How we protect and use your information
Last updated: 05 May 2026 · Version: 1.0
KONNECT (the "Service" or "Platform") is operated by KAPWA Global (the "Company", "we", "us", "our"). This Privacy Policy explains how we collect, use, store, and protect your personal data when you use KONNECT, and what rights you have in relation to that data.
By creating an account or using the Service, you confirm that you have read and understood this Privacy Policy.
KAPWA Global is the data controller responsible for your personal data collected through KONNECT.
This Privacy Policy applies to:
It does not apply to third-party websites or services linked from KONNECT, including the interactive product demo embedded on the marketing site.
We collect the following categories of personal data:
Account data: Email address, full name, phone number (optional), password hash, and two-factor authentication state.
Profile and attribution data: Role, company size, strategic goals, how you heard about KONNECT, and any partner or referral code used at signup.
Approximate location: City and country derived from your IP address via IP geolocation (see Section 6). We do not collect precise GPS location. Location data is used for security anomaly detection and regional analytics.
Usage and telemetry: Pages visited, features used, session duration, device type, and browser. Collected via analytics tools listed in Section 6.
Chat content and file uploads: Messages you send within KONNECT workspaces, files you upload, and text extracted from those files via AI-assisted OCR and vision processing.
Strategy evaluations (SRI): Inputs you provide for Strategy Readiness Index assessments and the AI-generated scoring outputs associated with them.
Expert session data: Messages exchanged during expert-facilitated sessions, session ratings, NPS scores, and feedback you submit.
Billing data: Stripe customer ID and subscription state. We do not store card numbers or full payment details. These are held by Stripe under their own data processing terms.
Security data: Failed login attempts, account lockout state, and audit logs related to account security events.
The table below sets out each purpose for which we process your data and the legal basis under GDPR Article 6.
| Purpose | Legal basis |
|---|---|
| Creating and managing your KONNECT account | Performance of a contract (Art. 6(1)(b)) |
| Providing AI chat, SRI evaluations, and expert sessions | Performance of a contract (Art. 6(1)(b)) |
| Sending transactional emails (account confirmation, password reset, session summaries, security alerts) | Performance of a contract (Art. 6(1)(b)) |
| Processing subscription payments via Stripe | Performance of a contract (Art. 6(1)(b)) |
| Sending lifecycle and marketing emails | Consent (Art. 6(1)(a)) — you may withdraw at any time |
| Product analytics and platform improvement | Legitimate interests (Art. 6(1)(f)) — understanding how users engage with the platform to improve it |
| Approximate location for security anomaly detection and regional analytics | Legitimate interests (Art. 6(1)(f)) |
| Security monitoring, fraud prevention, and audit logging | Legitimate interests (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)) where applicable |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c)) |
What is automated
KONNECT uses artificial intelligence to process your chat content, uploaded files, and SRI evaluation inputs. This includes AI-generated responses within the platform, file OCR and vision analysis, automated scoring as part of the Strategy Readiness Index, and AI-assisted expert matching based on your profile and goals.
Third-party AI processing
Your inputs are transmitted to Google Gemini (model: gemini-2.5-flash) via the Lovable AI Gateway (ai.gateway.lovable.dev), which acts as a proxy and billing layer for AI calls. This provider processes your inputs solely to generate responses and outputs. Per Lovable's published security terms and their contractual agreements with Google, customer data is not used to train AI models.
Nature of outputs
AI-generated outputs within KONNECT are decision-support tools. They are not automated decisions with legal or similarly significant effects under GDPR Article 22. All SRI evaluations are reviewed or validated by a human expert before being presented as conclusions. You retain the right to request human review of any AI-generated output by contacting support@kapwa-global.com.
Expert matching
Initial expert matching involves automated profiling based on your stated goals, company profile, and SRI inputs. A human expert reviews all matches before any session is confirmed.
We use the following third-party processors to operate KONNECT. Each has data protection agreements in place with us or operates under standard contractual clauses as noted.
| Processor | Purpose | Data shared | Region | Transfer mechanism |
|---|---|---|---|---|
| Lovable | App hosting, preview and published domains including konnect.kapwa-global.com | All data transiting the platform | EU / US | SCCs + Lovable DPA |
| Supabase | Database, authentication, file storage, edge functions, realtime | Account data, profile data, chat content, file uploads, SRI data, security logs | EU | EU hosting — no transfer |
| Lovable AI Gateway / Google Gemini | AI processing for chat, SRI evaluations, file OCR and vision | Chat content, file content, SRI inputs | US | SCCs |
| Stripe | Subscription billing and payment processing | Billing data, email address, name | US | EU-US Data Privacy Framework / SCCs |
| Resend | Transactional email delivery | Email address, name, email content | US | SCCs |
| Loops | Lifecycle and marketing email, contact sync | Email address, name, subscription status | US | SCCs |
| PostHog | Product analytics and event tracking | Usage and telemetry data, anonymised identifiers | US (us.i.posthog.com) | SCCs |
| Google Analytics 4 | Marketing and traffic analytics | Usage data, approximate location, anonymised identifiers | US | EU-US Data Privacy Framework / SCCs |
| ipapi.co | IP geolocation for security anomaly detection and regional analytics | IP address | US | SCCs |
| Storylane | Interactive product demo embed on marketing site (not inside authenticated platform) | Visitor interaction data, IP address | US | SCCs |
We will update this table when sub-processors change. Material changes will be notified to you in advance per Section 14.
