Privacy Policy

This Privacy Policy describes how Kostiak Systems LLC ("Kostiak Green", "we", "us") collects, uses, and protects personal information of people who use the Kostiak Green platform (the "Platform") — that is, our paying and trial customers and their team members. It does not apply to the third-party market data our Platform analyzes, which does not contain personal information about your customers or consumers.

Account information: business name, name, email address, password (stored as a salted hash, never in plain text), and any cannabis license or business information you choose to provide.

Billing information: when you subscribe to a paid plan, payment is handled directly by our payment processor, Paddle.com. We do not receive or store your full card number — we receive limited billing metadata from Paddle (such as subscription status, plan, and billing history) needed to manage your account.

Usage information: pages visited, features used, buttons clicked, and similar in-product activity; device, browser, and approximate location information inferred from IP address; log data including IP address and timestamps.

Communications: the content of any message you send us, for example by emailing hello@kostiak.pro.

We use PostHog, a product analytics tool, to understand how customers use the Platform so we can improve it. PostHog automatically records page views, clicks, and form interactions (autocapture), and may record session replays of your in-product activity to help us diagnose usability issues. Password fields are explicitly excluded and masked from session recording and are never captured. If you are logged in, we associate this usage data with your account (business/tenant identifier and plan) so we can support you more effectively — we do not use it to build advertising profiles, and we do not sell it to data brokers or advertisers.

We do not use third-party advertising or cross-site tracking cookies. The cookies and local-storage values we use are limited to those required for login sessions, your in-product preferences, and the analytics described above.

We use the information described above to: provide and maintain the Platform; authenticate your account and enforce plan limits; process billing through Paddle; respond to support requests; send service and account-related communications (such as trial and billing notices); detect and prevent abuse or violations of our Terms of Service; and improve the Platform's features and reliability. We do not use your account or usage data to train any public-facing AI or machine learning product offered to other customers.

We share personal information only with service providers who help us operate the Platform, under appropriate confidentiality and data-protection terms:

Paddle.com — payment processing and billing (acting as merchant of record).

Cloud infrastructure providers — hosting, database, and application infrastructure.

PostHog — product analytics, as described in Section 3.

We may also disclose information if required by law, subpoena, or court order, or to protect the rights, property, or safety of Kostiak Green, our customers, or others. If our business is acquired or merged, we will notify affected customers before any transfer of personal information.

We do not sell your personal information to third parties, and we do not share your account data with other Kostiak Green customers, including competitors of your business.

We retain account information for as long as your account is active, and for a reasonable period afterward to comply with legal, accounting, or reporting obligations and to resolve disputes. You may request deletion of your account and associated personal information at any time as described in Section 8; billing records may be retained longer where required by applicable tax or accounting law.

We use industry-standard safeguards to protect personal information, including encryption in transit, hashed password storage, access controls on our infrastructure, and secrets management for credentials. No system is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will notify you in accordance with applicable law.

Depending on your location, you may have the right to: request access to the personal information we hold about you; request correction of inaccurate information; request deletion of your information; request a portable copy of your information; or object to or restrict certain processing. To exercise any of these rights, email hello@kostiak.pro. We will respond within a reasonable time and in accordance with applicable law.

California residents: we do not sell or share personal information for cross-context behavioral advertising. [CCPA/CPRA-SPECIFIC LANGUAGE TO BE CONFIRMED BY ATTORNEY IF THE COMPANY MEETS THE APPLICABLE THRESHOLDS.]

EEA/UK residents: [GDPR-SPECIFIC LANGUAGE — LAWFUL BASIS, INTERNATIONAL TRANSFER MECHANISM, AND SUPERVISORY AUTHORITY DETAILS — TO BE CONFIRMED BY ATTORNEY IF THE COMPANY SERVES EEA/UK CUSTOMERS.]

The Platform is intended for business use by adults working in the licensed cannabis industry and is not directed at, nor knowingly used by, anyone under 21 years of age. We do not knowingly collect personal information from anyone under 21.

We may update this Privacy Policy from time to time. If we make a material change, we will provide notice via email or an in-product notice before the change takes effect.

Questions about this Privacy Policy or requests regarding your personal information can be sent to hello@kostiak.pro.

Kostiak Systems LLC · [REGISTERED BUSINESS ADDRESS TO BE CONFIRMED BY COMPANY]