Legal

Privacy Policy

Last updated: October 15, 2026

This is the English version. The same policy is available in Spanish. Both versions describe one single policy; where wording differs, it is a translation difference and not a difference in practice.

1. Who we are

DEFUP LLC ("we", "us") is the entity responsible for processing the personal data collected through Klidio (klidio.app). We are a limited liability company formed in Florida, USA.

Address: 7901 4TH ST N STE 300, ST PETERSBURG, FL 33702-4399
Contact email: hola@klidio.app
WhatsApp: +1 786 945 7083

2. What data we collect

From businesses and ambassadors (users of the Service):

  • Full name and email address.
  • Mobile phone or WhatsApp number.
  • Payment information (processed and stored by Stripe, not by us).
  • Usage data: pages visited, actions taken, IP address, browser type.
  • The consent you give to receive messages, with its date and time and the exact text you accepted.

From customers (uploaded by the businesses):

  • Full name and WhatsApp number.
  • Email address (optional).
  • Service or product received (free text).

Important: Businesses are responsible for obtaining their customers' consent before uploading their data. We act as a data processor.

3. How we use your data

  • To provide the Service (sign-up, authentication, referral management).
  • To process payments through Stripe.
  • To send you messages via WhatsApp or SMS (through Twilio) and by email: login codes, account notices, platform notifications and, if you gave that consent, promotional communications. Reply STOP to stop receiving them, START to receive them again and HELP for help.
  • If you are a customer of a business that uses Klidio, to send you emails on behalf of that business, and only that business, about its referral program and your appointments with that business (for example, rebooking one you missed), if you joined it, or about its news and promotions, if you ticked that optional box when booking. We never send you promotions from Klidio or from other companies. You can unsubscribe from those emails at any time; your appointment notices keep arriving even if you unsubscribe.
  • To improve the Service (aggregate usage analysis).
  • To comply with legal obligations.

4. SMS and WhatsApp Messaging

This section describes specifically what data we use to send you text and WhatsApp messages, how often you can expect to receive them, and what we do — and never do — with your mobile phone number.

We do not share your number or your consent

We do not share, sell, or otherwise disclose your mobile phone number or your messaging consent data to third parties or affiliates for marketing or promotional purposes.

The only exception is the technical provider that physically delivers the message (Twilio, and through it Meta’s official WhatsApp API). That provider receives only what is strictly necessary to deliver the message you asked for, acts on our instructions, and is prohibited from using your number for its own purposes.

If you take part as an ambassador, the business you work with sees your name and your WhatsApp number. This does not contradict the above: that business is not a third party but the counterparty of the program you chose to join, and it receives your data solely to credit your commission and pay it to you — never for marketing. The full breakdown of who sees what is in the "Who sees what" section of this policy.

What data we use for messaging, and how

To send you messages we use only the following data, and only for the stated purposes:

  • Your mobile phone number: this is the delivery address. Without it there is no message. We take it from the sign-up form where you entered it.
  • Your name: so we can address you personally and so you recognize the message as yours and not a bulk blast.
  • Your consent, with its date and time and the version of the text you accepted: so we can demonstrate that we messaged you with your permission, and stop the moment you withdraw it. This record is used to prove permission — never as a list to send you more messages.
  • Your activity data within the platform: the appointment you booked, the sale that closed, the reward you earned, or the challenge you have active. These determine which message applies and when, and are never used for advertising profiling.
  • Message delivery status: sent, delivered, or failed — so we do not keep retrying a number that bounces, and so we can help you if something did not arrive.

How often you will receive messages

Message frequency depends on your own activity. These are the system’s actual limits:

  • Login codes (OTP): only when you request one to access your account.
  • Appointment reminders: up to 2 per appointment: one 24 hours before and one 2 hours before.
  • Account notifications: appointment confirmed, cancelled, or rescheduled; reward earned; payment confirmed. These occur only when the corresponding event happens.
  • Ambassador challenges: up to 1 message per day while you have an active challenge. Each challenge lasts 7 days and only one is active at a time.
  • Daily summary for business owners: up to 1 per day, and only on days when there is something to report.
  • Promotional communications: up to 1 per day as an absolute cap, and only if you gave that separate consent. In practice they are far less frequent.

Costs

Message and data rates may apply. Klidio does not charge you for receiving these messages, but your mobile carrier may charge you according to your plan.

How to stop receiving messages

Reply STOP to any message to cancel, or HELP for help. We also accept BAJA and CANCELAR. Opting out is immediate and free of charge.

Opting out of promotional messages does not affect your account or your appointments. Strictly transactional messages that you trigger yourself — such as your login code — keep working, because without them you could not sign in.

Consent to receive promotional messages is not a condition of using Klidio.

5. Who we share data with

We only share data with providers necessary to operate:

  • Stripe — payment processing (card data).
  • Twilio — sending WhatsApp and SMS messages.
  • Resend — delivery of our emails and hosting of our email contact list (address, first name and last name).
  • Meta — measuring the effectiveness of our advertising. It receives your email address and phone number after we convert them into an irreversible code (SHA-256 hash), never in readable form, along with technical browsing data.
  • Google — optional OAuth authentication and Google Tag Manager to administer our measurement tags.
  • Hostinger — server hosting.
  • Cloudflare — anti-bot protection (Turnstile).
  • Sentry — technical error monitoring, which may include data from the request that failed.
  • PostHog — product analytics. It receives usage events without name, email address or phone number.

