Privacy Policy

MVPGROW INC. (“MVPGROW,” “Kollate,” “we,” “us,”or “our”) provides Kollate. This Policy applies to kollate.ai, app.kollate.ai, our capture tools and integrations, and related support and communications (the “Service”).

We act as a controller when we decide why and how to process data for account administration, billing, security, support, website analytics, and our own business operations. For content processed on behalf of an organization, the organization generally acts as controller and we act as its processor under our Data Processing Addendum. Questions about an organization's use of your content should first be directed to that organization.

Customer Content may include sensitive or special-category data if a user chooses to include it. We do not require this data and process it for the customer under the customer's instructions. Customers are responsible for establishing an appropriate lawful basis and safeguards.

We do not use identifiable Customer Content to train our own machine-learning models. We may create, use, license, disclose, or commercialize aggregated or deidentified information that cannot reasonably identify or be linked to a person, customer, or workspace. We maintain that information in deidentified form and do not attempt to reidentify it, except to test our deidentification methods.

If you use an organization workspace, the organization controls the workspace and its content. Its administrators can access, export, manage, and delete all member content, including conversations a member may consider private. Content may remain available to the organization after a member leaves. The organization is responsible for informing members, obtaining required employee or contractor consent, configuring capture lawfully, and avoiding covert surveillance or unauthorized third-party data capture.

We may disclose personal data to:

• service providers and subprocessors that support hosting, databases, authentication, AI processing, payments, analytics, communications, security, and support, under contractual data-protection duties;
• your organization and its administrators, according to workspace settings and the organization's instructions;
• connected third-party services when you direct or authorize a connection, sign-in, export, or other interaction;
• professional advisers and authorities where reasonably necessary to comply with law, enforce agreements, protect rights and safety, or establish or defend claims; and
• transaction participants in a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to appropriate safeguards.

Our current processors are listed on the Subprocessor List. We do not sell personal data for money or share personal data for cross-context behavioral advertising. If that practice changes, we will update this Policy and provide any legally required choice before it begins.

When an authorized user invokes an optional analysis feature, Kollate may send selected conversation text and context to OpenAI. Kollate applies automated redaction patterns intended to remove common secret formats before transmission, but no automated process can identify every secret or sensitive value. OpenAI's standard API practices apply: API content is not used to train OpenAI models by default, and abuse-monitoring logs may be retained for up to 30 days unless law or security needs require longer retention. Kollate has not represented that zero-data-retention processing applies.

We use essential browser storage for security, authentication, and remembering your privacy choice. Google Analytics loads on this website only after you accept analytics. We configure it without advertising personalization or Google Signals. You can change your decision at any time through “Cookie settings” in the footer. Details, including typical storage periods, appear in our Cookie Notice.

You or an authorized workspace administrator may request deletion at dpa@mvpgrow.com. We may retain limited records when required by law or necessary to establish, exercise, or defend legal claims. Deidentified information is not subject to deletion where it cannot reasonably be linked back.

Kollate is operated by a United States company and is available globally. Our primary Supabase database is hosted in the EU Central 1 (Frankfurt) region, but we and other providers may process data in the United States, European Economic Area, and other countries where we or they operate. Where required, we use recognized safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and Swiss-law adaptations. See the DPA.

Depending on where you live and the context, you may have rights to access, correct, delete, restrict, or receive a portable copy of personal data; object to certain processing; withdraw consent; or appeal a decision. You may also complain to your local data-protection authority. We will not discriminate against you for exercising a right.

Submit a request to dpa@mvpgrow.com. We may verify your identity and authority, and may direct a request involving organization-controlled content to the relevant organization. Authorized agents may submit requests where law permits, subject to verification. We will respond within the period required by applicable law.

We use technical and organizational measures intended to protect personal data, including encrypted transmission, provider-supported encryption at rest, tenant access controls, role-based permissions, hashed capture credentials, signed capture requests, replay protection, data-minimizing capture rules, and limited content logging. No method of storage or transmission is perfectly secure. Report suspected issues to security@mvpgrow.com.

Kollate is for people aged 18 or older and is not directed to children. We do not knowingly collect personal data from anyone under 18 through this Service. If you believe a minor has provided data, contact us so we can investigate and take appropriate action.

We may update this Policy as the Service, law, or our practices change. We will post the updated version and revise the effective date. If a change materially affects how we use personal data, we will provide additional notice where required.

Contact us with privacy questions or requests using the details below. People in the EEA or UK may also contact their local supervisory authority. MVPGROW is not established in the EEA or UK. Based on counsel's assessment of Kollate's current offering and processing, MVPGROW has determined that appointment of an EU or UK representative is not presently required. We will reassess that conclusion if the relevant facts or law change.