Privacy policy

Last updated: 29 October 2026

This Privacy Policy explains how KissMySkills collects, uses and discloses your personal information when you visit or buy from kissmyskills.com, use the KissMySkills apps, or otherwise communicate with us (together, the "Services"). The website and the apps run on our own software hosted by Cloudflare; payments are processed by Stripe. If there is a conflict between our Terms of service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing and disclosure of your personal information.

Please read this Privacy Policy carefully. By using the Services, you acknowledge that you have read it and understand how we collect, use and disclose your information.

Who we are

The controller of your personal data is Dzmitry Pliachko KREAL, trading as KissMySkills, ul. Stanisława Drabika 63/19, 52-131 Wrocław, Poland, NIP (VAT ID) PL8992909337, REGON 520256406 ("KissMySkills", "we", "us"). Contact: hello@kissmyskills.com, phone +48 699 810 680.

This policy covers: the website kissmyskills.com; the KissMySkills apps: the AI CRM (crm.kissmyskills.com and app.kissmyskills.com), the KissMySkills connector for AI assistants (mcp.kissmyskills.com), Receptionist, Contracts, and the free and paid tools on kissmyskills.com; file delivery and our support mailbox. For data that a business puts into its own workspace in our apps, that business is the controller and we act as its processor. See KissMySkills apps: data you put in.

Personal information we collect

"Personal information" means information that identifies or can reasonably be linked to you or another person. It does not include information that is collected anonymously or has been de-identified so that it cannot identify you. Depending on how you use the Services, we may collect:

• Contact details: your name, billing address, phone number and e-mail address.
• Financial information: transaction details, payment method type and its last digits, payment confirmation and billing country. Card numbers and other full payment credentials are processed by Stripe; we never see them.
• Account information: your KissMySkills account (e-mail address, internal user ID, sign-in method: e-mail code or Google), your plan and trial status, purchases and preferences.
• Transaction information: the items you view, add to checkout or buy, your subscriptions, invoices and past transactions, including purchases made on our previous Shopify-based store (kept for accounting).
• App account data: your e-mail address, an internal user ID, your plan and trial status, sign-in times, and the one-time sign-in codes we e-mail you (stored only as a hash and valid for 15 minutes). When you accept our Terms we record the Terms version, the time, your country and a short description of your browser.
• Connector data: the name of the AI client you connect, the OAuth tokens that authorise it (stored hashed), and a log of which tools and skills it used, including short search queries.
• Workspace content: contacts, deals, tasks, comments, candidates, website-chat transcripts, contracts and other content you or your team put into the apps. See KissMySkills apps: data you put in.
• Communications with us: what you include when you write to us, for example a support request.
• Feedback: if you choose to send feedback through your AI assistant (the KissMySkills connector) or the AI CRM, we store the text you approve, your account ID, your plan and your e-mail address so we can reply and tell you when it ships.
• Device and usage information: your device, browser and network connection, IP address and other identifiers, and how and when you use the Services. In the apps this is linked to an internal user ID, never to your e-mail address. See Cookies and analytics.

Where we get it

• Directly from you, when you create an account, buy, use the Services or write to us.
• Automatically, from your device when you use the Services, including through cookies and similar technologies.
• From our service providers, when they collect or process personal information on our behalf, for example Stripe at checkout (payment status, billing country, VAT ID) and Google when you choose "Sign in with Google" (your e-mail address and name).
• From a business that uses our apps, when it puts your details into its workspace (for example as a contact, lead or candidate), or when you leave your details in its Receptionist chat.

How we use it and our legal bases

We use personal information to:

• Provide and improve the Services: process payments and orders, deliver files, run your account and the apps, sign you in, send notifications about your account and orders, provide support, and understand which features and products are useful so we can improve them.
• Market to you: send marketing e-mails if you have agreed to receive them, and measure our marketing on the website after you accept analytics or marketing cookies.
• Keep the Services secure: authenticate you, prevent fraud and abuse, apply rate limits, and investigate suspicious activity.
• Communicate with you: answer your questions and maintain our business relationship.
• Meet legal obligations: keep accounting and tax records, respond to valid legal process, and establish, exercise or defend legal claims.

Under the EU General Data Protection Regulation (GDPR), we rely on these legal bases:

Purpose	Legal basis
Selling products, delivering files, running your account and the apps, sign-in, support	Performance of a contract (Art. 6(1)(b) GDPR)
Payment processing, subscriptions, receipts and invoices through Stripe	Performance of a contract (Art. 6(1)(b) GDPR); legal obligation for invoices (Art. 6(1)(c) GDPR)
Invoicing, accounting and tax records	Legal obligation (Art. 6(1)(c) GDPR), Polish accounting and tax law
Security, fraud and abuse prevention (including Stripe Radar in payments), rate limiting, operational alerts, records of Terms acceptance, defending legal claims	Legitimate interests (Art. 6(1)(f) GDPR)
Product analytics in the apps and service e-mails such as trial reminders	Legitimate interests (Art. 6(1)(f) GDPR); you can object at any time
One reminder e-mail about a checkout you started but did not finish	Legitimate interests (Art. 6(1)(f) GDPR); you can object at any time
Anonymous storefront analytics	Legitimate interests (Art. 6(1)(f) GDPR)
Analytics and advertising cookies on the website, marketing e-mails	Consent (Art. 6(1)(a) GDPR); you can withdraw it at any time
Feedback you choose to send	Consent (Art. 6(1)(a) GDPR)

Your e-mail address is necessary to buy from us or use the apps; without it we cannot create your account.

KissMySkills apps: data you put in

Who controls what. For your own account (e-mail, plan, orders, sign-in, analytics) we are the controller under this policy. For content that a business puts into its workspace (the people in its CRM, its leads, candidates, website-chat visitors or contract counterparties) that business is the controller, and we process the data on its behalf under our Data Processing Addendum. If your data is in someone else's workspace, please contact that business first; if you contact us, we will forward your request to them.

Hosting and security. The website and the apps run on Cloudflare. Our subprocessors are listed at kissmyskills.com/pages/subprocessors. Our security measures are described at kissmyskills.com/pages/security.

Deleting your account. You can delete your account yourself at any time: in the AI CRM under Settings > Profile > "Delete account", or by asking your AI assistant to run the KissMySkills connector tool delete_my_account. Deleting your KissMySkills account also deletes your CRM account and ends all connected AI clients and sessions. Workspace admins can also export and delete a whole workspace under Settings.

How we use AI

We do not train AI models on your data or on the content of any workspace, and our providers may not do so either.

Your own AI assistant. When you connect Claude, ChatGPT or another assistant through the KissMySkills connector, that assistant reads and changes your workspace on your instructions, through access you approve. Its provider processes that data under your own agreement with it; it is not our subprocessor. You can disconnect it at any time and sign out all sessions.

Receptionist. Receptionist answers website visitors using the answers the site owner configured, and its chat window is labelled as an AI assistant. To phrase a reply it uses an open AI model running on Cloudflare Workers AI; it sends the model the visitor's question (with e-mail addresses and phone numbers removed) and a few configured answers. The site owner can switch this off. Receptionist does not make decisions with legal or similarly significant effects on visitors.

Tools. Some tools on kissmyskills.com use open AI models on Cloudflare Workers AI to process the text you submit. We do not send your data to any third-party AI model provider. Details: AI Terms.

Who we share it with

We disclose personal information only where needed for the purposes above:

Our service providers (processors):

• Stripe (Stripe Payments Europe, Limited, Ireland; Stripe, Inc., USA): checkout, payments, subscriptions (Stripe Billing), the customer portal, tax calculation (Stripe Tax), fraud prevention (Radar) and receipts. For some processing, such as fraud prevention and its own legal duties as a regulated payment provider, Stripe acts as an independent controller under the Stripe Privacy Policy.
• Cloudflare: hosting of the website and the apps, databases, file storage and file delivery, AI models for Receptionist and tools, security and bot protection.
• Resend: transactional e-mail such as sign-in codes, order confirmations, download links and checkout reminders. Payment receipts and invoices are sent by Stripe.
• Zoho Mail EU: our support mailbox.
• PostHog EU: product analytics (on the website only with your consent).
• Google: Google Analytics 4 on the website (with your consent) and Google sign-in when you choose it.

The full list with locations and transfer mechanisms is at kissmyskills.com/pages/subprocessors. Internal alerts to our team carry no names or e-mail addresses.

We also disclose personal information:

• When you ask us to, or consent to it, for example when you connect your own AI assistant through the connector.
• In connection with a business transaction such as a merger or insolvency, to comply with legal obligations (including valid requests from authorities, see our Government Requests page), to enforce our terms, and to protect the Services, our rights and the rights of others.

We do not sell your personal information.

Our previous store

Until we moved to our own platform, our store ran on Shopify. Order and customer records from that period are kept by us for accounting (see How long we keep it) and may still be held by Shopify under the Shopify Consumer Privacy Policy until Shopify deletes them after our store there is closed. Shopify is no longer a processor for new orders.

Third-party websites and links

The Services may link to websites or platforms operated by third parties. If you follow such links, please review their privacy and security policies. We are not responsible for the privacy or security of those sites. Information you share on public or semi-public venues, including third-party social networks, may be visible to other users of those platforms.

International transfers

We are based in Poland and keep personal data in the European Economic Area (EEA) where we can (Stripe Payments Europe in Ireland, PostHog EU in Germany, Zoho Mail in the EU). Some providers are located in, or may access data from, the United States (Cloudflare, Stripe, Inc., Resend, Google). For these transfers we rely on a European Commission adequacy decision (including the EU-US Data Privacy Framework where the recipient is certified) or on the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), or the equivalent UK instruments for UK data. You can ask for a copy of the safeguards at hello@kissmyskills.com.

How long we keep it

No security measures are perfect, and information you send us may not be secure in transit, so please do not send sensitive information through unsecured channels. Our security measures are described at kissmyskills.com/pages/security.

We keep personal information only as long as needed for the purposes above, and then delete it automatically or on a schedule:

Data	How long we keep it
Orders, invoices, payment records (Stripe and our previous Shopify store)	5 years from the end of the calendar year in which the related tax became due, as required by Polish accounting and tax law
Stripe customer and subscription records	While the subscription is active, then as for payment records
A checkout you started but did not finish	Stripe keeps the unfinished checkout; the link in our one reminder works for 30 days
App account (e-mail, plan, sign-in history)	While your account exists. You can delete it yourself at any time (see Deleting your account)
Evidence that you accepted our Terms, after you delete your account	3 years after deletion, reduced to an internal ID, the Terms version and the time
Sign-in codes	15 minutes
Website sign-in session	7 days
CRM sign-in session	Ends after 7 days without activity, and after 30 days at most
Connector authorisations	Access tokens 1 hour; refresh tokens up to 90 days unless revoked
CRM workspaces you delete	Restorable for 30 days, then permanently deleted; removed from backups within a further 30 days
Receptionist conversations and messages	180 days after the last activity in the conversation
Receptionist leads and bookings	24 months
Connector usage logs (tools and skills used, short queries, notification log)	12 months
Sign-in funnel events	6 months
Product usage events in the CRM	180 days
CRM admin access log	24 months
Operational alerts to our team	12 months
Feedback	24 months
Support e-mails	3 years after the conversation ends
File download links	Valid 30 days
Your cookie choice	6 months, in your browser
Anonymous storefront analytics	90 days
Product analytics (PostHog EU)	Up to 12 months
Google Analytics 4 on the website	14 months

We may keep data longer where the law requires it or where it is needed to establish, exercise or defend legal claims.

Your rights

Depending on where you live, you may have some or all of the rights below. They are not absolute and may apply only in certain circumstances.

