Privacy policy
Last updated: 11 October 2026
This Privacy Policy explains how KissMySkills collects, uses and discloses your personal information when you visit or buy from our online store at kissmyskills.com, use the KissMySkills apps, or otherwise communicate with us (together, the "Services"). The store is powered by Shopify. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing and disclosure of your personal information.
Please read this Privacy Policy carefully. By using the Services, you acknowledge that you have read it and understand how we collect, use and disclose your information.
Who we are
The controller of your personal data is Dzmitry Pliachko KREAL, trading as KissMySkills, ul. Stanisława Drabika 63/19, 52-131 Wrocław, Poland, NIP (VAT ID) PL8992909337, REGON 520256406 ("KissMySkills", "we", "us"). Contact: hello@kissmyskills.com, phone +48 699 810 680.
This policy covers:
- the online store kissmyskills.com;
- the KissMySkills apps: the AI CRM (crm.kissmyskills.com and app.kissmyskills.com), the KissMySkills connector for AI assistants (mcp.kissmyskills.com), Receptionist, Contracts, and the free and paid tools on kissmyskills.com;
- file delivery and our support mailbox.
For data that a business puts into its own workspace in our apps, that business is the controller and we act as its processor. See KissMySkills apps: data you put in.
Personal information we collect
"Personal information" means information that identifies or can reasonably be linked to you or another person. It does not include information that is collected anonymously or has been de-identified so that it cannot identify you. Depending on how you use the Services, we may collect:
- Contact details: your name, billing address, phone number and e-mail address.
- Financial information: payment card and transaction details, form of payment and payment confirmation. Card numbers are processed by Shopify Payments; we never see them.
- Store account information: your Shopify customer account, preferences and settings.
- Transaction information: the items you view, put in your cart or buy, your subscriptions and your past transactions.
- App account data: your e-mail address, an internal user ID, your plan and trial status, sign-in times, and the one-time sign-in codes we e-mail you (stored only as a hash and valid for 15 minutes). When you accept our Terms we record the Terms version, the time, your country and a short description of your browser.
- Connector data: the name of the AI client you connect, the OAuth tokens that authorise it (stored hashed), and a log of which tools and skills it used, including short search queries.
- Workspace content: contacts, deals, tasks, comments, candidates, website-chat transcripts, contracts and other content you or your team put into the apps. See KissMySkills apps: data you put in.
- Communications with us: what you include when you write to us, for example a support request.
- Feedback: if you choose to send feedback through your AI assistant (the KissMySkills connector) or the AI CRM, we store the text you approve, your account ID, your plan and your e-mail address so we can reply and tell you when it ships.
- Device and usage information: your device, browser and network connection, IP address and other identifiers, and how and when you use the Services. In the apps this is linked to an internal user ID, never to your e-mail address. See Cookies and analytics.
Where we get it
- Directly from you, when you create an account, buy, use the Services or write to us.
- Automatically, from your device when you use the Services, including through cookies and similar technologies.
- From our service providers, when they collect or process personal information on our behalf (for example Shopify at checkout).
- From a business that uses our apps, when it puts your details into its workspace (for example as a contact, lead or candidate), or when you leave your details in its Receptionist chat.
How we use it and our legal bases
We use personal information to:
- Provide and improve the Services: process payments and orders, deliver files, run your account and the apps, sign you in, send notifications about your account and orders, provide support, and understand which features and products are useful so we can improve them.
- Market to you: send marketing e-mails if you have agreed to receive them, and measure our marketing on the store after you accept analytics or marketing cookies.
- Keep the Services secure: authenticate you, prevent fraud and abuse, apply rate limits, and investigate suspicious activity.
- Communicate with you: answer your questions and maintain our business relationship.
- Meet legal obligations: keep accounting and tax records, respond to valid legal process, and establish, exercise or defend legal claims.
