Correction (2026-08-15). The contact address on this page was gyjong@gmail.com, a personal mailbox, from version 1.0.0 until this version. Requests under this document — including data-subject requests, sub-processor objections and DPA requests — now go to kenny@flenzies.com, the firm address. Nothing about the processing changed; only where the post arrives. Mail sent to the old address will continue to be read.

Privacy Policy

This Privacy Policy explains how EaaS ("Expansion-as-a-Service", "we", "us") processes personal data when you or your organisation uses our multi-tenant AI workforce platform. It is written for transparency under the EU General Data Protection Regulation (GDPR, Regulation 2016/679) and applies to all users of the EaaS platform.

1. Who we are

EaaS is operated by Kenny (Kwang-Yong) Jung, currently as a sole proprietor in the Republic of Korea, transitioning to a German GmbH with seat in Munich during 2026. Until incorporation completes, the Korean sole proprietorship is the legal operator and your point of contact.

Contact (controller of platform-level data): kenny@flenzies.com
Postal address: Postal address pending German GmbH formation — Munich seat
Data Protection Officer: Not appointed. EaaS qualifies for the small-team derogation under Art. 37 GDPR (no large-scale processing of special categories; no large-scale systematic monitoring as core activity). Contact the controller directly for all data-protection matters.

2. Controller / processor split

EaaS is processor under Art. 28 GDPR for the contacts, signals, meeting notes and Gmail metadata that your tenant organisation imports. Your organisation is the controller of that content and is required to sign a Data Processing Agreement (DPA) with us before production use. The DPA is being finalised; until executed, tenants operate under this Privacy Policy and the Terms of Service as the interim baseline.

EaaS is controller for platform-level data: your Clerk user identity, audit logs of your actions on the platform, billing data (Phase B), and the legal-consent records we retain to demonstrate compliance.

3. What we collect and the legal basis

Category	Examples	Legal basis (Art. 6 GDPR)
Identity / account	Email, name, Clerk user id, IP + user-agent captured at consent	Art. 6(1)(b) — contract performance
Tenant content (you upload)	Contact name, email, phone, employer, LinkedIn URL, meeting notes	Art. 6(1)(b) on behalf of your tenant controller, per Art. 28 processor instructions
Gmail content (if you connect Gmail)	Thread metadata (subject, sender, recipients, timestamps), the Gmail snippet, and the first 500 characters of the message body — see the note below	Art. 6(1)(b) on behalf of your tenant controller, per Art. 28 processor instructions
Behavioural / audit	Action type, target object id, timestamp, IP address	Art. 6(1)(f) — legitimate interest in platform security and auditability; Art. 6(1)(c) where required by HGB §257 record retention
OAuth tokens	Google Gmail OAuth access + refresh tokens (read scope only)	Art. 6(1)(b) — necessary to deliver the integration you requested
Marketing communications	Email address for product updates	Art. 6(1)(a) — explicit consent; withdrawable at any time

On Gmail content. Version 1.0.0 of this policy stated that we do not ingest Gmail message bodies. That was inaccurate as implemented, and this version corrects it. When a user connects Gmail, the meeting-preparation agent reads the first 500 characters of each relevant message body in addition to thread metadata. Those excerpts are not stored verbatim in our database, but they are included in the prompt sent to the inference provider (Anthropic, see §5 and §6), and briefing material derived from them is stored as an artefact in your tenant. Gmail access is read-only, is granted per user rather than per organisation, and is revoked on disconnect.

Third parties who correspond with a connected mailbox therefore have their message excerpts processed. The mailbox owner is the party who grants this access; controllers should ensure their own Art. 13/14 notices to correspondents account for it.

Network enrichment via a third-party LinkedIn data vendor was described in version 1.0.0. That vendor was never adopted — see the "Configured but not in use" section of the sub-processor list — and the corresponding entry has been removed rather than left as an unexercised claim.

We do not process special categories of personal data (Art. 9 GDPR) and the service is not designed to. Do not upload health, biometric, religious or political data.

4. Purposes of processing

Operating the platform you contracted for (drafting briefings, surfacing relationship signals, preparing outreach material for human review).
Routing AI inference requests to the model provider you or your tenant chose (Anthropic Claude by default; tenant-selectable Ollama / vLLM self-hosted alternative).
Security, integrity and abuse prevention (audit logging, anomaly detection).
Billing and contract management (Phase B).
Product improvement using aggregated, de-identified usage signals. Your tenant content is never used to train AI models — see §9.
Legal compliance (HGB record retention; responding to lawful authority requests; GDPR rights fulfilment).

5. Sub-processors

We rely on a small, deliberately curated set of sub-processors. The current list, their roles, processing regions and links to their respective DPAs is published at /legal/subprocessors and is kept current as part of this Privacy Policy.

We notify controllers at least 30 days in advance of adding or replacing a sub-processor, allowing time to object under Art. 28(2) GDPR.

6. International data transfers

All stored data resides in Germany. The application, the PostgreSQL database and the encrypted backups run on a single server operated by Hetzner Online GmbH in Nuremberg (nbg1), Germany, on a LUKS2 full-disk-encrypted volume. Hetzner is established in Germany, so no Chapter V transfer arises from hosting.

Correction (2026-08-07). Version 1.0.0 of this policy stated that the database was Neon Postgres in eu-central-1 and that application functions ran on Vercel in fra1, both Frankfurt. The live service moved off that stack on 2026-08-01 (application) and 2026-08-04 (database), and the statement remained published until this version. Data remained inside Germany throughout; only the provider and city changed. The superseded environment has not yet been erased — an audit on 2026-08-07 confirmed it still holds records from the earlier period — and it is listed as being decommissioned in the sub-processor list until that is complete.

