Privacy Policy

Draft — this document is being finalized with counsel and is not yet binding.

What personal data Kovik processes, the legal bases, EU data residency, our subprocessors, and how to exercise your rights.

Who we are

Kovik is a SaaS that helps digital-product sellers create marketplace-ready products. This policy explains what personal data we process, why, and your rights. It is a draft pending legal review and will be finalized before public launch.

Data we process

We process the following categories of personal data:

Account data: name, email, password hash, OAuth identifiers, locale, role.
Content you provide: brief answers, uploads, and project data you create.
Billing identity: held by our merchant of record (Paddle), not in Kovik's database.
Technical data: IP address, consent records, and product-analytics events.

Third-party subprocessors

Your content (briefs and uploads) is processed by third-party inference providers to generate products. We maintain a public subprocessor list. Current subprocessors include:

Hosting & delivery: Vercel, our backend host, Cloudflare (R2 storage + CDN).
Payments (merchant of record): Paddle.
Inference providers: serverless model providers (e.g. Fal, Together, DeepInfra, Replicate, DeepSeek).
Email: our transactional email provider.
Observability & analytics: Sentry, PostHog.

Data residency — the honest limit

Our database, object storage (EU-jurisdiction buckets), and analytics endpoints are configured for the EU. However, briefs and uploads transit serverless inference providers (mostly US) as transient processing. We do NOT claim full EU residency. We require each provider's terms to exclude training on customer data, prefer EU endpoints where offered, and cover transfers via standard contractual clauses. The full transfer map is documented in our compliance records.

Your rights

You can access, export, and delete your data from your account settings (Export my data / Delete my account). Account deletion cascades to deletion of your stored objects, subject to limited retention required for tax/accounting. You may withdraw consent at any time; we honor Global Privacy Control signals.

Retention

Working artifacts are purged shortly after a job completes; preview renders are purged after a period of inactivity; export files are retained while your subscription is active and for a limited window after cancellation, then purged.

Contact

For privacy questions or to exercise your rights, contact us through the support channel listed in the app. An EU representative is appointed where required before EU availability.