Under the EU General Data Protection Regulation (GDPR), we rely on these legal bases:
| Purpose | Legal basis |
|---|---|
| Selling products, delivering files, running your account and the apps, sign-in, support | Performance of a contract (Art. 6(1)(b) GDPR) |
| Invoicing, accounting and tax records | Legal obligation (Art. 6(1)(c) GDPR), Polish accounting and tax law |
| Security, fraud and abuse prevention, rate limiting, operational alerts, records of Terms acceptance, defending legal claims | Legitimate interests (Art. 6(1)(f) GDPR) |
| Product analytics in the apps and service e-mails such as trial reminders | Legitimate interests (Art. 6(1)(f) GDPR); you can object at any time |
| Anonymous storefront analytics | Legitimate interests (Art. 6(1)(f) GDPR) |
| Analytics and advertising cookies on the store, marketing e-mails | Consent (Art. 6(1)(a) GDPR); you can withdraw it at any time |
| Feedback you choose to send | Consent (Art. 6(1)(a) GDPR) |
Your e-mail address is necessary to buy from us or use the apps; without it we cannot create your account.
KissMySkills apps: data you put in
Who controls what. For your own account (e-mail, plan, orders, sign-in, analytics) we are the controller under this policy. For content that a business puts into its workspace (the people in its CRM, its leads, candidates, website-chat visitors or contract counterparties) that business is the controller, and we process the data on its behalf under our Data Processing Addendum. If your data is in someone else's workspace, please contact that business first; if you contact us, we will forward your request to them.
Hosting and security. The apps run on Cloudflare. Our subprocessors are listed at kissmyskills.com/pages/subprocessors. Our security measures are described at kissmyskills.com/pages/security.
Deleting your account. You can delete your account yourself at any time: in the AI CRM under Settings > Profile > "Delete account", or by asking your AI assistant to run the KissMySkills connector tool delete_my_account. Deleting your KissMySkills account also deletes your CRM account and ends all connected AI clients and sessions. Workspace admins can also export and delete a whole workspace under Settings.
How we use AI
- We do not train AI models on your data or on the content of any workspace, and our providers may not do so either.
- Your own AI assistant. When you connect Claude, ChatGPT or another assistant through the KissMySkills connector, that assistant reads and changes your workspace on your instructions, through access you approve. Its provider processes that data under your own agreement with it; it is not our subprocessor. You can disconnect it at any time and sign out all sessions.
- Receptionist. Receptionist answers website visitors using the answers the site owner configured, and its chat window is labelled as an AI assistant. To phrase a reply it uses an open AI model running on Cloudflare Workers AI; it sends the model the visitor's question (with e-mail addresses and phone numbers removed) and a few configured answers. The site owner can switch this off. Receptionist does not make decisions with legal or similarly significant effects on visitors.
- Tools. Some tools on kissmyskills.com use open AI models on Cloudflare Workers AI to process the text you submit.
- We do not send your data to any third-party AI model provider. Details: AI Terms.
Who we share it with
We disclose personal information only where needed for the purposes above:
- Our service providers (processors): Shopify (store, checkout, payments, subscriptions, store e-mails), Cloudflare (hosting, databases, file storage, AI models for Receptionist and tools, security), Resend (transactional e-mail such as sign-in codes), PostHog EU (product analytics), Zoho Mail EU (support mailbox) and Google (Analytics on the store, with consent). The full list with locations and transfer mechanisms is at kissmyskills.com/pages/subprocessors. Internal alerts to our team carry no names or e-mail addresses.
- Shopify and marketing partners. We use Shopify features that can support personalised advertising with third-party services based on your activity with different merchants and websites. These partners use your information under their own privacy notices. Depending on where you live, you may have the right to tell us not to share information about you for targeted advertising; you can opt out here.
- When you ask us to, or consent to it, for example when you connect your own AI assistant through the connector.
- In connection with a business transaction such as a merger or insolvency, to comply with legal obligations (including valid requests from authorities, see our Government Requests page), to enforce our terms, and to protect the Services, our rights and the rights of others.
