Privacy Policy
Privacy Policy
Effective Date: June 21, 2026
Who We Are
Kata-ru is a personal project by:
- Diego Quintana Esteve (Co-founder, Engineering)
- Maria Angeles Gomez Benitez (Co-founder, Strategy)
Entity Name: Kata-ru (trading name)
Contact Email: privacy@kata-ru.com
Postal Address: [TO BE PROVIDED — Legal address required before public launch]
What Data We Collect
When you join our waitlist, we collect:
- Email address — to send you launch updates and news
- Locale (EN or ES) — to send you content in your preferred language
- IP address hash (SHA-256) — to prevent spam and abuse
- User agent — to understand device and browser types
- Referrer URL — to understand where you found us
- UTM parameters (utm_medium, utm_campaign) — to measure marketing effectiveness
- Consent timestamp — to record when you agreed to receive emails
- Consent choice (cookie preferences) — to respect your analytics opt-out
- Profile data (professional experience, skills, education, preferences) — used for AI-assisted profile building and job search assistance via Amazon Bedrock
Why We Collect It
Lawful basis under GDPR Article 6:
- Consent: Your explicit opt-in checkbox on the waitlist form. We do not send marketing emails without this.
- Legitimate interest: IP-hash and user agent help us prevent spam and detect abuse. This is proportionate and necessary to protect our service.
How We Use It
- Send you launch announcements and product updates
- Monitor signup trends via privacy-respecting analytics (Umami)
- Prevent duplicate signups and spam attacks
- Contact you if there are critical security issues affecting your account
Who We Share It With
Your data is shared with these sub-processors only as necessary:
- Amazon Web Services (AWS) — hosting infrastructure (RDS database, ECS, S3). AWS Data Processing Agreement
- Amazon Bedrock (AWS) — AI subprocessor for profile building and CV extraction. We send profile content and CV text to Amazon Bedrock (Claude models) to generate AI-assisted profile sections. Data is processed in the eu-central-1 (Frankfurt) region. Legal basis: user consent via using the service. AWS Data Processing Addendum
- Resend — transactional email (welcome email, launch notification). Resend DPA
- Umami Cloud (umami.is) — privacy-respecting website analytics: cookieless, no personally identifiable information collected, all data anonymised. Processed by Umami Software, Inc. on EU/US servers under a Data Processing Agreement. Umami Privacy · Umami sub-processors
We do not sell, rent, or share your data with any other third parties.
International Data Transfers
Resend is EU-based, so no international transfer occurs for email.
Umami Cloud (Umami Software, Inc., USA) processes anonymised, cookieless analytics data on servers located in the EU and the United States. These transfers are covered by our Data Processing Agreement with Umami, which incorporates the EU Standard Contractual Clauses and, where the UK GDPR applies, the UK International Data Transfer Addendum. Our analytics does not collect directly identifying information such as your name or email; any IP address is used only transiently to derive approximate location and is not stored in identifiable form.
Data Retention
- Waitlist data: Retained for 90 days after product launch, then deleted or migrated to a user account (if you create one).
- Consent records: Retained for 3 years to comply with marketing regulation audits.
- CV draft history (internal quality data): When we generate a CV for you, we keep the intermediate draft versions and our automated quality-review notes for that CV as internal data used to improve our AI writing. We retain this under our legitimate interest (GDPR Art. 6(1)(f)) in improving the quality of our AI-generated outputs, which we consider proportionate given its short retention and internal-only use. This data is tied to the CV: it is deleted when you delete the CV, and in any case when your account data is erased (within the standard 30-day deletion grace period). It is internal evaluation data rather than content you provided, so it is not included in a data-portability export — your finished CV is.
- Deletion on request: You can request erasure at any time (see “Your Rights” below).
Your Rights (GDPR & UK GDPR)
You have the right to:
- Access: Request a copy of all data we hold about you
- Rectification: Correct any inaccurate data
- Erasure: Request deletion of your data (“right to be forgotten”)
- Restriction: Ask us to stop processing your data
- Portability: Receive your data in a portable format (CSV)
- Objection: Opt out of marketing emails at any time
- Complaint: Lodge a complaint with your data protection authority:
To exercise any of these rights, email privacy@kata-ru.com with your request. We will respond within 30 days.
Cookies & Tracking
See our Cookie Policy for details on cookies and consent management.
Umami analytics does not use cookies and does not collect personally identifiable information. It respects the “Do Not Track” browser setting.
Unsubscribe from Emails
Every marketing email contains an unsubscribe link. Click it, or reply to privacy@kata-ru.com to be removed from our mailing list immediately.
Children
This service is not directed at children under 16. We do not knowingly collect data from children. If we discover we have collected data from a child, we will delete it immediately.
Changes to This Policy
We may update this policy from time to time. We will notify you of material changes by email or by posting the updated policy here with a new “Effective Date.”
Contact Us
Privacy questions? Email privacy@kata-ru.com
This policy was last updated on June 21, 2026. It will be reviewed by a solicitor within 2 weeks of public launch.