Privacy Policy

1. Who we are

Kyrovo is a career resilience tool operated by Kyrovo. You can reach us at hello@getkyrovo.com.

2. What data we collect

Only what you explicitly type into Kyrovo:

• Your self-reported check-in answers (energy, motivation, ability to switch off)
• Your job title, industry, and the tasks you tell us you do
• Your self-reported income, expenses, and savings
• Your email address (only if you choose to save your scores)
• Payment information (processed by Stripe — we never see or store your card details)

What we do NOT collect: We do not use AI to passively infer your emotional state. We do not track keystrokes, typing patterns, or behavioural signals to detect burnout. We do not read your emails, messages, or calendar. We do not access your employer's systems. This is a hard architectural rule, not a policy — it makes us compliant with EU AI Act Article 5.

3. How we use your data

Your inputs are used solely to:

• Calculate your three scores (energy pulse, AI risk, financial runway)
• Generate your personalized 90-day plan
• Track your progress over time (only if you're a subscriber)
• Send you the emails you opted into (weekly check-in reminder, monthly plan update)

4. What we NEVER do

• Sell your data to anyone, ever
• Share your data with your employer, current or prospective
• Share your data with insurers, data brokers, or advertisers
• Use your data to train AI models
• Passively infer your emotional or mental state
• Provide access to law enforcement without a valid legal order

5. Your rights

Under GDPR (EU/UK), CCPA/CPRA (California), and 20+ US state privacy laws, you have the right to:

• Access — download all your data as a JSON file from Settings
• Deletion — one-click permanent deletion of your account and all data, immediate not 30 days
• Portability — your export is in a machine-readable format
• Opt-out — you can cancel your subscription and stop all data collection at any time
• Withdraw consent — at any time, without giving a reason

To exercise any of these rights, email hello@getkyrovo.com or use the tools in your Settings.

6. Legal basis (GDPR Article 6 & 9)

Because your check-ins may relate to your mental wellbeing, we treat them as special category data under GDPR Article 9. Our legal basis is your explicit consent, given via the consent gate before any check-in begins. You can withdraw consent at any time by deleting your account.

7. Data retention

Your data is retained while your account is active. When you delete your account, all your data is permanently removed within 24 hours from our production systems and within 30 days from encrypted backups.

8. Where your data lives & sub-processors

Your data is stored encrypted at rest in secure EU-region data centres. Our sub-processors and the Data Processing Agreements (DPAs) that govern them:

• Supabase (database + auth, EU region) — DPA incorporating EU SCCs & UK IDTA
• Stripe (billing, US/EU) — DPA with EU SCCs; only receives your email + subscription status, never your check-in answers
• Lovable AI Gateway (plan generation) — receives only your numeric scores and task categories; no identifiers; no training
• Cloudflare (edge hosting / DDoS) — DPA

International transfers rely on EU Standard Contractual Clauses (2021/914) and, where relevant, the UK IDTA. We'll notify you at least 30 days before adding a new sub-processor.

8a. US consumer health data notice

If you're a resident of Washington, Nevada, or Connecticut, your self-reported wellbeing signals are "consumer health data" under state law. See our dedicated Consumer Health Data Privacy Policy (WA MHMDA / NV SB 370 / CT CTDPA).

9. AI use

Your 90-day plan is generated by a large language model using only your numeric scores and task categories. The model never receives your name, email, employer, or any identifying information. Its output is a template we fill in with your data on our servers.

10. Changes

If we change this policy, we'll email every active user at least 30 days before the change takes effect.