Privacy Policy
This is the frozen copy of version 1.0. The current version is always at /legal/privacy/. All versions.
1. General information
1.1. This Policy describes how the Klyaksa service (the “Service”, “we”) processes users' personal data. The operator of the Service, which determines the purposes and means of processing, is SEBO - FZCO (DSO-IFZA, IFZA Properties, Dubai Silicon Oasis, Dubai, UAE). The Service is available at klyaksa.app, including its subdomains (among them app.klyaksa.app).
1.2. For questions about the processing of personal data: [email protected].
2. What data we process
- Email address — the account identifier, if you registered or linked an address to a Guest account. A Guest account is created without an email address or any other data about you.
- Password — only if you have set one; stored in protected form.
- Your Content — Canvases and images you have uploaded.
- Technical data necessary for the Service to work, including the session identifier by which the Service recognises your account.
- Data of visitors by link — if a Canvas link is set to ask for a name and/or email address: the name and address entered by the visitor, as well as the number of visits via that link and the time of the first and the last of them (see clause 5.2).
- Anonymised usage statistics — aggregated data, not identifying you, about how the Service is used (see clause 3.1).
3. Purposes of processing and legal bases (GDPR)
- Providing and operating the Service — the basis is “performance of a contract”; the contract is the Terms of Use, which you accept by starting to use the Service (Art. 6(1)(b) GDPR).
- Security, improvement of the Service and usage statistics — “legitimate interest” (Art. 6(1)(f) GDPR).
- Marketing emails — “consent” (Art. 6(1)(a) GDPR); sent only with your explicit consent (opt-in) and with the option to unsubscribe at any time.
3.1. Usage statistics. We collect anonymised (aggregated) statistics about the use of the Service — for example, which features are used and how actively. This data does not allow you to be personally identified and is used only to understand the load and to improve the Service. We do not use it for advertising purposes and do not transfer it to third parties for their own purposes.
4. Cookies
4.1. We use only strictly necessary and functional cookies. See the Cookie Policy for details.
5. Access to your Content for other persons
5.1. By giving access to a Canvas (to other users of the Service, by link or by other means available in the Service), you make the data placed on it — including any personal data of third parties — available to other persons. You are responsible for giving such access.
5.2. Visitors by link. When creating a Canvas link, you can ask visitors to introduce themselves — to enter a name and/or email address. The decision to collect this data is made by whoever creates the link. We do not verify the data entered by a visitor; together with the visit statistics (number of visits, time of the first and the last), we store it and show it only to the project owner and to members who have been given the right to manage access to it. We do not use this data for any other purpose.
6. Retention periods
- While your account is active, we store the data necessary for the Service to work.
- After the account is deleted, we delete your data within 30 days.
- Data of visitors by link is kept until the link is deleted and is deleted together with it.
- A browser session lasts up to 30 days without activity and no longer than 90 days in total, after which you need to sign in again. For a Guest account with no linked email address, the end of the session means losing access to it.
- We may delete Guest accounts with no linked email address that have not been used for more than 90 days, together with their Content.
7. Recipients of data
7.1. We do not transfer your personal data to third parties for their own purposes.
7.2. To operate the Service we use the following processors, which process data only on our instructions:
- Cloudflare, Inc. (USA) — attack protection and delivery of traffic to the website and the app; all requests to the Service pass through Cloudflare.
- Maileroo (Australia) — sending service emails (sign-in, address confirmation, password reset); the recipient's address and the content of the email are transferred.
7.3. Transfers of data to these processors outside the European Economic Area are based on their data processing agreements: for Cloudflare — under the EU-U.S. Data Privacy Framework and the EU Standard Contractual Clauses; for Maileroo — under the EU Standard Contractual Clauses (European Commission Decision 2021/914).
8. Where data is processed
8.1. Data is processed on servers in Europe.
9. Your rights
9.1. With respect to your personal data, you have the right of access, rectification, erasure, restriction of and objection to processing, data portability, as well as the right to withdraw consent and to lodge a complaint with a data protection supervisory authority. You can change your email address in the account settings; other rights are exercised on request to [email protected].
9.2. You can delete your account on request to [email protected], sent from the email address the account is registered to. For a Guest account, first link an email address to it — otherwise we cannot confirm that the request comes from the owner. You can download (export) your Canvases using the Service.
10. Security
10.1. We apply reasonable technical and organisational security measures: encryption of data in transit, protected storage of passwords, restriction of access to data.
11. Minors
11.1. The Service is not intended for persons under 16.
12. Changes to the Policy
12.1. We notify you of changes through the Service interface or by email. The current version is always published on this page.
13. Contacts
13.1. For privacy questions: [email protected].