may also remove Kitsuly's access through their Facebook or Meta Apps and Websites settings. Removing the application prevents continued authorised access. To request deletion of information previously stored by Kitsuly, please also submit the deletion request described above.
Contact: support@kitsuly.com
Privacy Policy: https://kitsuly.com/privacy-policy/