Privacy Policy

Last updated: 30 December 2025

1. Who we are

Kaizen is operated by OWL GENIUS SOLUTIONS SRL (Romania). For data protection purposes, OWL GENIUS SOLUTIONS SRL is the data controller, meaning we decide how and why personal data is processed.

Contact: [email protected]

2. What this policy covers

This Privacy Policy explains what personal data we collect, why we collect it, how long we keep it, who we share it with, and what rights you have under the EU General Data Protection Regulation (GDPR).

3. Personal data we collect

3.1 Account information

When you create and use an account, we process:

  • Name
  • Email address
  • Password (stored in encrypted/hashed form)
  • Optional profile details such as phone number and avatar
  • Account identifiers used for login providers if you use Google or Facebook sign-in (e.g., provider user ID)
Purpose Create and manage your account, authenticate you, and provide the service.
Legal basis Performance of a contract (GDPR Art. 6(1)(b)).

3.2 Content you create

When you use Kaizen, you may create content such as Lists, Prompts, Templates, and Comments. This content may include personal data if you choose to include it.

Purpose Provide the core functionality of the service.
Legal basis Performance of a contract (GDPR Art. 6(1)(b)).

3.3 Usage and activity data

We record limited in-app activity linked to your account (for example: views, favorites, copies, recent items, and app activity events). We do not run anonymous (unauthenticated) event tracking in our backend.

Purpose Provide features (e.g., recent items), maintain service integrity, prevent abuse, and improve the service.
Legal basis Legitimate interest (GDPR Art. 6(1)(f)).

3.4 Contact form submissions

If you contact us via the public contact form, we process:

  • Name
  • Email address
  • Message content

Contact form messages are sent by email only (via our email provider) and are not stored in our application database.

Purpose Respond to your inquiry and handle requests.
Legal basis Legitimate interest (GDPR Art. 6(1)(f)).
Retention We delete contact messages after 6 months by default, and we may keep them longer only if the request is still unresolved.

4. Cookies and analytics

4.1 Essential cookies

We use essential cookies and similar storage that are required for login sessions, security, and core site functionality. These are always enabled.

Legal basis Performance of a contract (GDPR Art. 6(1)(b)) and legitimate interest for security (GDPR Art. 6(1)(f)).

4.2 Google Analytics (optional)

In the future, we may use Google Analytics 4 (GA4) to understand basic usage trends and improve the service.

Key points:

  • Analytics is disabled by default and loads only after you explicitly opt in via a cookie banner.
  • You can withdraw analytics consent at any time from your account settings.
  • We intend to use a privacy-friendly configuration (e.g., IP anonymization and no advertising features such as Google Signals).
Legal basis Your consent (GDPR Art. 6(1)(a)).

5. Sharing and visibility of content

5.1 Marketplace (members-only)

Marketplace listings are visible only to logged-in users. Content appears in the marketplace only if the owner/editor chooses to list it, and it can be unlisted at any time.

5.2 Shared links

Users can share Collections/Templates by direct links. Shared links are view-only, and access can be revoked at any time by the owner. When a link is revoked, the content is no longer publicly accessible via that link.

6. Account deletion and data retention

6.1 Deletion timeline

If you request account deletion:

  • Your account is soft-deleted immediately.
  • Your account and associated personal data are permanently deleted after 30 days.
  • Deletion is intended to be irreversible once completed.

6.2 What happens to your data on deletion

When permanent deletion runs, we apply the following approach (depending on the data type):

  • User profile and login data: deleted.
  • Activity events and usage logs stored in our database: deleted.
  • Preferences (e.g., settings, favorites): deleted.
  • Owned content (e.g., Lists and content within them): deleted.
  • Comments: the comment text may remain, but the link to your account is removed (anonymized).
  • Shared content: if you contributed content inside a List owned by someone else, that content may be retained to preserve the shared resource and may be transferred to the List owner.
  • Version history: version records may be retained for integrity, with identifiers replaced so they no longer identify you (anonymized).

6.3 Backups

We create daily backups for disaster recovery. Backups are retained for up to 30 days on our primary backup storage. Copies may also be stored on secured backup systems used for resilience; access is restricted and backups are rotated as part of our operational security procedures.

7. Data export and correction

7.1 Access and portability (exports)

You can request a copy of your data. Depending on the data type, exports are provided in different formats:

  • User-generated content (such as Lists, Prompts, and Templates) is exported in Excel format.
  • Account-related data (such as your profile information, activity history, notifications, and consent records) is exported in JSON format.

These formats are commonly used and allow you to reuse your data.

Legal basis Compliance with legal obligations related to GDPR rights (GDPR Art. 6(1)(c)).

7.2 Correction (rectification)

You can update certain profile details in your account settings. You can also change your email address using a self-service email change process that verifies the new email address.

If you need help correcting information, contact us at [email protected].

8. Admin access

Authorized administrators may access user data where necessary for platform administration, support, abuse prevention, security investigations, and legal compliance. Access is role-based and limited to authorized personnel.

9. Where your data is processed

Our primary hosting infrastructure is located in France (EU). We primarily process and store data within the European Union.

10. Third-party processors

We use trusted third parties (processors) to run and secure the service, including:

  • Cloudflare (CDN, security, DDoS protection, rate limiting/bot protection)
  • Zoho (EU) for email delivery (including contact form messages)
  • Google (OAuth login; and optional Google Analytics if you consent)
  • Facebook (OAuth login)

Some providers may process data outside the EU. Where required, we rely on appropriate transfer safeguards such as Standard Contractual Clauses.

11. Your GDPR rights

Depending on your situation, you may have rights under GDPR, including:

  • Access your personal data
  • Receive a copy of your data (exports)
  • Correct inaccurate or incomplete data
  • Delete your account and associated personal data
  • Withdraw analytics consent at any time (if you previously opted in)

To exercise your rights, contact us at [email protected] or use our contact form. We normally respond within 30 days, and we may request verification of identity before fulfilling certain requests.

12. Security

We use technical and organizational measures designed to protect your data, including secure password handling, role-based access controls, and infrastructure-level security protections. No system is 100% secure, but we work to protect data against unauthorized access, alteration, and loss.

13. Changes to this policy

We may update this Privacy Policy from time to time. If changes are significant, we will provide notice within the platform or by other appropriate means.

14. Contact

If you have questions about this Privacy Policy or data protection, contact:

OWL GENIUS SOLUTIONS SRL (Kaizen)
Email: [email protected]