What Kyrovo looks like when it's compliant
The rules we live by — today and as regulation tightens. Every pillar below is enforced by code, not by a policy PDF.
Self-reported only — never inferred
Kyrovo only processes what you type into the quiz. No keystroke tracking, no behavioral inference, no passive monitoring, no wearable/microphone/camera ingestion. This keeps us out of EU AI Act Annex III (workplace monitoring) and out of FDA medical-device territory.
EU AI Act Art. 5–6 · FDA 2026 wellness-app guidance
Explicit, granular consent before any input
The ConsentGate blocks the quiz until you (a) select your region, (b) confirm the regional minimum age, and (c) tick a separate GDPR Art. 9 checkbox for processing self-reported wellbeing inputs. No dark patterns, no pre-checked boxes, no bundled consent.
GDPR Art. 7 & Art. 9 · WA MHMDA · CCPA sensitive-data opt-in
Encrypted storage, user-owned rows
Every table is protected by Row-Level Security scoped to auth.uid(). You can only ever read or write your own rows. Data is encrypted at rest and in transit. Service-role access is confined to verified webhooks and admin maintenance — never used for ordinary reads.
GDPR Art. 32 · SOC 2 CC6
Zero sharing — no employers, no third parties
Kyrovo does not sell, rent, or share your inputs. There is no employer dashboard on user data. The public Layoff Radar uses only public WARN Act filings and SEC 8-Ks — it never crosses with any employee's wellbeing data.
GDPR Art. 6 · CCPA §1798.120 · WA MHMDA §7
One-click, immediate deletion
Settings → Delete account wipes every row you own across six tables and deletes your auth user in a single server call. No 30-day queue, no support ticket, no dark pattern.
GDPR Art. 17 · CCPA §1798.105
"Career resilience tracker" — not a medical device
We never name a disease, never say "abnormal," never recommend a specific treatment. Scores use neutral language (Energy Zone: Low / Steady / High) and every plan carries a professional-help note. This keeps Kyrovo on the wellness-app side of the FDA's 2026 guidance.
FDA 21 CFR 880 · EU MDR wellness carve-out
Disclaimer on every screen
The ComplianceFooter renders on every route — authenticated and public: "Career planning tool — not medical, psychiatric, or financial advice. If you're struggling, please talk to a qualified professional."
FTC Act §5 · EU AI Act Art. 50 (transparency)
Where to verify each claim
- · Privacy Policy — what we collect, what we never do, your rights
- · Terms of Service — Kyrovo is a career-planning tool, not medical or financial advice
- · Health Data Privacy Notice — WA MHMDA-specific disclosures
- · Records of Processing — GDPR Art. 30 register
- · Subprocessors — the short list
- · Security — encryption, RLS, incident contact
- · DPIA — Art. 35 impact assessment
- · AI Model Card — EU AI Act Art. 50 transparency
- · Methodology — deterministic scoring, versioned
This page is maintained by Kyrovo to answer common security and privacy questions. It describes controls enabled in the app — it is not a certification or an independent audit.
Available in 8 languages via the language switcher (top-right). The English version is authoritative.