Privacy Policy

Last updated: April 2026

This Privacy Policy explains how Koss Flow CV ("we", "us", "our"), operated by Individual Entrepreneur Kostyniuk Ihor Valeriiovych (Ukraine, Tax ID 3593802718), collects, uses, and protects your personal data when you use our service at cv.kossflow.com. This policy is drafted in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Law of Ukraine "On Personal Data Protection".

By creating an account or using our service, you agree to this Privacy Policy. If you do not agree, please do not use the service.

1. Data We Collect

We collect the following categories of personal data:

  • Account data: email address, name, profile photo (from Google/Telegram OAuth), authentication tokens.
  • Resume and CV data: content you enter manually or upload (PDF files), work history, skills, education, contact details, phone number.
  • Usage data: services used, AI quota usage, timestamps of actions, AI service outputs.
  • Payment data: transaction ID, amount, date of purchase. We do not store card numbers — payments are handled by WayForPay.
  • Technical data: IP address, browser type, device type, session identifiers (stored in cookies/localStorage for authentication).
  • AI provider API key (BYOK) (OpenAI or Google Gemini, if you provide your own key): stored encrypted (pgcrypto) in our database and never exposed to the client. When you use your own Gemini key, your inputs are sent to Google under your key and subject to Google's terms.
  • Telegram notification settings: Telegram bot token and chat ID (if you configure Telegram notifications in Settings). Stored encrypted and used solely to deliver notifications to you.
  • Job Hunter & Tracker data: Search profile extracted from your CV (role keywords, skills, region preference); cached CV text snapshot used for re-running analyses without re-uploading PDF (kept up to 30 days); jobs you save to Tracker (URL, title, company, your status notes); subscription preferences (region, frequency, AI re-rank settings, custom webhook URL if configured). Saved searches and Tracker data are private to your account.
  • Public job listings cache: We scrape publicly-available job postings from 21 platforms (RemoteOK, LinkedIn guest API, Indeed, work.ua, djinni.co, dou.ua, robota.ua, etc.) on your demand. Cached results (job titles, company names, locations, public URLs) are stored shared across users for 6 hours to reduce load on source sites. We do not collect any data about employers beyond what they publicly publish.

2. Legal Basis for Processing

Under GDPR Article 6, we process your data based on the following legal grounds:

  • Contract performance (Art. 6(1)(b)): Processing account data, resume data, and payment data is necessary to provide you with our services (resume generation, AI analysis, subscription management).
  • Consent (Art. 6(1)(a)): Processing your data via Google Gemini AI (free tier) — you provide explicit consent before use, and can withdraw it at any time in Settings. Processing your Telegram credentials for notifications — you provide them voluntarily.
  • Legitimate interest (Art. 6(1)(f)): Technical/usage data processing for security, fraud prevention, and service improvement. Our interest does not override your fundamental rights.
  • Legal obligation (Art. 6(1)(c)): Retaining payment records for 5 years as required by Ukrainian tax law.

3. How We Use Your Data

  • To provide and improve our AI services (resume generation, ATS optimization, etc.)
  • To authenticate you and maintain your account session
  • To process payments and manage your subscription
  • To send transactional emails (account verification, password reset)
  • To deliver Telegram/push notifications (if configured by you)
  • To detect and prevent fraud and abuse
  • To comply with legal obligations

We do not sell your data, share it for marketing purposes, or use your resume content to train AI models (unless you have explicitly consented to Google Gemini processing, which is disclosed separately at point of use).