We do not sell your personal information.
Relationship with Shopify
The store is hosted by Shopify, which collects and processes personal information about your access to and use of the store in order to provide and improve it. Information you submit to the store is transmitted to and shared with Shopify and with third parties that may be located in other countries. To help protect, grow and improve our business, we use certain Shopify enhanced features that incorporate data from your interactions with our store, with other merchants and with Shopify. For these features, Shopify is responsible for the processing of your personal information, including for responding to your requests to exercise your rights. To learn more, see the Shopify Consumer Privacy Policy. Depending on where you live, you can exercise certain rights through the Shopify Privacy Portal.
Third-party websites and links
The Services may link to websites or platforms operated by third parties. If you follow such links, please review their privacy and security policies. We are not responsible for the privacy or security of those sites. Information you share on public or semi-public venues, including third-party social networks, may be visible to other users of those platforms.
International transfers
We are based in Poland and keep personal data in the European Economic Area (EEA) where we can (PostHog EU in Germany, Zoho Mail in the EU, Shopify International in Ireland). Some providers are located in, or may access data from, countries outside the EEA, including the United States (Cloudflare, Resend, Google, Shopify Inc.). For these transfers we rely on a European Commission adequacy decision (including the EU-US Data Privacy Framework where the recipient is certified, and the decision for Canada) or on the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), or the equivalent UK instruments for UK data. You can ask for a copy of the safeguards at hello@kissmyskills.com.
How long we keep it
No security measures are perfect, and information you send us may not be secure in transit, so please do not send sensitive information through unsecured channels. Our security measures are described at kissmyskills.com/pages/security.
We keep personal information only as long as needed for the purposes above, and then delete it automatically or on a schedule:
| Data | How long we keep it |
|---|---|
| Orders, invoices, payment records | 5 years from the end of the calendar year in which the related tax became due, as required by Polish accounting and tax law |
| App account (e-mail, plan, sign-in history) | While your account exists. You can delete it yourself at any time (see Deleting your account) |
| Evidence that you accepted our Terms, after you delete your account | 3 years after deletion, reduced to an internal ID, the Terms version and the time |
| Sign-in codes | 15 minutes |
| CRM sign-in session | Ends after 7 days without activity, and after 30 days at most |
| Connector authorisations | Access tokens 1 hour; refresh tokens up to 90 days unless revoked |
| CRM workspaces you delete | Restorable for 30 days, then permanently deleted; removed from backups within a further 30 days |
| Receptionist conversations and messages | 180 days after the last activity in the conversation |
| Receptionist leads and bookings | 24 months |
| Connector usage logs (tools and skills used, short queries, notification log) | 12 months |
| Sign-in funnel events | 6 months |
| Product usage events in the CRM | 180 days |
| CRM admin access log | 24 months |
| Operational alerts to our team | 12 months |
| Feedback | 24 months |
| Support e-mails | 3 years after the conversation ends |
| File download links | Valid 30 days |
| Anonymous storefront analytics | 90 days |
| Product analytics (PostHog EU) | Up to 12 months |
| Google Analytics 4 on the store | 14 months |
We may keep data longer where the law requires it or where it is needed to establish, exercise or defend legal claims.
Your rights
Depending on where you live, you may have some or all of the rights below. They are not absolute and may apply only in certain circumstances.
- Access. Ask for a copy of the personal information we hold about you.
- Deletion. Ask us to delete your personal information. You can also delete your app account yourself (see Deleting your account).
- Correction. Ask us to correct inaccurate information.
- Portability. Receive your personal information in a portable format and ask us to transfer it to a third party.
- Opt out of sale or sharing for targeted advertising. Depending on where you live, you may opt out of the "sale" or "sharing" of your personal information or of "targeted advertising", as defined in applicable law. You can opt out here. If you visit our store with the Global Privacy Control signal enabled, depending on where you are, we treat it as a request to opt out for that browser and device, and for your Shopify account if we can link it. Learn more at globalprivacycontrol.org. Other than Global Privacy Control, we do not respond to other "Do Not Track" signals.
