Privacy Policy

1. Controller

Nasratullah Nejat
Hansering 1b 31141 Hildesheim Germany
Email: nasratnejat24@gmail.com

2. General information on data processing

We process our users' personal data only to the extent necessary to provide a functional application as well as our content and services (Art. 6(1)(b) GDPR – performance of a contract).

3. Registration and user account

During registration, we collect your email address and password (stored encrypted). Authentication is handled through our service provider, Supabase.

4. Data processing by Supabase

We use Supabase as a processor for authentication, database services and private file storage. The production hosting region must match the region configured for the live Supabase project; no placeholder region is used in this notice. We maintain an Art. 28 GDPR data processing agreement with our processors.

Production data region: Not configured — set NEXT_PUBLIC_DATA_REGION before launch.

5. What data we process

Depending on the features you use, we may process account and profile data, financial and budget data, contracts, deadlines, housing and rental information, immigration and naturalisation progress, uploaded documents and letters, support or assistant messages, consent records, security and audit records, and technical information needed to secure the service.

6. Storage period

We keep account data while your account is active, unless a longer period is required by law. Assistant history is automatically limited to the most recent messages. Security and audit records are retained only for defined operational/security periods. Deletion requests remove account data and associated private files subject to any legally required retention.

7. Data subject rights

You have the right to access, rectify, erase, and restrict the processing of your data, as well as the right to data portability and to object to processing. You can export your data or permanently delete your account at any time yourself, via account settings.

8. Right to complain

You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data.

10. Optional AI explanation of letters

If you voluntarily use the letter decoder and have given the required consent, the selected document is sent to OpenAI for analysis. This can include personal and special-category information contained in the document. Do not upload information you are not comfortable sending to the configured AI processor. Processing is governed by the AI provider terms and our data-processing arrangements.

11. Storage and deletion of letters

Uploaded letters are stored in a private storage bucket and accessed with short-lived signed links. Deleting a letter removes its database record and associated storage object when deletion succeeds. Account deletion also attempts to remove associated private files.

12. AI assistant and contextual processing

If you use Klawego’s AI assistant, your message and limited account context needed to answer it may be sent to the configured AI provider. The legal basis for providing the requested feature is generally Art. 6(1)(b) GDPR where it is necessary to perform the service you requested. This context can include your selected profile information, setup progress, current-month financial balance and upcoming deadlines. Assistant conversations are stored in your account so the feature can show recent history and are automatically pruned to a bounded history.

13. Malware scanning and third-party security services

For ordinary document uploads, Klawego may send the uploaded file to VirusTotal for malware analysis as a security measure based on our legitimate interest in protecting users and the service (Art. 6(1)(f) GDPR), subject to applicable legal requirements and data minimisation. This is a third-party security service and may make the file available to VirusTotal and participating security vendors. For private letter analysis, Klawego uses a hash-only reputation check instead of sending the letter file itself to VirusTotal.

14. International transfers and recipients

Depending on the infrastructure and processor configuration, personal data may be processed outside the EU/EEA. Where required, we use an appropriate GDPR transfer mechanism and contractual safeguards. The relevant recipients can include Supabase for hosting and OpenAI for voluntarily used AI features, plus security providers used for malware protection.

15. Automated processing and important decisions

Klawego uses automated analysis to summarize documents, extract dates and organize information. These outputs are assistive and may be inaccurate. Klawego does not make decisions with legal or similarly significant effects on you solely from these AI outputs.

16. Data protection contact and policy changes

For privacy questions or rights requests, contact the controller using the email address in section 1. We may update this policy when the service, processors or legal requirements change. The version shown with a consent record is the version applicable to that consent event.

17. AI tools for CVs, cover letters and interview practice

If you voluntarily use the AI tools in the career area, the data you work on is sent to OpenAI to produce the result you asked for: the text of your CV (including the contact details in it), a job posting you paste, the text of a cover letter, or your answers in interview practice. Your work permit status, willingness to relocate and preferred way of working are never sent. Your salary expectation is only used in a cover letter if you switched that on. Nothing is sent before you use such a tool and have given your consent, which you can withdraw at any time. The legal basis is your consent (Art. 6(1)(a) GDPR). OpenAI acts as our processor, and processing can take place outside the EU/EEA (see section 14). Your CVs, letters, applications and practice sessions are stored in your account until you delete them or your account. AI output can be wrong, so please check it before you use it.

18. Optional location (city and federal state)

In your account settings you can optionally enter your city and federal state. We do not ask for your street address. We use this information only to make guidance and assistant answers more specific to your area, on the basis of your voluntary entry (Art. 6(1)(a) GDPR) and, where it is needed to provide the feature you requested, Art. 6(1)(b) GDPR. If you use the AI assistant, your city and federal state may be sent to the configured AI provider as part of the limited context described in section 12. You can change or delete these entries at any time in your account settings. They are included in your data export and deleted together with your account.

19. Klawego Agency (optional travel and visa service)

The Klawego Agency is an optional service run by the operator of Klawego. If you ask the agency to help with a travel or visa matter, or the agency starts an application for your account, the agency's team can see that application: your name and email address, the service and destination, the progress steps, the messages between you and the agency, and a text-only document checklist. No document files are stored for the agency. The agency team cannot see your other Klawego data, such as your budget, letters or assistant chats. You see the details of an application only after you consent, and you can withdraw your consent at any time on the application page, which ends the application. The legal basis is your consent (Art. 6(1)(a) GDPR) and, once you engage the agency, performance of a contract (Art. 6(1)(b) GDPR). The agency also keeps a record of actions (for example “moved to step 3”) that contains only ids and no message or document content. It is deleted after 12 months. Deleting your account deletes your agency applications, messages and checklists, and your data export includes them.

20. Hosting, error monitoring and email

Klawego is hosted on Vercel. Supabase provides the database, login and private storage. Errors are reported to Sentry (EU data centre) so we can keep the service working; these reports are configured not to include user identifiers, request bodies or cookies. Account emails such as the confirmation and password reset emails are sent through an email delivery provider (Resend) and contain only what the email needs, for example a link. These providers process data on our behalf under data processing agreements. Some processing may take place outside the EU/EEA with appropriate safeguards (see section 14).