4. Third-Party Services

We use the following third-party services that may process your data:

  • Supabase (self-hosted on our server in Germany) — database and authentication. Your data remains on our infrastructure.
  • OpenAI API (USA) — processes your resume content to generate AI outputs. OpenAI's Privacy Policy. OpenAI does not use API data for model training by default.
  • Google Gemma 4 & Gemini 2.5 Flash (USA) — free-tier AI models used only when you have explicit consent. Google may use free-tier input data to improve their models — this is disclosed at point of use. For full privacy, use BYOK or paid OpenAI services (zero-retention). Google's Privacy Policy.
  • WayForPay (Ukraine) — payment processor. Handles credit card data. We do not receive or store your card details.
  • MonoPay / Universal Bank (Ukraine) — payment processor for Pro/Max subscriptions, including saved-card recurring billing. PCI-DSS Level 1 compliant. We never see or store your card details.
  • n8n (self-hosted) — workflow automation running on our own server, used to process AI requests.
  • Google OAuth / Telegram Login — used for social login. We receive only your name, email, and profile photo.

5. International Data Transfers

Your data is primarily stored on our self-hosted servers in Germany (EU). However, when you use AI services, your resume data is transmitted to OpenAI (USA) and/or Google (USA) for processing. These transfers are governed by the respective providers' Data Processing Agreements and Standard Contractual Clauses (SCCs) as adopted by the European Commission. By using AI services, you acknowledge this transfer. You may avoid it by using only the Manual Builder (free, no AI, no data leaves our servers).

6. Cookies & Local Storage

  • Authentication cookies — strictly necessary for login sessions. Cannot be disabled without breaking the service.
  • localStorage — stores your language preference, saved CVs, profile data, and UI state locally in your browser. This data never leaves your device unless you use an AI service.

We do not use advertising or tracking cookies. No third-party analytics (Google Analytics, etc.) are installed.

7. Data Retention

  • Account data: until deletion or 2 years of inactivity
  • Candidate CV files (applications to vacancies): deleted after 30 days
  • Temporary processing files (CV Builder uploads): deleted within 5 minutes after generation
  • AI-generated output: stored until you delete it or close your account
  • Payment records: 5 years (Ukrainian tax law requirement)
  • Usage/access logs: 90 days

8. Automated Decision-Making

Our AI services analyze your resume content to generate suggestions, match scores, and recommendations. These AI outputs are advisory only — they do not produce any legal effects or similarly significantly affect you. No automated decisions about hiring, employment, or creditworthiness are made. Final decisions about using any AI-generated content are always yours. You have the right to request human review of any AI output by contacting us.

9. Your Rights

Under GDPR and Ukrainian law, you have the following rights:

  • Access — request a copy of all data we hold about you
  • Export — download your data in JSON format via Settings → Data & Privacy
  • Deletion — delete your account and all associated data via Settings → Data & Privacy
  • Correction — update your profile information at any time
  • Withdraw consent — revoke Gemini AI consent or Telegram notifications in Settings at any time
  • Portability — receive your data in a machine-readable format
  • Restriction — request that we limit processing of your data
  • Object — object to processing based on legitimate interest

To exercise any right, use the in-app tools in Settings or contact us at support@kossflow.com. We respond within 30 days.

If you are unsatisfied with our response, you have the right to lodge a complaint with a supervisory authority:

  • Ukraine: The Ukrainian Parliament Commissioner for Human Rights (Ombudsman) — ombudsman.gov.ua
  • EU: Your local Data Protection Authority (e.g., BfDI in Germany, CNIL in France, ICO in the UK)

10. Data Security

We use industry-standard security measures: HTTPS/TLS encryption in transit, encrypted storage for sensitive fields (API keys), unique JWT secrets, access control via Supabase Row Level Security, rate limiting on all API endpoints, and regular security reviews. Despite these measures, no system is 100% secure — please use a strong password and keep your credentials private.

11. Children's Privacy

Our service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by displaying a notice in the app or via email. Continued use after changes constitutes acceptance of the updated policy.

13. Contact

For any privacy-related questions or requests:

Email: support@kossflow.com

Individual Entrepreneur Kostyniuk Ihor Valeriiovych, Ukraine

→ Terms & Conditions
Last updated: April 2026 · © 2026 Koss Flow · Individual Entrepreneur Kostyniuk Ihor Valeriiovych