- Communication preferences. You can unsubscribe from promotional e-mails at any time using the link in them. We may still send you non-promotional e-mails about your account or orders.
If you live in the UK or the EEA, you also have these rights, subject to the limits in local law:
- Objection and restriction. You can ask us to stop or restrict processing for certain purposes. Where we rely on legitimate interests you can object at any time on grounds relating to your situation, and you can always object to direct marketing.
- Withdrawal of consent. Where we rely on consent, you can withdraw it at any time. This does not affect processing before the withdrawal.
How to exercise your rights. Write to hello@kissmyskills.com from the e-mail address linked to your account. We reply within one month (extendable by two months for complex requests; we will tell you why). For data processed by Shopify you can also use the Shopify Privacy Portal. We may need to verify your identity before acting on a request. You may use an authorised agent; we will ask for proof that you authorised them and may need to verify your identity directly. We will not discriminate against you for exercising your rights.
Complaints
Please contact us first at hello@kissmyskills.com. You also have the right to complain to a data protection supervisory authority, in particular in the EU Member State where you live, work or where the alleged infringement took place (list of EEA authorities). Our lead supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl.
Cookies and analytics
Store (kissmyskills.com). Shopify sets cookies needed for the cart, checkout and security. Analytics cookies, including Google Analytics 4 and PostHog EU, are set only after you accept them in the cookie banner. You can change your choice at any time with the "Cookie preferences" link in the store footer.
Anonymous storefront analytics. When you view products, add to cart or search on kissmyskills.com we record the product or search term (with e-mail addresses, phone numbers and similar personal data removed), your country and an anonymous visitor code. The code is derived from a random value that changes every day and is not stored beyond about 26 hours, so visits cannot be linked across days, and no cookie is set. We use this only to understand which skills interest visitors. It is processed on Cloudflare and deleted after 90 days. Legal basis: our legitimate interest in improving the catalogue (Art. 6(1)(f) GDPR).
Apps (sign-in pages and CRM). We use PostHog EU Cloud (Frankfurt, Germany) to measure which steps and features people use, to track errors, and to replay sessions for debugging with all text and inputs masked. Users are identified by an internal ID, not by e-mail, and links are stripped of query strings before they are sent. PostHog sets a first-party cookie.
Essential app cookies.
| Cookie | Purpose | Lifetime |
|---|---|---|
__Host-kms_crm |
CRM sign-in session | Ends after 7 days of inactivity, 30 days at most |
crm_lang |
Remembers your interface language | 1 year |
kms_ph_si |
One-time marker that you just signed in, read once by our analytics and then deleted | 10 minutes |
| Sign-in state cookies | Protect the sign-in flow | Minutes |
Receptionist's chat widget sets no cookies; it keeps the conversation only in your browser tab's session storage.
Children
The Services are not intended for children, and we do not knowingly collect personal information about children under the age of majority in your jurisdiction. The KissMySkills apps are business tools and are not intended for anyone under 16. If you are the parent or guardian of a child who has given us personal information, contact us and we will delete it. We do not have actual knowledge that we "share" or "sell" (as defined in applicable law) personal information of individuals under 16.
Changes to this policy
We may update this Privacy Policy, for example to reflect changes to our practices or for legal or regulatory reasons. We will post the updated policy on this page, change the "Last updated" date, and give notice where the law requires it.
Contact
For questions about this policy or to exercise your rights, e-mail hello@kissmyskills.com or write to:
Dzmitry Pliachko KREAL (KissMySkills)
ul. Stanisława Drabika 63/19
52-131 Wrocław, Poland
NIP (VAT ID): PL8992909337
REGON: 520256406
Phone: +48 699 810 680
Security issues: security@kissmyskills.com.