Privacy Policy

1) Who we are (Data Controller)

KSTUDIO SIA (trading as "KSTUDIO")

• Reg. No.: 40203140189 | VAT: LV40203140189
• Address: Skolas Iela 36, Jurmala, LV-2016, Latvia
• Contact for data requests: support@kstudio.lv
• Authorized representative: Konstantīns Sigulis

This policy covers sekta.app, our internal business platform. The policy for our public website is published at kstudio.lv/privacy-policy.

2) Whose data we process here

Platform accounts belong to our own staff and to named collaborators we invite. We also process business-contact data about the companies and people we work with or approach, and operational data created by the work itself.

3) What we collect

• Account data: name, work email, role, and permissions.
• Business contacts: name, work email, company, role, and the history of our correspondence.
• Work data: projects, tasks, time entries, files, invoices, and related records.
• Connected social accounts: the account identifier and display name, encrypted OAuth access and refresh tokens, published posts, and the metrics of those posts.
• Technical data: log records needed to run and secure the service.

4) Why we process it, and on what legal basis

• Running the business and delivering client work: contract and pre-contract necessity, Art. 6(1)(b) GDPR.
• Business correspondence and outreach to companies: legitimate interests, Art. 6(1)(f), with an objection route in every message.
• Accounting, invoicing, and statutory records: legal obligation, Art. 6(1)(c).
• Security, abuse prevention, and service reliability: legitimate interests, Art. 6(1)(f).

5) Social platform data

When an account is connected, we store its identifier, display name, and encrypted OAuth tokens. We use them only to publish to that account and to read metrics for the posts we published. We do not read private messages unless a feature you enable requires it, we do not build profiles of other users, and we do not sell, rent, or otherwise pass platform data to third parties. Disconnecting an account, or removing our app on the platform side, deletes the stored tokens.

6) Who we share data with

We use processors that host and run the service on our behalf, under data processing agreements: our cloud hosting and database providers, email and file storage providers, and the social platforms whose APIs we call at your instruction. We disclose data to authorities only where the law requires it.

7) International transfers

Where a provider processes data outside the EEA, the transfer relies on an adequacy decision or on Standard Contractual Clauses with appropriate safeguards.

8) Retention

Account data is kept while the account is active and for a short period afterwards. Accounting records are kept for the statutory period, up to 5 years. Business-contact data is kept for up to 24 months after the last activity, unless you ask us to delete it sooner. OAuth tokens are kept until the connection is removed.

9) Your rights

You have the right to access, rectify, erase, restrict, and port your personal data, and to object to processing based on legitimate interests. Write to support@kstudio.lv and we will respond within one month. You may also complain to the Latvian Data State Inspectorate (Datu valsts inspekcija) or to the authority in your country of residence.

10) Security

Access is restricted by role, traffic is encrypted in transit, OAuth tokens are encrypted at rest, and access to production data is limited to the people who need it.

11) Changes

We may update this policy. The current version is always published at this address with its effective date.

12) Contact

KSTUDIO SIA, Skolas Iela 36, Jurmala, LV-2016, Latvia · support@kstudio.lv