Privacy Policy

1. Who this policy covers

This policy applies to visitors, registered Clients, Professionals, job applicants, and anyone who contacts us through the platform, regardless of where you are located.

2. Information we collect

Information you provide directly

• Account information: name, email, phone number, password (stored encrypted, never in plain text), timezone, company name (Clients).
• Professional application data: resume, work history, education, skills, certifications, portfolio links, a short video introduction, expected rate, and English proficiency self-assessment.
• Booking information: meeting date/time, notes about what you need help with.
• Support requests: the content of support tickets and chat conversations, including any files you attach.
• Payment information (future feature): processed directly by our payment provider (Stripe); we do not store full card numbers on our own servers.

Information collected automatically

• Basic usage data (pages visited, device/browser type, approximate location from IP address) for analytics and security purposes.
• Cookies and similar technologies (see Section 7).

3. How we use your information

We use your information to:

• Create and manage your account and verify your identity (email verification, login).
• Match Clients with suitable Professionals and generate AI-powered recommendations.
• Schedule, confirm, and remind you of consultations and meetings, including creating Google Calendar events and Google Meet links on your behalf.
• Send transactional communications (booking confirmations, reminders, application status, support replies) and, only with your consent, marketing communications.
• Review and process Professional applications.
• Respond to support requests and investigate reports of misconduct.
• Maintain platform security, detect fraud, and enforce our Platform Rules.
• Improve the platform and understand how it's used.

We do not sell your personal information.

4. Who we share information with

We share information only as needed to operate the platform:

• Professionals and Clients with each other, limited to what's needed for a booking (name, relevant profile details, meeting notes) — a Client's private contact details are not shared with a Professional beyond what's needed to conduct the consultation.
• Service providers who process data on our behalf, under contractual confidentiality obligations, including: our database and authentication provider (Supabase), our AI provider (OpenAI, for generating match recommendations and support chatbot responses — we do not send full resumes or sensitive documents to this provider, only the query text needed to generate a response), our calendar and video provider (Google, for Calendar/Meet integration), our email provider (Resend, for sending transactional email), and our payment processor (Stripe, once payments are enabled).
• Legal and safety reasons, if required by law, or to protect the rights, safety, or property of Kalag, our users, or the public.
• Business transfers, if Kalag is involved in a merger, acquisition, or sale of assets — you'll be notified of any change in ownership or use of your data.

5. International data transfers

Kalag is based in the Philippines and serves Clients and Professionals globally. This means your information may be processed in the Philippines and in other countries where our service providers operate (including the United States, where several of our infrastructure providers are based). Where required — for example, for Clients located in the European Economic Area — we take steps intended to ensure appropriate safeguards are in place for these transfers, such as standard contractual clauses with our service providers.

6. Data retention

We retain personal information for as long as your account is active, plus a reasonable period afterward to comply with legal, accounting, or reporting obligations, resolve disputes, and enforce our agreements. Rejected Professional applications are retained for 12 months in case of future application, then deleted or anonymized unless you ask us to delete them sooner.

7. Cookies

We use essential cookies (required for login and core functionality) and, with your consent, analytics cookies to understand platform usage. You can control cookie preferences through our cookie banner and your browser settings. Disabling essential cookies may prevent parts of the platform from working correctly.

8. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data ("right to be forgotten"), subject to legal retention requirements.
• Object to or restrict certain processing.
• Request a copy of your data in a portable format.
• Withdraw consent for marketing communications at any time.

To exercise any of these rights, contact us at privacy@kalag.co. We will respond within the timeframe required by applicable law (for example, the Philippines Data Privacy Act of 2012, and where applicable, GDPR or CCPA).

9. Data security

We use industry-standard safeguards including encryption in transit and at rest, database-level access controls that restrict each user to only their own data, role-based access for staff, and audit logging of sensitive account actions. See our Security & Data Management page for more detail. No system is 100% secure, and we encourage you to use a strong, unique password and enable additional login protection where available.

10. Children's privacy

Kalag is not directed at, and does not knowingly collect information from, anyone under the age of 18. If we learn we've collected information from a minor, we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. We'll notify registered users of material changes by email or in-platform notification, and update the "Last updated" date above.

12. Contact us

Questions about this policy or your data can be sent to privacy@kalag.co or Kalag Marketing Agency, Philippines.