KolosokPrivacy Policy
This policy explains what data Kolosok — a mobile app and service for stretch ceiling installation companies — processes, why, where it is stored, for how long, and what rights you have.
1. Who we are
The service owner and controller of users' personal data is FOP Haidaienko O. V. (individual entrepreneur), Ukraine.
For any questions about your data, email support@kolosok.app.
2. Two kinds of data
Kolosok holds two kinds of data, with different responsibilities:
- User data — of measurers, installers, managers and company owners who have an account. We are responsible for it, and this policy describes how we handle it.
- Data of companies' customers — the people a company installs ceilings for: name, phone numbers, email, site address, notes. It is entered by the company, and the company is the controller of this data. We only store and process it on the company's behalf and to the extent needed to run the service. The company is responsible for collecting this data lawfully and for informing its customers. If you are a company's customer and have a question about your data, contact the company; we will help it handle your request.
3. What data we collect
Account
Name, email address, password (stored only as a one-way hash that cannot be turned back into the password), interface language; phone number if you provide it.
Company and work
Company name, address, phone number and description; employees and their roles; invitations; orders including customer data; measurements, drawings, estimates, price lists, material issuance, documents; plan and service usage.
Devices and sessions
Device identifier, model name, platform (Android, iOS, browser), device type (phone or tablet), app version, sign-in and last-use time. We need this to sign you in, to list your devices in your profile, to limit the number of simultaneous devices and to protect your account.
Technical data
IP address, time and path of requests, sign-in records (successful or not) — in server logs, for security and abuse prevention.
Diagnostics
If an error occurs in the app, a technical description of the error is sent to the server automatically so we can fix it. The full app log is sent only when you send a report to support from the app yourself; together with it we receive your description of the problem and screenshots, if you add any (up to five, only the ones you choose).
Correspondence
Emails and Telegram messages you send to support, and our replies.
Payments
We see the company's plan and its history. We do not process or store payment card data.
What we do not do
- we do not show ads or use advertising or analytics services and trackers;
- we do not sell data or share it for third-party marketing;
- we do not access your location, contacts, photo library or microphone (you pick a screenshot for a report yourself, and we receive only that image).
4. Why we process data
| Purpose | Legal basis |
|---|---|
| Providing the service: account, company, orders, sync between devices, documents | Performance of a contract (Terms of Use) |
| Service emails: email confirmation, password reset, invitations, account notifications | Performance of a contract |
| Account security, protection against takeover, password guessing and abuse | Legitimate interest |
| Fixing errors and supporting users | Legitimate interest |
| Kolosok news by email (you can unsubscribe via the link in the email) | Legitimate interest |
| Payment records and compliance with the law | Legal obligation |
5. Data on your device
To work without internet, orders, rooms, the price list and unsaved drawings are stored on the device and synced with the server as soon as a connection is available. This data is removed from the device when you sign out.
6. Who else receives data
- Other users of your company — according to their roles; contractors the company has given access to orders; customers you sent a document link to (you can revoke it in the app).
- Processors that help us run the service:
- Hetzner Online GmbH (Germany) — servers and database;
- Cloudflare, Inc. (USA) — protection and delivery of traffic to the server;
- Sendinblue SAS / Brevo (France) — sending emails;
- Google (Gmail) — the support mailbox;
- Telegram — the support chat, if you write to us there (Telegram processes your messages under its own terms).
- Public authorities — only where required by law.
7. Where data is stored
Servers and the database are located in the European Union (Germany). Cloudflare may process traffic in its global network, including the USA; such transfers are covered by the Standard Contractual Clauses approved by the European Commission.
8. How long we keep data
| Data | Period |
|---|---|
| Account and company data | As long as the account / company exists |
| After an account deletion request | 30 days (account locked), then personal data is deleted |
| Device sessions | 90 days without use |
| Server logs (including IP addresses) | Log volume is capped (up to 1 GB); the oldest records are deleted automatically, usually within a few weeks |
| Automatic error reports | 30 days |
| Reports you send to support (including screenshots) | 90 days |
| Database backups | up to 60 days |
When an account is deleted, its database record is anonymized: the name is replaced with “Deleted user”, and the email, phone number and password are erased. The anonymized record stays in the order history of companies you worked for, so their reports for past periods do not change. Deleted data disappears from backups once those backups expire.
9. Your rights
You have the right to:
- know what data of yours we process and get a copy of it;
- correct inaccurate data (most of it yourself in your Profile);
- delete your account and data — see Delete account;
- restrict or object to processing;
- receive your data in a machine-readable format;
- unsubscribe from news via the link in any news email.
To exercise a right, email support@kolosok.app from your account's email address. We reply within 30 days.
If you believe your rights have been violated, you can complain to the Ukrainian Parliament Commissioner for Human Rights or, if you are in the EU, to the data protection authority of your country.
10. Security
All data is transmitted over an encrypted connection (HTTPS). Passwords are stored only as hashes. Access to company data is limited by roles assigned by the company. Devices you are signed in on are listed in your profile, and you can sign out of any of them remotely. The database is backed up regularly.
11. Children
Kolosok is a business service and is not intended for people under 16. We do not knowingly collect their data.
12. Cookies
The app does not use cookies. This website may set only technical cookies that Cloudflare needs to protect against attacks.
13. Changes to this policy
We will notify you of material changes in the app or by email in advance. The current version is always available on this page, with its date at the top.
14. Contact
FOP Haidaienko O. V. (individual entrepreneur), Ukraine · support@kolosok.app