Master Privacy Policy

Last updated: 2026-05-08 · GDPR-compliant · Effective for all Koss Flow ecosystem services

1. Data Controller

Individual Entrepreneur (ФОП) Kostyniuk Ihor Valeriiovych, Tax ID (РНОКПП) 3593802718, Ukraine. Contact for privacy: koss.flow@gmail.com.

2. What We Collect

Category	Data	Purpose	Lawful Basis
Account	Email, password hash, name, avatar URL	Authentication, SSO across apps	Contract
Profile	Per-app data (CVs, transactions, conversations)	Service delivery	Contract
Telegram (optional)	chat_id, bot token (encrypted AES-256-GCM)	Push notifications, support	Consent
Payments	Order ID, amount, gateway tx ID, saved card token	Subscription billing	Contract + Legal obligation (UA tax law ст.44 ПКУ — 3 years)
Usage	Page views, feature usage, push subscriptions	Quota tracking, observability	Legitimate interest
Analytics	Anonymized via Umami self-hosted (no cookies, no IP)	Product improvement	Legitimate interest

3. Where Data Lives

All databases self-hosted on Hetzner servers in EU (Helsinki/Falkenstein). Storage: Supabase Postgres, MinIO S3-compatible. Backups encrypted, retention 30 days.

4. Sub-Processors

Service	Purpose	Data Shared
Hetzner	Hosting infrastructure	All data (encrypted at rest)
Cloudflare	DNS only	Domain queries
OpenAI	AI generation (BYOK or platform key)	CV text, prompts (no PII unless user inputs it)
Anthropic	Claude AI (HR services)	Same as OpenAI
Groq	Llama inference (Voice/Chat)	Conversation messages
Google OAuth	Login provider	Email + profile (only on consent)
Telegram	Login + bot push (optional)	tg_id + message payloads
WayForPay / MonoPay	Payment processing	Order amounts, no card data stored on our servers
Monobank API	Budget transaction sync (opt-in)	OAuth token (encrypted), transactions
Glitchtip	Error tracking (self-hosted)	Stack traces, error context

5. Cross-App Data Flow

Single Supabase project — your account + base profile + cross-app notifications (`kf_notifications`) + referrals (`kf_referrals`) shared. Per-app data (CVs, transactions, conversations) isolated in separate schemas (`public`, `money`, `messenger`). Row-Level Security (RLS) enforced on all tables — you only access your own rows.

6. AI Processing

BYOK (Bring Your Own Key): for HR AI services you can use your own OpenAI/Anthropic key — your prompts go directly to provider, never stored on our servers. Platform keys: prompts stored ≤ 30 days for debugging, deleted thereafter.

7. Cookies

Essential cookies only:

kf_theme — your theme (dark/light) across subdomains
kf_lang — UI language
coach_subdomain — white-label branding (HR Coach plan only)
Supabase session token in localStorage (per-origin)

No tracking cookies, no third-party advertisers. Umami analytics is cookieless.

8. Your Rights (GDPR)

Access: download all your data via Settings → Export (JSON + CSV)
Erasure: Settings → Account → Delete (purges all data; payment_orders anonymized for 3 years per UA tax law)
Portability: JSON export, machine-readable
Rectification: edit profile in Settings
Withdrawal of consent: revoke per-feature in Settings (Telegram, OpenAI BYOK, Google Drive, Monobank)
Complaint: file with your local DPA OR Ukraine Personal Data Protection Office

9. Data Retention

Active account: indefinitely
Deleted account: purged within 30 days
Payment records: 3 years (UA Tax Code ст.44 ПКУ)
Backups: 30 days rolling
Logs: 30 days, then deleted

10. Security

HTTPS via Let's Encrypt (Caddy auto-TLS)
HSTS, CSP frame-ancestors, X-Content-Type-Options nosniff
Rate limiting (60 req/min per IP, 10/min for AI endpoints)
Bearer auth for API (Supabase JWT, 7-day expiry, auto-refresh)
RLS on all tables
BYOK keys + Telegram tokens AES-256-GCM with key versioning
Push payload sanitization
WebAuthn biometric available (opt-in)

11. Children

Services not directed to children under 14. Age gate at signup.

12. Changes

Material changes notified via in-app + email. Continued use = acceptance.

13. Per-App Specifics

HR Privacy Notice → (CV/job data specifics)
Budget Privacy Notice → (financial data specifics)
Chat Privacy Notice → (customer conversations)