Several of our sub-processors are based in the United States. Where we transfer personal data outside the European Economic Area, we rely on one or more of the following safeguards:
You may request a copy of the applicable transfer mechanism by contacting support@kapwa-global.com.
We retain your personal data for as long as your account is active, and for limited periods thereafter as set out below.
| Category | Retention period |
|---|---|
| Account data | Active account lifetime, then purged within 30 days of confirmed account deletion |
| Chat content and file uploads | Active account lifetime unless you delete them earlier via Settings. Purged within 30 days of account deletion. |
| SRI evaluations | Active account lifetime. Purged within 30 days of account deletion. |
| Expert session data | Active account lifetime. Purged within 30 days of account deletion. |
| Billing records | 7 years in line with Spanish tax retention obligations under Ley General Tributaria |
| Security logs | 12 months |
| Marketing attribution and consent records | Until consent is withdrawn or account is deleted, whichever is earlier |
| Anonymised analytics data | Indefinite (not attributable to an individual) |
You may request early deletion of specific data categories via Settings > Privacy & My Data or by contacting support@kapwa-global.com.
If you are in the European Economic Area or the United Kingdom, you have the following rights in relation to your personal data:
Right of access: You may request a copy of the personal data we hold about you.
Right to rectification: You may request correction of inaccurate or incomplete data.
Right to erasure: You may request deletion of your data, subject to our retention obligations.
Right to restriction: You may request that we limit how we use your data in certain circumstances.
Right to data portability: You may request a machine-readable copy of the data you have provided to us.
Right to object: You may object to processing based on legitimate interests, including profiling for expert matching.
Right to withdraw consent: Where processing is based on your consent (e.g. marketing emails), you may withdraw consent at any time without affecting the lawfulness of prior processing.
Right to object to automated processing: You may request human review of any automated output, including SRI evaluations. See Section 5.
Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is the AEPD (aepd.es). You may also lodge a complaint with the supervisory authority in your country of residence.
To exercise any of these rights, visit Settings > Privacy & My Data within your KONNECT account, or contact us at support@kapwa-global.com. We will respond within 30 days.
If you are a California resident, the following additional disclosures apply.
Categories of personal information collected: Identifiers (name, email, IP address); commercial information (subscription plan, billing status); internet or other electronic network activity (usage data, feature events); geolocation data (approximate, city and country level); professional or employment-related information (role, company size, goals); inferences drawn from the above (SRI scores, expert match recommendations).
We do not sell your personal information. We do not sell or share personal information with third parties for cross-context behavioural advertising purposes. Analytics cookies (PostHog, Google Analytics 4) are used for platform and marketing analytics only and require your consent via the Cookie Preferences panel.
Your California rights include: The right to know what personal information is collected, used, shared, or sold; the right to delete personal information; the right to correct inaccurate personal information; the right to opt out of the sale or sharing of personal information; the right to non-discrimination for exercising your rights.
To exercise your California rights, contact support@kapwa-global.com or use Settings > Privacy & My Data.
KONNECT uses cookies and similar technologies for essential platform functionality, analytics, and marketing purposes. You can manage your preferences using the Cookie Preferences panel, accessible at any time from the footer of the KONNECT site.
Essential cookies cannot be disabled as they are required for the platform to function. Non-essential cookies (analytics and marketing) are disabled by default until you provide consent.
The full cookie register, including names, purposes, and durations, is maintained within the Cookie Preferences panel.
KONNECT is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you become aware that a minor has provided us with personal data, please contact support@kapwa-global.com and we will delete it promptly.
We implement the following technical and organisational measures to protect your data:
No method of electronic transmission or storage is 100% secure. We will notify you and the AEPD in the event of a breach as described in Section 14.
In the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will notify the AEPD within 72 hours of becoming aware of it. Affected users will be notified by email to their registered address without undue delay where required by law.
We will post updates to this Privacy Policy on this page with a revised "Last updated" date. Where changes are material, we will provide at least 30 days notice via email to your registered address and via in-app notification before the changes take effect.
Continued use of KONNECT after the effective date of any update constitutes acceptance of the revised policy.
For any questions about this Privacy Policy or your personal data: