Privacy Notice

Who we are

KAIVI is run by Matt Belas in the Philippines. Matt Belas is the personal information controller: the person who decides how your data is used.

Matt Belas is also our Data Protection Officer (DPO). You can reach the DPO at [email protected].

What this notice covers

This notice covers people who visit this website and people who sign in. Right now, only email addresses on our invite list can create an account.

KAIVI does not read resumes, job posts or interview answers yet. Before it does, we will update this notice.

What we collect

• Your email address, when you ask for a sign-in code.
• Your 6-digit sign-in code. It works once and expires after 10 minutes.
• Sign-in records: when your account was created, when you signed in and when you were last active.
• Session records: when each session started and the type of browser you used.
• Your choices on the consent page: what you accepted, the version of the text and the time.
• A security log of sign-ins, sign-outs and consent choices. It holds a scrambled code made from your IP address (a keyed hash), never the address itself.
• Sign-in limits: scrambled codes made from your email address and IP address, used to count how many codes were asked for. The email and IP address themselves are not stored there.
• Bot check: on the sign-in pages, Cloudflare Turnstile looks at signals from your browser and device and at your IP address.
• Error reports: if our server has an error, Sentry receives a report with the technical details. Personal details are removed first, and Sentry does not store IP addresses.

Cookies

• kaivi-auth keeps you signed in on this browser until you sign out (at most about 13 months).
• kaivi_pending holds a sign-in that is in progress, in encrypted form. Only the sign-in pages receive it, and it is deleted after 15 minutes or when you finish signing in.

Both cookies are needed for sign-in to work.

Why we use your data, and our legal basis

Each use has a legal basis under the Data Privacy Act of 2012 (Republic Act 10173):

• To send your sign-in code and run your account. Legal basis: it is needed to give you the service you ask for (Sec 12(b)). We tell you this on the sign-in page before we send the code.
• To keep accounts and KAIVI safe with the security log, sign-in limits and the bot check. Legal basis: our legitimate interest in stopping abuse and keeping the service safe (Sec 12(f)).
• To run practice interviews and write reports with AI, once this starts. Legal basis: your consent (Sec 13(a)), because resumes often hold sensitive personal information. You give it on the consent page. If you withdraw it, KAIVI cannot work for you.
• To keep invoice records, once KAIVI takes payments. Legal basis: our legal duty under tax law (Sec 12(c)).

Who else handles your data

• Supabase stores your account and runs sign-in. Location: Singapore.
• Vercel hosts this website. Location: Singapore and its global network.
• Upstash stores the sign-in limit counters, as scrambled codes only. Location: Singapore.
• Cloudflare Turnstile runs the bot check. Location: Cloudflare's global network.
• Cloudflare also receives email sent to [email protected] and forwards it to us.
• Resend sends the email with your sign-in code. Location: United States.
• Sentry receives error reports with personal details removed. Location: United States or European Union, named here once it is set up.
• Anthropic, our AI provider, will read your resume, job post and answers once practice interviews start. Location: United States. It does not train on this data. It keeps it for up to 30 days, or up to 2 years if its safety systems flag it.

Some of these companies are outside the Philippines. Your account data is stored in Singapore.

How long we keep it

• Your account, email and consent records: until your account is deleted.
• Sign-in code: 10 minutes, and it works only once.
• The kaivi_pending cookie: 15 minutes at most.
• Sessions and the kaivi-auth cookie: until you sign out, at most about 13 months.
• Sign-in limit counters: 1 hour for email counts and 15 minutes for IP counts.
• Our security log: 24 months. It holds no content, and your account is removed from it when your account is deleted.
• Supabase's own sign-in log: 12 months.
• Accounts never confirmed are deleted after 24 hours. Accounts that never pass the consent page are deleted after 30 days. Accounts with no activity for 24 months are deleted after a warning email. These clean-up jobs start before KAIVI opens to outside testers.
• Backups: 35 days or less.

Your rights

Under the Data Privacy Act, you can:

• know how your data is used, as this notice explains;
• see your data and get a copy of it;
• correct data that is wrong;
• object to a use of your data, or withdraw your consent;
• have your data deleted;
• get your data in a format you can take elsewhere;
• complain to the National Privacy Commission (privacy.gov.ph);
• claim damages if your data is misused.

For now, send every request to [email protected], including a request to withdraw your consent or delete your account. We answer within 15 working days.

Age

KAIVI is for people 18 or older. If we find that an account belongs to someone under 18, we delete it.

How we protect your data

Your data is encrypted while it travels and while it is stored. In our database, each person can reach only their own records.

Changes to this notice

This is an interim notice. When we change it, we publish the new version here and ask you to read it again.