Privacy Policy

Aenze s.r.o., Moskevska 1842, 272 04 Kladno, Czech Republic, company ID 28534395, VAT ID CZ28534395, operates KORD.ch. Operator website: https://aenze.com/.

We are the controller for account registration, billing, security, support and operation of the service. For content, contacts and other personal data that a customer places in a workspace, the customer normally decides the purpose and means of processing and is the controller; KORD acts as its processor.

Privacy requests can be sent to [email protected]. General product support is available at [email protected]. We have not appointed a data protection officer because our current processing does not require one; privacy matters are handled through the privacy address above.

Account and team data: name, email address, avatar, workspace membership, role, invitations, authentication records and account status.

Workspace data: brands or clients, posts, captions, media, schedules, comments, approvals, channel selections, publishing results, analytics snapshots, workspace settings and audit history.

Connected-platform data: provider name, external channel or profile ID, display name, avatar, granted permissions, encrypted OAuth credentials, token expiry, connection health and publishing identifiers or results returned by the platform.

Agent API and automation data: API token name, connection mode, scopes, permitted social profile IDs, expiry, risk-acknowledgement version and time, immutable attribution used for agent-prepared drafts, safe last-use client metadata, idempotency records and audit events. We never display or store a recoverable copy of the raw API token after creation.

Billing and support data: selected plan and storage add-ons, subscription and invoice references, usage totals, billing status and communications with support. Full card details are handled by the payment provider and are not stored by KORD.

Technical and security data: IP address, browser and device information, request and error logs, session identifiers, rate-limit events and security signals needed to prevent abuse and operate the service.

Website usage statistics: on the public website only, the operator's self-hosted Umami instance records page views, referring page, browser and device type, approximate country and clicks on sign-up buttons. It sets no cookies, keeps no IP address and respects Do Not Track. Sign-up, profile connection, first scheduled post and checkout steps are counted from the server as anonymous totals without any user, workspace or email identifier.

AI data: prompts, selected workspace context, referenced media and generated output only when a user or authorized agent invokes an AI feature. Public plans do not silently use customer content to train a KORD model.

We receive data directly from users, workspace owners and authorized agents; from connected social platforms after a user grants access; from service providers such as Stripe and Cloudflare; and automatically from the browser, app and infrastructure during normal use.

If your organization created your account or added you to a workspace, it may provide your business contact details and decide your role and permissions.

Contract: to create accounts, operate workspaces, store media, schedule and publish content, provide the Agent API, deliver support and administer subscriptions.

Legitimate interests: to secure the service, prevent fraud and abuse, diagnose incidents, maintain auditability, improve reliability, understand in aggregate how the website and sign-up flow are used and communicate important service information. We balance these interests against the rights of affected people.

Legal obligation: to retain records required by tax, accounting, sanctions, fraud-prevention or other applicable law and to respond to lawful authority requests.

Consent: where a connected provider or optional feature requires consent. You may withdraw it at any time, without affecting processing already carried out lawfully.

We disclose data only as needed to operate the service, follow customer instructions, complete a transaction, protect the service or comply with law. We do not sell personal data or share it for third-party behavioral advertising.

• Infrastructure, security, email and payment subprocessors listed on the Subprocessors page.
• Social platforms selected by the workspace, which receive the media, text, schedule and profile data necessary to perform the requested connection or publishing action.
• AI providers selected or enabled for a workspace, but only when an AI feature is invoked and only with the prompt and context needed for that request.
• Professional advisers, authorities or counterparties where disclosure is required by law or reasonably necessary to establish, exercise or defend legal claims.
• A successor in a merger, financing, reorganization or sale, subject to appropriate confidentiality and data-protection safeguards.

KORD uses YouTube API Services when a user connects a YouTube channel. We request YouTube upload and read-only permissions to identify the channel selected by the user, display current channel metadata and upload a video or Short that the user explicitly chooses to publish or schedule. KORD does not request YouTube passwords or access unrelated viewing history, subscriptions or private messages.

Stored YouTube data may include the selected channel ID, channel name and avatar, encrypted OAuth credentials, token expiry, upload status and the resulting video ID or URL. We use it only for the visible connected-channel and publishing functions requested by the user.

KORD does not sell Google user data, use it for advertising, determine creditworthiness, or use it to train a generalized AI model. KORD's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect a YouTube channel in KORD or revoke access in Google Account permissions. After we receive a verified deletion request or detect revocation, we delete stored YouTube Authorized Data associated with that authorization as soon as possible and no later than seven calendar days, except data that applicable law independently requires us to keep. Deleting data in KORD does not delete videos or other data held by YouTube.

• Google API Services User Data Policy - the Limited Use rules that apply to Google API data
• Google Privacy Policy - how Google handles data in its services
• Google Account permissions - review or revoke KORD access
• KORD data deletion - request deletion of data held by KORD

Account and workspace data is kept while the account or workspace is active. A confirmed workspace deletion removes its active database records and stored media. Rotating production backups are normally retained for up to 14 days before expiry; restoration may temporarily reintroduce deleted data, which will be removed again through the normal deletion process.

Connected-platform credentials are kept only while the profile remains connected or as briefly required to finish an already accepted publishing operation. Disconnecting a profile clears its active credentials. Limited publishing and audit history may remain to preserve customer records and investigate incidents, unless provider-specific deletion rules require earlier removal.

Operational and security logs are kept for a limited period proportionate to troubleshooting and abuse prevention. Billing, invoice and transaction records are retained for the periods required by tax and accounting law.

Primary production hosting is in the European Economic Area. Some providers or connected social platforms may process data in other countries. Where GDPR requires safeguards and no adequacy decision applies, we use the European Commission's Standard Contractual Clauses and supplementary measures where appropriate. You can request information about the relevant safeguard from the privacy contact.

Where GDPR applies, you may request access, correction, deletion, restriction or portability of your personal data, object to processing based on legitimate interests, and withdraw consent. You also have the right to lodge a complaint with the supervisory authority in your habitual residence, place of work or place of the alleged infringement.

For data controlled by KORD, contact [email protected]. For workspace content controlled by a KORD customer, contact that organization first; we will assist the customer as required. We may verify identity and workspace authority before acting on a request.

The Czech supervisory authority is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), uoou.gov.cz.

• Czech Office for Personal Data Protection - supervisory authority information and contact details

KORD does not make solely automated decisions that produce legal or similarly significant effects about users. AI suggestions and readiness checks support publishing workflows; authorized people remain responsible for approval and publication unless they deliberately grant an automation elevated permissions.

The service is intended for organizations and authorized professional users, not for children. Do not create an account if you cannot enter into the applicable agreement or are not authorized by your organization.

We use role-based access, tenant isolation, encrypted provider credentials, secure session cookies, rate limits, audit logs, monitoring and backups. No online service can guarantee absolute security; see the Security page for reporting instructions.

We may update this policy when the service, providers or legal requirements change. We will post the new date on this page and provide additional notice when a change materially affects how we use personal data.