Privacy Policy

Last updated September 30, 2026

Version of 30 September 2026.

1. Who we are

The controller of your personal data is KORVIIA FLOU LLC (ТОВ «КОРВІЯ ФЛОУ»), EDRPOU 46116432, 13 Khmelnytske Highway, Vinnytsia, 21036, Ukraine ("we", "us").

Questions about your data: support@coreviaflow.space.

2. What data we collect

Email address — you enter it when you sign up or place an order.
Contact and billing details — your country, the name and phone number you enter when you sign up, and, if you give them or we ask for them (Terms, sections 3.1 and 3.5), your postal address and whether you buy as a consumer or as a business. For businesses, also the company name, VAT number and contact person. We need them to conclude the contract, to apply the correct tax, and to comply with sanctions law.
Password — only as a hash; we never store the password itself.
Order details — plan, billing term, add-ons, your country, the server's region, company name and tax number (if you give them), amount and status. You enter them yourself or through your AI assistant.
IP address from which an order was placed — collected automatically.
Consent at checkout — when you tick the box asking us to start the service immediately, we record the time, the exact wording you agreed to and your IP address.
Withdrawal from a contract — if you use the "Withdraw from contract here" function, we record your name, email address, the contract concerned, the time, the site language and your IP address.
Sign-in attempts (email, IP address and time) — to protect against password guessing. They are deleted automatically when the check window ends.
Dashboard session — the cf_session cookie; we store only a hash of it.
Connected AI assistants — the assistant's name, access level (view or manage), validity period and time of last use, when you grant access.
Action log — which tool was called, by which assistant, with which arguments and result, and who confirmed it.
Support requests — subject and a short description, when an assistant hands your question to a person.
SSH keys — the key's name and fingerprint, when you add a key.
Servers assigned to your account.
Web server logs — IP address, time, requested page and browser (User-Agent), collected automatically when you visit the site.
Abuse reports — if you report abuse, we process your name, email and the content of your report to handle it. We forward the report to the customer concerned without your contact details, unless you agree otherwise. Data related to child sexual abuse material is preserved and passed to the competent authorities as required by law.

You need to give us your name, email address and phone number to create an account, and your email address and country to place an order. Without them we cannot create your account or provide a server. We use your phone number to process card payments and share it with the payment service for that purpose, once online payment is connected. If we ask for the other contact and billing details listed above to conclude or perform the contract, we may not be able to provide or continue the Service without them. Everything else is optional.

What we do not collect: there is no third-party analytics and there are no advertising pixels on our site. We do not store bank card details — card payments are handled by the payment service hutko.

We do not look at the contents of your servers. For those contents we are a processor acting on your instructions, not a controller (see Terms, section 13).

Creating your account, signing you in, providing and supporting your server; sign-in links and order emails — performance of the contract (Art. 6(1)(b)).
Protection against password guessing, spam and abuse (sign-in attempts, IP addresses, rate limits) — our legitimate interest (Art. 6(1)(f)).
Records of your consent at checkout and of any withdrawal from a contract — legal obligation (Art. 6(1)(c)) under consumer protection law, and our legitimate interest (Art. 6(1)(f)) in being able to prove them.
The AI assistant action log, so you can see what was done on your behalf — performance of the contract and our legitimate interest.
Invoices and tax records — once online payment is connected: our legitimate interest (Art. 6(1)(f)) in complying with Ukrainian tax and accounting law and in establishing, exercising or defending legal claims, and legal obligation (Art. 6(1)(c)) where EU or Member State tax law applies to us.
Sanctions screening — orders from the countries and territories listed in section 9.1 of the Terms are refused automatically, based on the country you give. We may also check the details you give us, your country and the IP address of your order against sanctions lists, when you order and during the contract. Legal basis: legal obligation (Art. 6(1)(c)) where EU or Member State sanctions law applies to us, and otherwise our legitimate interest in not dealing with sanctioned persons (Art. 6(1)(f)). Apart from the automatic refusal by country, a person, not an automated system, decides whether to refuse an order or suspend a server on sanctions grounds.
Handling abuse reports and notices of illegal content — our legitimate interest (Art. 6(1)(f)), and legal obligation where the EU Digital Services Act applies.
Visitor statistics from our own server logs (no third-party services) — our legitimate interest.

