Master Privacy Policy

Last updated: 2026-10-16 · GDPR-compliant · Effective for all Koss Flow ecosystem services

1. Data Controller

Individual Entrepreneur (ФОП) Kostyniuk Ihor Valeriiovych, Tax ID (РНОКПП) 3593802718, Ukraine. Contact for privacy: koss.flow@gmail.com.

2. What We Collect

Category	Data	Purpose	Lawful Basis
Account	Email, password hash, name, avatar URL	Authentication, SSO across apps	Contract
Profile	Per-app data (CVs, transactions, conversations)	Service delivery	Contract
Telegram (optional)	chat_id, bot token (encrypted AES-256-GCM)	Push notifications, support	Consent
Payments	Order ID, amount, gateway tx ID, saved card token	Subscription billing	Contract + Legal obligation (UA tax law ст.44 ПКУ — 3 years)
Usage	Page views, feature usage, push subscriptions	Quota tracking, observability	Legitimate interest
Analytics	Server access logs and page events on kossflow.com (no cookies, no IP, no third parties)	Product improvement	Legitimate interest
Telegram business chats (only when the owner's reply assistant is enabled)	Telegram ID, name and @username of the other person in a chat with the owner, recent messages of that chat	Drafting replies the owner checks before sending	Legitimate interest (keeping up with the owner's own conversations)
Contact form (kossflow.com)	Name, the contact you enter (email, Telegram or phone), chosen package, message, page language, time of the request	Replying to your request, preparing an offer	Steps at your request before a contract (GDPR Art. 6(1)(b))

The contact form needs no account and sets no cookies. Your IP address is used only in memory to limit abuse of the form, for at most an hour after your last request, and is never written to disk. Web server access logs on kossflow.com do not record the IP address your request comes from, cookies, or request headers other than three: the browser name (User-Agent), the referring site without its path or query, and whether the request is a prefetch. They also keep the time and the page requested, without its query string (so campaign tags such as utm or gclid are not stored). The page itself reports a few events (page view, clicks on buttons and links, a sent form) by a script request to the same site; these carry only the event name, the page language, the page section and button name, and whether the screen is phone-sized or wider. If your browser sends Global Privacy Control, the page reports no events. Access logs are used to count visits and clicks and are deleted after 30 days at most.

3. Where Data Lives

All databases self-hosted on Hetzner servers in EU (Helsinki/Falkenstein). Storage: Supabase Postgres, MinIO S3-compatible. Backups: encrypted daily archives (password-protected, file list encrypted too) on the owner's computer and in Google Drive; the 14 most recent are kept.

4. Sub-Processors

Service	Purpose	Data Shared
Hetzner	Hosting infrastructure	All data (encrypted at rest)
Namecheap	DNS only	Domain queries
OpenAI	AI generation (BYOK or platform key)	CV text, prompts (no PII unless user inputs it)
Anthropic	Claude AI (HR services)	Same as OpenAI
Groq	Llama inference (Voice/Chat)	Conversation messages
Google Drive	Storage of encrypted backup archives	Encrypted archives only (Google cannot read them)
Google OAuth	Login provider	Email + profile (only on consent)
Telegram	Login + bot push (optional)	tg_id + message payloads
Telegram	Delivering contact-form requests to the owner	Contents of your request
Groq	Draft replies in the owner's Telegram business chats (only when enabled; every draft is checked by a human before sending)	Recent messages of that chat
WayForPay / MonoPay	Payment processing	Order amounts, no card data stored on our servers
Monobank API	Budget transaction sync (opt-in)	OAuth token (encrypted), transactions
Glitchtip	Error tracking (self-hosted)	Stack traces, error context

5. Cross-App Data Flow

Single Supabase project — your account + base profile + cross-app notifications (`kf_notifications`) + referrals (`kf_referrals`) shared. Per-app data (CVs, transactions, conversations) isolated in separate schemas (`public`, `money`, `messenger`). Row-Level Security (RLS) enforced on all tables — you only access your own rows.

6. AI Processing

BYOK (Bring Your Own Key): for HR AI services you can use your own OpenAI/Anthropic key — your prompts go directly to provider, never stored on our servers. Platform keys: prompts stored ≤ 30 days for debugging, deleted thereafter.

7. Cookies

Essential cookies only:

kf_theme — your theme (dark/light) across subdomains
kf_lang — UI language
theme and lang in your browser's localStorage on kossflow.com — your theme and the page language, never sent anywhere
coach_subdomain — white-label branding (HR Coach plan only)
Supabase session token in localStorage (per-origin)

No tracking cookies, no third-party advertisers. Visit counting uses no cookies.

8. Your Rights (GDPR)

Access: download all your data via Settings → Export (JSON + CSV)
Erasure: Settings → Account → Delete (purges all data; payment_orders anonymized for 3 years per UA tax law)
Portability: JSON export, machine-readable
Rectification: edit profile in Settings
Withdrawal of consent: revoke per-feature in Settings (Telegram, OpenAI BYOK, Google Drive, Monobank)
Complaint: file with your local DPA OR Ukraine Personal Data Protection Office

9. Data Retention

Active account: indefinitely
Deleted account: purged within 30 days
Payment records: 3 years (UA Tax Code ст.44 ПКУ)
Contact-form requests: 12 months after the request, then deleted from our server; the notification the owner receives stays in the owner's own Telegram history. If a request leads to a contract, it is kept as part of the contract records
Telegram business chats (messages, reply drafts, the other person's Telegram ID, name and @username): 180 days after the last message
Backups: the 14 most recent daily encrypted archives; data deleted from the live database leaves the backups as they rotate out, usually within two to three weeks
Logs: 30 days, then deleted

10. Security

HTTPS via Let's Encrypt (Caddy auto-TLS)
HSTS, CSP frame-ancestors, X-Content-Type-Options nosniff
Rate limiting (60 req/min per IP, 10/min for AI endpoints)
Bearer auth for API (Supabase JWT, 7-day expiry, auto-refresh)
RLS on all tables
BYOK keys + Telegram tokens AES-256-GCM with key versioning
Push payload sanitization
WebAuthn biometric available (opt-in)

11. Children

Services not directed to children under 14. Age gate at signup.

12. Changes

Material changes notified via in-app + email. Continued use = acceptance.

13. Per-App Specifics

Koss Flow CV Privacy Notice → (CV and job data specifics)
Kosht Privacy Notice → (financial data specifics)
Chat Privacy Notice → (customer conversations)