Privacy Policy

Kolegio ("Kolegio", "we", "us") is operated by Kolegio d.o.o., the data controller for the personal data described in this policy.

• Address: Voćarska cesta 20, 10000 Zagreb, Croatia
• Company registration number (OIB): 39391177574
• VAT ID: HR39391177574
• Contact for privacy questions: privacy@kolegio.app (or mislav@kolegio.hr until that mailbox is set up)

Kolegio connects to your Gmail, Google Calendar, Google Tasks, and Google Contacts, and lets you read, search, and act on your email through WhatsApp — drafting replies, creating calendar events and tasks, and sending you daily digests — using AI to summarize and draft on your behalf.

Derived data. We also generate and store AI classifications, summaries, draft text, per-contact language and writing-style profiles, and an activity / audit log, all used solely to provide the Service to you.

Kolegio's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, Google user data is:

• used only to power the assistant features you explicitly request inside WhatsApp;
• never used for advertising;
• never sold to third parties, ever;
• not used to develop, improve, or train generalized AI/ML models.

It is never read by a human at Kolegio except (a) with your explicit consent for support purposes, or (b) as required to investigate abuse or comply with the law.

You can withdraw your consent and revoke Kolegio's access to your Google account at any time at myaccount.google.com/permissions.

• Performance of contract — to provide the Kolegio service you signed up for (triage email, draft replies, manage calendar/tasks, deliver reminders, transcribe voice notes).
• Consent — to connect your Google account and access Gmail, Calendar, Tasks, and Contacts. You can withdraw this consent at any time.
• Legitimate interests — to keep the service secure, prevent abuse, debug issues, and improve user-facing features.
• Legal obligation — to comply with applicable laws.

To draft replies, summarize emails, and understand your free-text instructions, message and email content is sent to our AI sub-processors:

• Anthropic (Claude models) — drafting, summarizing, classification, and Q&A over your email. Email subjects and bodies are sent here.
• Groq (Whisper) — transcribing voice messages you send on WhatsApp.

These providers process data as our sub-processors under their own data protection terms and do not use your content to train their models under our commercial agreements with them.

• Message metadata, encrypted OAuth tokens, and activity logs are stored in Cloudflare D1 (database) and Cloudflare KV, in Cloudflare's infrastructure.
• Voice recordings, cached email bodies, and attachments are stored in Cloudflare R2 object storage, encrypted at rest, and deleted automatically after a limited retention window.
• Google OAuth tokens are encrypted at rest with a per-user derived key before storage, and are never stored or logged in plaintext.
• Access controls and audit logging for production systems.
• Transport encryption (TLS) for data in transit.

• Email/calendar/task content is cached only as long as needed to serve the assistant feature you used, and is periodically purged.
• Voice recordings are deleted after transcription.
• We keep account data and derived data for as long as your account is active.
• If you disconnect your Google account or delete your Kolegio account, we delete your stored tokens and cached content within 30 days, except where we must retain records for legal, tax, or fraud-prevention purposes.

If you are in the EU/EEA, you have rights under the GDPR to:

• access, correct, export, or delete your personal data;
• restrict or object to certain processing;
• data portability;
• withdraw consent at any time (e.g., by disconnecting Google access or ending your WhatsApp session).

How to exercise them:

• Contact privacy@kolegio.app to exercise any of these rights, including account and data deletion.
• Revoke Kolegio's access to your Google account anytime at myaccount.google.com/permissions.
• Unpair WhatsApp from inside Kolegio.

You also have the right to lodge a complaint with the Croatian supervisory authority, Agencija za zaštitu osobnih podataka (AZOP).

We use the following sub-processors, who act on Kolegio d.o.o.'s instructions:

• Google — your connected data source (Gmail, Calendar, Tasks, Contacts APIs).
• Meta Platforms — WhatsApp Cloud API (the messaging channel).
• Anthropic — Claude AI models for drafting, summarizing, classification.
• Groq — Whisper voice-note transcription.
• Clerk — authentication.
• Cloudflare — hosting, database (D1), object storage (R2), KV, Queues.
• Stripe — payment processing (only if/when paid plans are enabled; currently unused).

Some of these providers are based in the United States. International transfers of personal data outside the EU/EEA occur under the European Commission's Standard Contractual Clauses or an equivalent lawful transfer mechanism.

Our website uses only the cookies and local storage strictly necessary to operate the site (for example, to keep you signed in and remember your language). If we introduce analytics or non-essential cookies in the future, we will update this policy and, where required, ask for your consent.

Kolegio is not directed at, and is not knowingly used by, anyone under 16. We do not knowingly collect personal data from anyone under 16.

We may update this Privacy Policy from time to time and will post updates here. For material changes, we will notify you via WhatsApp or email and update the "Last updated" date.

Questions or requests? Email us at privacy@kolegio.app (or mislav@kolegio.hr).