Privacy Policy
KRAGOS · last updated 29 July 2026
This policy explains what personal information KRAGOS collects, why, and what you can do about it. It is written to meet the Protection of Personal Information Act, 2013 (POPIA).
1. Responsible party
Ecopackaging (Pty) Ltd, registration number 2014/032538/07, of 750 Nieuwhout Street, Garsfontein, Pretoria, 0081, South Africa, trading as KRAGOS. Information Officer contact: francois@kragos.app, +27 76 826 3103.
2. What we collect
- Account information — the name, work email address and organisation used to sign in.
- Content you provide — documents, records and messages you place in the platform.
- Technical information — server logs, IP address, browser type, and timestamps, kept for security and troubleshooting.
- Connected-account information — see section 4.
We do not use advertising trackers and we do not sell personal information to anyone.
3. Why we process it
To provide and secure the service, to authenticate you, to carry out the tasks you instruct, to meet legal and accounting obligations, and to communicate with you about your account.
4. TikTok connection
If you choose to connect a TikTok account, we use TikTok's official APIs and only the permissions you approve:
- Login Kit (user.info.basic) — we read your TikTok open ID, display name and avatar, solely to confirm which account is connected and show it back to you.
- Content Posting API (video.upload) — we upload a video into your TikTok account's upload inbox as a draft. Nothing is published publicly by KRAGOS. You review, edit and post it yourself from within TikTok.
Access and refresh tokens are stored server-side, are never exposed to the browser, and are used only to perform actions you initiated. We do not read your TikTok videos, followers, messages or analytics. You can revoke KRAGOS at any time in TikTok under Settings and privacy → Security and permissions → Manage app permissions; revoking immediately ends our access. To have stored TikTok data deleted, email francois@kragos.app and we will delete it within 30 days.
5. Other processors
We use Microsoft 365 for identity and email, and infrastructure hosted in South Africa. These providers process information on our instruction, under their own security obligations.
6. Retention
We keep account and content information for as long as your account is active and thereafter only as long as the law requires. Technical logs are kept for a limited operational period. Connected-account tokens are deleted on disconnection or on request.
7. Security
Access is authenticated and role-limited, traffic is encrypted in transit, credentials are held in restricted server-side storage, and actions that release information outward require explicit human approval.
8. Your rights under POPIA
You may ask what personal information we hold about you, ask us to correct or delete it, object to processing, and withdraw consent where processing rests on consent. Write to francois@kragos.app. You may also complain to the Information Regulator of South Africa.
9. Children
The service is for business use and is not directed at children.
10. Changes
We may update this policy; the date at the top reflects the current version.