Two categories of processing leave the EEA:

United States — Anthropic receives the prompt content of each agent run, which may include tenant content and the Gmail excerpts described in §3. Clerk holds account identity records. Google operates the Gmail and Calendar APIs. Transfers rely on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) as set out in each provider's DPA; where applicable the EU-US Data Privacy Framework provides an additional safeguard for certified recipients.
Republic of Korea — the controller (Kenny Jung) is currently Korean-resident and administers the server remotely. Korea holds an adequacy decision from the European Commission (Commission Implementing Decision (EU) 2022/254 of 17 December 2021), so transfers do not require additional safeguards.

No data is transferred to Singapore. The enrichment vendor named in version 1.0.0 was never adopted.

Transfer-impact assessments are documented internally and available to controllers on request.

7. Storage and retention

Data	Retention
Tenant content (contacts, notes, metadata)	Lifetime of subscription + 30-day grace period after termination. Right-to-erasure requests honoured within 30 days.
Audit log	3 years (aligned with HGB §257 commercial-record minimum). Pseudonymised within 30 days after the subject's deletion request.
`legal_consents` records (proof of Art. 7(1) consent)	Retained for the lifetime of the platform as evidence of lawful basis. Pseudonymised after account deletion.
Encrypted backups	Taken daily and retained on a rolling short-term cycle (currently 7 days of provider snapshots plus on-server dumps), all within Germany.
OAuth tokens	Revoked and deleted on disconnect or account termination.

8. Your rights as a data subject

You have the following rights under the GDPR:

Access (Art. 15)
Rectification (Art. 16)
Erasure / right to be forgotten (Art. 17)
Restriction of processing (Art. 18)
Data portability (Art. 20)
Objection (Art. 21)
Not to be subject to a decision based solely on automated processing (Art. 22)
Withdrawal of consent at any time (Art. 7(3)), without affecting the lawfulness of prior processing

Some rights are already self-service in the product: a tenant data export, and per-subject erasure of a person from a campaign (which also suppresses that person from future collection, so erasure is not silently undone by the next run). For every other request, contact kenny@flenzies.com. We will acknowledge within 5 working days and complete within 30 days, in line with Art. 12(3) GDPR.

You also have the right to lodge a complaint with a supervisory authority:

Pending GmbH formation: the relevant German DPA will be the Bavarian State Office for Data Protection Supervision (BayLDA) for private-sector controllers in Bavaria, or the Federal Commissioner for Data Protection (BfDI) for any federal-level matters.
Current operator (sole proprietorship in Korea): the Personal Information Protection Commission (PIPC) of the Republic of Korea.

9. Automated decision-making and AI disclosure

The platform uses AI (Claude by Anthropic by default; tenant-selectable Ollama / vLLM self-hosted alternatives) to generate drafts, summaries and briefing material. We disclose this in accordance with Art. 50 EU AI Act (Regulation 2024/1689):

Every artefact the platform produces is AI-generated under human supervision.
No outbound communication is sent automatically. A human user must review and execute every outbound touch. This is enforced by the platform's MANIFEST §Sacred boundary as a product feature.
We do not make decisions solely by automated means that produce legal or similarly significant effects on you (Art. 22 GDPR).
Tenants may opt to route inference to self-hosted Ollama / vLLM to keep prompts and completions inside their own infrastructure.
The default Anthropic configuration sets no training on customer data. We verify this contractual setting periodically.

10. Cookies and similar technologies

We use only strictly necessary cookies (Clerk session, theme preference). No analytics, no advertising, no cross-site tracking pixels. Because we set only strictly necessary cookies, no consent banner is required under §25(2) TTDSG. If we add non-essential cookies later, we will request consent through a banner before they fire.

11. Children

The service is B2B and not directed at persons under 18. We do not knowingly collect personal data from minors. If you believe we hold data from a minor, contact kenny@flenzies.com and we will delete it.

12. Security

Encryption in transit: TLS 1.2 or higher for all client-server and server-server traffic.
Encryption at rest: The entire server volume — database, backups and application — is encrypted with LUKS2 full-disk encryption. Gmail OAuth tokens are additionally encrypted at the application layer with AES-256-GCM before persistence, so the database never holds a usable token.
Tenant isolation: Postgres Row-Level Security (RLS) enforced and FORCE-applied, verified by automated test suite.
Audit log: append-only, tamper-evident.
Access control: least-privilege admin access. Multi-factor authentication is required for platform-wide administrative access (cross-tenant surfaces), enforced by a first-party time-based second factor bound to a single session.
Incident response: controllers will be notified without undue delay and within 72 hours of becoming aware of a personal data breach affecting their data (Art. 33 GDPR).

13. Changes to this Policy

We publish updates here. The effectiveDate and version in the frontmatter of this document indicate the active version, and material changes are described in a dated correction note in the affected section rather than applied silently. The platform currently sends no email of its own, so for material changes we notify controllers directly at their contract contact at least 14 days before the change takes effect.

14. Contact

For any privacy question, complaint, or data-subject request:

kenny@flenzies.com EaaS — Kenny (Kwang-Yong) Jung Postal address pending German GmbH formation — Munich seat

This document is preparation material drafted for review by qualified German legal counsel. It is not legal advice. Kenny must engage a Munich-based Rechtsanwalt with IP/IT and GDPR expertise before relying on this Privacy Policy in dealings with paying clients.

Privacy Policy · version 1.2.0 · effective 15 August 2026. This document is published by EaaS and reviewed periodically. For questions, contact kenny@flenzies.com.