Privacy Policy
Version of 11 October 2026
Kepdesk is an app for independent practitioners (psychologists and other professionals) to manage clients, their schedule, session notes and payments. This Policy explains what data we process, why, where it is stored and what rights you have. We follow the EU General Data Protection Regulation (GDPR) and the Law of Ukraine "On Personal Data Protection".
1. Who we are
The service is provided by Individual Entrepreneur Maksym Tolstik (registered address: Ukraine, region Kharkivska, district Sakhnovshchynskyi, village Nova Cherneshchyna, street Druzhby, build 11; "Kepdesk", "we"). For anything about your data, write to [email protected].
2. Two roles: your data and your clients' data
- Your account data (as a practitioner): we are the controller. We decide how it is processed and are responsible for it under this Policy.
- Your clients' data (client records, sessions, notes, payments, files for import): you are the controller and we are the processor. We process it only on your instructions and only to run the app. The rules are in the "Processing of client data" section of the Terms of Use. You provide the legal basis for processing your clients' data (including health data) and obtain your clients' consent.
3. Account data we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, password (stored only as a hash), specialization, language, profile settings | Create and run your account, let you sign in | Performance of a contract (Art. 6(1)(b) GDPR) |
| Google account identifier, if you sign in with Google | Sign-in with Google | Performance of a contract |
| Subscription status and Google Play purchase data (purchase identifier, expiry) | Provide the Pro plan, verify payment | Performance of a contract |
| Device push notification token | Send you notifications (e.g. the daily schedule digest) | Performance of a contract |
| Emails we send (email confirmation, password reset, account deletion) | Account security and management | Performance of a contract |
| Feedback you send in the app: text, an optional screenshot, device model and app version | Answer you and improve the service | Legitimate interest (Art. 6(1)(f)) |
| Crash reports from the app and the server: error type and location, app version, device model, account identifier (no client names, no note text) | Find and fix errors | Legitimate interest |
| Technical logs: IP address, time and type of request, errors; a log of actions on data (e.g. exporting a note or a finance report: only the fact and the format, not the content) | Security, abuse prevention, troubleshooting | Legitimate interest |
| Date and version of the Policy and Terms you accepted | Record which terms you agreed to | Legal obligation / legitimate interest |
We don't sell data, show ads, or use trackers or advertising identifiers. The app and these pages use no tracking cookies.
4. Who receives data
Only providers the service can't run without:
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Servers, database, backups | EU (Germany / Finland) |
| Cloudflare, Inc. | Attack protection and traffic delivery: requests to the service pass through Cloudflare's network | Global network, US company; EU-US Data Privacy Framework / Standard Contractual Clauses |
| Google (Firebase Cloud Messaging, Google Play, Sign in with Google, Google Calendar) | Push notifications; subscription billing; sign-in; importing events from your Google Calendar (read-only), only if you connect it | USA, under the EU-US Data Privacy Framework / Standard Contractual Clauses |
| Functional Software, Inc. (Sentry) | Crash reports from the app and the server | EU (Germany) |
| OpenRouter, Inc. and the AI model provider OpenRouter routes the request to | AI import: recognising clients and sessions in files you upload yourself to move your data from another program. Only when you start an import. We let OpenRouter route the request only to model providers whose terms say they don't retain request data (zero data retention) and don't use it for training; if no such provider is available, the import doesn't run | USA, under Standard Contractual Clauses |
| Resend | Sending service emails to your address | USA, under the Data Privacy Framework / Standard Contractual Clauses |
| Telegram | Reminders to clients through the bot, if the client connected it themselves; notifying our team of new feedback (feedback text only) | Outside the EU |
| Scaleway SAS | Keeping the encryption key in wrapped (encrypted) form; receives no personal data | EU (France) |
Push notifications never carry note text. We can't delete chat history inside Telegram itself; Telegram controls it. Data may also be disclosed when required by law.
5. How we protect data
- All connections use HTTPS only.
- Session notes, reasons for seeking help, contact notes, decline reasons, session and personal-time titles, and AI import drafts are additionally encrypted in the database (AES-256-GCM). The rest of the data is protected by encrypted connections and backups, access only through your account, and workspace isolation.
- The mobile app's offline copy of your data is kept on your device in an encrypted database (SQLCipher).
- Passwords, sign-in tokens and one-time links (password reset, email confirmation, account deletion, Telegram connection) are stored only as hashes. Google Calendar access tokens are stored encrypted.
- Backups are encrypted before they leave the server.
- Every workspace is isolated: one practitioner can't access another's data.
- Files for AI import are processed in an isolated process and deleted right after processing.
6. How long we keep data
- Your account and all workspace data, including your feedback: for as long as the account exists. After you ask to delete it, the account can be restored for 30 days, then everything is deleted for good.
- Backups: up to about 3 months; after that, deleted data is gone from them too.
- Erased clients: when you erase a client's data, their name, contacts, note text, payment comments and Telegram bot connection are destroyed; payment amounts, dates and methods stay, without the name, for your financial records. Erased data remains in backups until they are replaced (see below).
- Files for AI import: only while they are processed; an import draft you haven't confirmed: up to 7 days, and it is deleted as soon as you confirm or discard it.
- Log of actions on data (what was exported, imported or bulk-edited and when, without the content): for as long as the account exists; deleted with it.
- Crash reports: up to 90 days.
- Server technical logs are kept in a fixed-size buffer: new entries push out the oldest, so logs don't build up indefinitely. We don't write client names, contacts or note text to the logs.
- After account deletion: data is deleted from the live database after 30 days, from backups within about 3 months, and from crash reports and technical logs within the periods above.
7. Your rights
You have the right to access your data and get a copy, correct it, delete it, restrict processing, object to processing based on legitimate interest, receive it in a machine-readable format, and withdraw consent.
- Data export: in the app, under Profile.
- Account deletion: in the app (Profile → Delete account) or at kepdesk.app/delete-account.
- Anything else: write to [email protected]; we answer within 30 days.
You can lodge a complaint with a data protection authority: in Ukraine, the Ukrainian Parliament Commissioner for Human Rights; in the EU, the supervisory authority of your country.
If you are a client of a practitioner who uses Kepdesk (for example, you get reminders from us in Telegram), please send requests about your data to that practitioner first: they are the controller of your data. We will help them fulfil your request. You can stop the reminders at any time by sending /stop to the bot.
8. Age
Kepdesk is meant for practitioners aged 18 or over. Data of clients who are minors is entered by the practitioner, who obtains consent from their legal representatives.
9. Changes
We will tell you in the app about material changes to this Policy and ask you to accept the new version. The date of the current version is at the top of this page.