We do not sell your data to third parties. We do not use it for third-party advertising.

Mobile phone numbers and messaging consent data will not be sold, rented, or shared with third parties or affiliates for marketing or promotional purposes. The providers listed above receive only what is strictly necessary to deliver the message you asked for, and may not use it for their own purposes.

6. Who sees what

Klidio connects three parties and, for the program to work, some of each party's data is visible to another. Here is exactly who sees what, with no fine print.

The business owner sees, about the ambassador who generated a sale for them: full name, WhatsApp number and referral code. This lets the business recognize and contact whoever brought them the customer. In addition, only at the moment of recording the commission payment, the owner sees the ambassador's Bre-B payment key, because that is the account they must transfer to. It is not visible at any other time or on any other screen.

Important for ambassadors: our promise not to share your phone number with third parties refers to marketing or promotional purposes, whether ours or anyone else's. The business you work with is not a third party: it is the counterparty of the program you chose to join, and it receives your data solely to credit your commission and pay it to you.

The business sees, about the customer who books: their name, WhatsApp number, email address if provided, and the service they booked or received. It is the business that will serve them.

If you say no: if you leave a business's referral program or decline its invitation, we let that business know. If you ask to stop receiving our WhatsApp messages (STOP), we let each business where you are a customer know, so it knows your appointment notices no longer reach you there. If you come back, we let them know too.

The ambassador who referred them sees, about the customer: their name and the amount of the commission credited, so they can verify it corresponds to a referral they actually made. The ambassador does not see which service the customer received, nor their phone number, email address or any other data.

The customer sees, about the ambassador: their name, because they are the person who referred them.

Klidio personnel: a small number of people on our team access personal data only when necessary to provide support, handle a complaint, verify a payment or comply with a legal obligation. Each person holds only the permissions their role requires: our ambassador support team, for example, sees names, challenge status and activity, but does not see amounts, payment data or any business information. Phone numbers are displayed masked, and revealing one leaves a record of who did it and when. We do not sell or transfer this data.

7. Where data is stored

Our servers are hosted in the United States (Hostinger). If you or your customers are in another country (Europe, Latin America), this involves an international data transfer. By using the Service you accept that transfer.

8. How long we keep data

  • Active account: for as long as the account is active.
  • After cancellation: up to 30 days to allow reactivation. After that it is deleted or anonymized.
  • Legal and accounting data: we keep payment information for 7 years to meet tax obligations.

9. Your rights

You have the right to:

  • Access the data we hold about you.
  • Correct inaccurate data.
  • Delete your account and personal data.
  • Export your data in a readable format.
  • Object to or restrict processing.
  • Withdraw consent at any time, including messaging consent: reply STOP to any message or use the unsubscribe link in the footer of our emails.
  • Come back whenever you want, on your own: reply START to receive our WhatsApp messages again; use the «Volver a recibir» button on the email unsubscribe page or ask for it from your wallet (we send an email to that address so you can confirm it; all newsletter emails to that address come back); and if you left a business's referral program, write VOLVER to our WhatsApp from your number or sign in to your wallet. Each return is recorded with its date, the channel and the text you accepted.

To exercise these rights, write to us at hola@klidio.app. We respond within 30 days at most.

10. Cookies and tracking

We use strictly necessary cookies to:

  • Keep your session signed in (JWT in localStorage).
  • Remember preferences.
  • Run our own analytics of anonymous visits through a random identifier stored in the browser.

Before sign-up we measure pages visited, source campaign, device type, video playback and sign-up clicks. We do not store name, email or WhatsApp number during that journey; the IP address is kept only as an irreversible hash. If the person creates an account, the journey is linked to that record to calculate conversion. We honor the browser's "Do Not Track" and Global Privacy Control signals.

We use the Meta pixel to measure the effectiveness of our advertising. You can turn it off through the ad preferences of your Meta account or through your browser's privacy signals, which we honor. We do not use advertising cookies to build profiles about you or to sell them to anyone.

11. Security

We apply reasonable measures to protect your data:

  • HTTPS connections with Let's Encrypt certificates.
  • Passwords hashed with bcrypt.
  • JWT tokens signed with a strong secret.
  • Rate limiting and anti-bot protection.
  • Regular security updates.

That said, no measure is 100% secure. If we detect a breach affecting your data, we will notify you within 72 hours at most, as required by applicable regulations.

12. Minors

The Service is not directed to people under 18. We do not knowingly collect data from minors. If you discover that a minor uploaded data, contact us to delete it.

13. Retention of messaging consent

We keep the record of your consent — which text you accepted, on what date, and for which number — for as long as you have an account and up to 5 years afterwards, because it is the evidence that lets us demonstrate we messaged you with your permission. That record is not used to message you: if you withdraw consent, we stop sending promotional messages immediately even though the record still exists.

14. Changes to this policy

We may update this policy. If the changes are substantial, we will notify you by email at least 14 days in advance.

15. Contact and complaints

For privacy questions or complaints: hola@klidio.app or WhatsApp +1 786 945 7083.

If you believe we have not handled your complaint properly, you may contact the data protection authority in your country (in Colombia: Superintendencia de Industria y Comercio).