4. Who receives your data

The infrastructure providers on which our servers and the Service run, in the data-centre regions where the Service operates and where you choose to place your server.
The email delivery provider through which we send emails.
An AI assistant to which you have granted access — only within the level you granted.
The payment service hutko and its partner bank PUMB (Ukraine), which process card payments and receive your phone number for that purpose, once online payment is connected.
Public authorities — only where the law requires it.

We name recipients by category above. If you ask us, we will tell you the identity of the specific recipients of your personal data, including the specific infrastructure and email delivery providers (Article 15(1)(c) GDPR). Business customers receive the names of our sub-processors under the Data Processing Agreement (Terms, section 13.5).

Our infrastructure and email delivery providers process data only on our instructions as our processors. The payment service hutko and PUMB bank process your card data as independent controllers under their own privacy notices and the rules of the card schemes; we receive only the payment result, not your card number.

When you connect an AI assistant, the data it reads or sends through our interface is also processed by the assistant's provider under that provider's own terms and privacy notice. The provider is an independent controller, and we are not responsible for its processing.

We do not sell your data.

International transfers. We are established in Ukraine, which is outside the European Economic Area. The European Commission has not adopted an adequacy decision for Ukraine. Because we offer the Service to people in the European Union, we are ourselves subject to the GDPR (Article 3(2) GDPR) and apply it to your data. Your data is stored in the data-centre regions where the Service operates, and it is accessed from Ukraine to provide the Service. Where we transfer personal data from the EEA to other recipients outside the EEA, we use a safeguard permitted by Chapter V GDPR, such as the Standard Contractual Clauses adopted by the European Commission. You can ask us for a copy of the relevant safeguards at support@coreviaflow.space.

5. How long we keep it

Account — while your account exists. After you ask us to delete your account, personal data is erased within 30 days, except the records listed below that we still need.
Order records and the IP address from which an order was placed — while your account exists; after that, only as long as needed to meet tax and accounting obligations or to establish, exercise or defend legal claims, and then deleted.
Consent and withdrawal records — while your account exists; after that, only as long as needed to establish, exercise or defend legal claims, and then deleted.
Invoices and payment records — for the period required by tax and accounting law.
Action log — while your account exists; it is deleted together with the account.
Support requests and SSH keys — while your account exists, or until you remove the key; they are deleted together with the account.
Sign-in attempts — only for the protection window, then deleted automatically.
Sessions — until you sign out or the session expires.
Web server logs — up to 90 days.
Server contents — kept for 14 days after your Service ends, then permanently deleted (Terms, section 13.3).

6. Your rights

You have the right to get a copy of your data, to correct it, to have it deleted, to restrict its processing, to object to processing based on legitimate interest, and to receive your data in a machine-readable format. You can revoke an AI assistant's access in your dashboard at any time. You can also complain to a data protection supervisory authority — in the EU, the authority of your country of residence; in Ukraine, the Ukrainian Parliament Commissioner for Human Rights.

To use your rights, email support@coreviaflow.space. We answer within one month.

7. Cookies

We use two technical cookies only:

cf_session keeps you signed in to the dashboard. HttpOnly, Secure; it expires when you sign out or when the session ends, at the latest after 12 hours.
cf_lang remembers the site language, and is set only when you choose a language yourself. It expires after 12 months. You can delete it at any time in your browser.

We use no advertising, analytics or tracking cookies. These cookies are strictly necessary to provide the service you request or to apply a setting you chose, so under Article 5(3) of Directive 2002/58/EC they do not require consent.

8. Security

Passwords are stored only as hashes; sign-in links and sessions are stored as hashes; connections use HTTPS.

9. Changes to this Policy

We will email you about material changes to this Policy before they take effect.