Privacy Policy

We do not sell data

Karkium does not sell, rent, or trade personal data of its users to third parties.

Support and legal contact

For privacy or data use inquiries, write to info@karkium.com.

Data retention and deletion

We retain your account data for as long as your account is active. To request account deletion, write to info@karkium.com: we process the request within 7-14 days with a 30-day grace period before final purge. Google OAuth tokens are revoked immediately when you disconnect the integration. Some data may be retained beyond that for legal reasons: audit_logs (security traceability), invoices (SAT/IRS or other tax requirements depending on your jurisdiction), and any records we are legally required to keep under applicable law.

Sub-processors

To deliver the service, we rely on external providers (sub-processors). The current list:

1. Cloudflare Inc. — CDN, WAF, and DNS (USA).
2. Hostinger / VPS provider — server hosting (Lithuania / EU).
3. Resend — transactional email (USA, planned provider when MAIL_MAILER=resend).
4. Anthropic / OpenAI — AI inference for Cerebro and Copilot (USA). They process metadata and operational text only. We do not train models with your data.
5. iubenda — legal compliance platform (Italy / EU).

Each sub-processor operates under its own DPA. We do not transfer data to sub-processors outside the ones listed here without notifying you 30 days in advance.

Breach notification

If we detect unauthorized access to your data, we will notify you within 72 hours of detection, via the email on your account and an in-app banner. The notification will include the nature of the incident, the data affected, the mitigation measures applied, and the recommended steps for your team. To report or inquire about incidents, write to info@karkium.com with the subject INCIDENT.

Your rights under GDPR

If you are in the EU/EEA, the UK, or another jurisdiction with equivalent data protection rules, you have the following rights regarding your personal data:

1. Access — request a copy of the personal data we hold about you.
2. Rectification — ask us to correct inaccurate or incomplete personal data.
3. Erasure — request deletion of your personal data, subject to legal retention obligations.
4. Restriction — request that we restrict processing of your personal data.
5. Portability — receive your personal data in a structured, commonly used, machine-readable format.
6. Objection — object to processing based on our legitimate interests.

Withdraw consent — where we rely on your consent, you can withdraw it at any time without affecting the lawfulness of prior processing. Manage consent for analytics and marketing cookies via the Iubenda Privacy Controls available on the site.

To exercise any of these rights, write to info@karkium.com. We will respond within the statutory time limit (typically 30 days).

If you need to contact our data protection contact or Data Protection Officer, route your inquiry to info@karkium.com and we will direct it to the responsible area.

You have the right to lodge a complaint with the supervisory authority of your EU/EEA member state. The European Data Protection Board maintains the index of national authorities at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

International transfers — where personal data is transferred outside the EU/EEA, Karkium relies on Standard Contractual Clauses, adequacy decisions, or equivalent transfer safeguards, as applicable.