• Access. Ask for a copy of the personal information we hold about you.
• Deletion. Ask us to delete your personal information. You can also delete your app account yourself (see Deleting your account).
• Correction. Ask us to correct inaccurate information.
• Portability. Receive your personal information in a portable format and ask us to transfer it to a third party.
• Opt out of sale or sharing for targeted advertising. We do not sell your personal information or share it for targeted advertising. Analytics and advertising cookies stay off until you accept them, and you can change your choice at any time with "Cookie preferences" in the website footer. A Global Privacy Control signal is therefore not needed on our website; we do not respond to other "Do Not Track" signals.
• Communication preferences. You can unsubscribe from promotional e-mails at any time using the link in them. We may still send you non-promotional e-mails about your account or orders.

If you live in the UK or the EEA, you also have these rights, subject to the limits in local law:

• Objection and restriction. You can ask us to stop or restrict processing for certain purposes. Where we rely on legitimate interests you can object at any time on grounds relating to your situation, and you can always object to direct marketing.
• Withdrawal of consent. Where we rely on consent, you can withdraw it at any time. This does not affect processing before the withdrawal.

How to exercise your rights. Write to hello@kissmyskills.com from the e-mail address linked to your account. We reply within one month (extendable by two months for complex requests; we will tell you why). We may need to verify your identity before acting on a request. You may use an authorised agent; we will ask for proof that you authorised them and may need to verify your identity directly. We will not discriminate against you for exercising your rights.

Complaints

Please contact us first at hello@kissmyskills.com. You also have the right to complain to a data protection supervisory authority, in particular in the EU Member State where you live, work or where the alleged infringement took place (list of EEA authorities). Our lead supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl.

Cookies and analytics

Website (kissmyskills.com). Until you choose otherwise in our cookie banner, we set only the cookies needed for sign-in, the cart, checkout and security. Analytics cookies (Google Analytics 4, PostHog EU) are set only after you accept them. Stripe sets its own cookies on its checkout pages for fraud prevention. You can change your choice at any time with "Cookie preferences" in the footer. Details: Cookie policy.

Anonymous storefront analytics. When you view products, add to cart or search on kissmyskills.com we record the product or search term (with e-mail addresses, phone numbers and similar personal data removed), your country and an anonymous visitor code. The code is derived from a random value that changes every day and is not stored beyond about 26 hours, so visits cannot be linked across days, and no cookie is set. We use this only to understand which skills interest visitors. It is processed on Cloudflare and deleted after 90 days. Legal basis: our legitimate interest in improving the catalogue (Art. 6(1)(f) GDPR).

Apps (sign-in pages and CRM). We use PostHog EU Cloud (Frankfurt, Germany) to measure which steps and features people use, to track errors, and to replay sessions for debugging with all text and inputs masked. Users are identified by an internal ID, not by e-mail, and links are stripped of query strings before they are sent. PostHog sets a first-party cookie.

The full list of cookies, with their lifetimes, is in our Cookie policy. Receptionist's chat widget sets no cookies; it keeps the conversation only in your browser tab's session storage.

Children

The Services are not intended for children, and we do not knowingly collect personal information about children under the age of majority in your jurisdiction. The KissMySkills apps are business tools and are not intended for anyone under 16. If you are the parent or guardian of a child who has given us personal information, contact us and we will delete it. We do not have actual knowledge that we "share" or "sell" (as defined in applicable law) personal information of individuals under 16.

Changes to this policy

We may update this Privacy Policy, for example to reflect changes to our practices or for legal or regulatory reasons. We will post the updated policy on this page, change the "Last updated" date, and give notice where the law requires it.

Latest change (29 October 2026): our store moved from Shopify to our own platform on Cloudflare; payments are now processed by Stripe; Shopify was removed as a processor; the Cookie policy became a separate document.

Contact

For questions about this policy or to exercise your rights, e-mail hello@kissmyskills.com or write to:

Dzmitry Pliachko KREAL (KissMySkills)
ul. Stanisława Drabika 63/19
52-131 Wrocław, Poland
NIP (VAT ID): PL8992909337
REGON: 520256406
Phone: +48 699 810 680

Security issues: security@kissmyskills.com.