Privacy policy

The Korkem AI service, korkem-ai.com. Published at: korkem-ai.com/ru/legal/privacy.

Operator: ИП Nomad JC (Чинозбеков Абдужамол Абдужалолович), IIN 990815301658, address: г. Астана, проспект Улы Дала, д. 29, кв. 169. Contact for personal data matters: admin@korkem-ai.com. The person responsible for organising the processing of personal data is Чинозбеков Абдужамол Абдужалолович.

This policy covers the korkem-ai.com website and the Korkem AI service and is drawn up in accordance with the Law of the Republic of Kazakhstan "On Personal Data and Their Protection" and the acts adopted under it.

• ·Your account data. Your email address; one-time sign-in codes; if you sign in with Google, the identifier and email address from your Google profile.
• ·Data about your business. What you told us yourself in the interview when you joined: a description of the business, products and services with prices, the tone of communication, the target audience.
• ·Access to social networks. Access tokens for the accounts you have connected. They are stored only in encrypted form (AES-256-GCM). We neither ask for nor store your social media passwords.
• ·Materials you upload. Photos and videos you give the service. If people appear in them, you are responsible for having their consent. We do not use images of faces to identify people.
• ·Created content and the schedule. Texts, images and videos created by the service, and their publication times.
• ·Conversations with your clients. If you have connected the agent that replies in direct messages: the messages themselves, the name or nickname of the person on the social network, the stage of the conversation and the contact, if the client left one. See section 5 for details.
• ·Payments. Records of orders and credit transactions. We neither receive nor store bank card details: they are processed by the payment institution.
• ·Data of connected social media accounts. With your permission, we read the account name, handle, avatar and your own posts, so that you can see which account is connected and so that we can analyse your style. If you allow access to statistics, we read those too. We do not request your follower lists or other people's posts.
• ·Technical data. Records of sign-ins and actions in the service needed for security and for investigating failures.

• ·To create posts and reply to your clients, that is, to provide the service under the contract (the Public offer).
• ·To publish to the accounts you have connected at the scheduled time.
• ·To keep account of credits, process payments and use cash register equipment.
• ·To ensure security and investigate incidents.
• ·To meet legal requirements.

We do not sell personal data or pass it on for other people's advertising.

The processing of your data is based on your consent and on the need to perform the contract. On registration you give two separate consents with ticks: to the collection and processing of data for the purposes set out in section 3, and to the transfer of data outside the Republic of Kazakhstan to the suppliers listed in section 6. We record the date, the time and the version of the policy. You can withdraw your consent at any time by writing to admin@korkem-ai.com or by deleting your account; withdrawing consent to cross-border transfer makes it impossible to use the features that depend on foreign suppliers.

When you connect the agent that replies in direct messages, the service processes the conversations with your clients. In this relationship you are the owner of the data, and we act as an operator on your instructions under Appendix 2 to the Public offer. Hence your obligations: to inform clients that their data are processed and that they are being answered by an artificial intelligence system, and to obtain consent, including consent to cross-border transfer, where the law requires it. We use these conversations only to reply within your dialogue and do not use them for any other purpose.

Only those without whom the service cannot work. Suppliers receive only what is needed for a specific operation.

• ·Google (Gemini models). What is passed: the brief, uploaded photos and videos and, for an account review, the texts and images of your posts. Country of processing: the USA and other countries where Google's servers are located.
• ·fal.ai (image and video generation). What is passed: the generation prompt and uploaded materials. Country of processing: the USA.
• ·Model developers to whom fal.ai passes the request (MiniMax, Kling). What is passed: the generation prompt and uploaded materials. Country of processing: the countries where the model developers' servers are located.
• ·OpenAI (fallback speech synthesis if the main one is unavailable). What is passed: the voice-over text of a clip. Country of processing: the USA.
• ·Groq (fallback speech recognition if the main one is unavailable). What is passed: the audio track of an uploaded video. Country of processing: the USA.
• ·Resend (sending email). What is passed: the email address and the text of service emails, such as sign-in and deletion codes and post notifications. Country of processing: the USA.
• ·The social networks you have connected: Telegram, VK, X, Pinterest, Instagram and Threads (Meta). What is passed: content to publish and replies in conversations. Country of processing: the USA, the Russian Federation and other countries where the platforms' servers are located.
• ·FreedomPay (Freedom Pay LLP). What is passed: the amount, the order number and the internal account number; card details are entered on FreedomPay's side. Country of processing: the Republic of Kazakhstan.
• ·The hosting provider hoster.kz. What is passed: all data of the service, that is, the database, files and backups. Country of processing: the Republic of Kazakhstan.
• ·The service developer, an individual processing data on the operator's instructions. What is passed: access only for maintenance and investigating failures, under a confidentiality obligation. Country of processing: the Republic of Kazakhstan.
• ·Public authorities. What is passed: only on a lawful request. Country of processing: the Republic of Kazakhstan.

AI model suppliers process data to fulfil your request under their own agreements. The current list of suppliers is available on request at admin@korkem-ai.com.

The main database with personal data is located in the Republic of Kazakhstan, as the law requires. User files (photos, videos) and backups are stored in the Republic of Kazakhstan.

Some operations require data to be transferred outside Kazakhstan: calls to AI models, sending emails and publishing to social networks whose servers are abroad. Such transfer takes place only with your separate consent, to the extent needed to provide the service, and over secure channels. We pass suppliers only the part of the data needed for a specific operation.

• ·Account and business data: as long as your account exists.
• ·One-time sign-in codes: minutes, until used or expired.
• ·Created content and materials: until you delete them or as long as the account exists.
• ·Conversations with clients: as long as the account exists or until you instruct us to delete them.
• ·Payment records: for the period set by accounting and tax law, for accounting and for considering refund requests.

Once the purpose of collection has been achieved, the data are destroyed.

You have the right to:

• ·know what data of yours we process and get a copy of it;
• ·require inaccurate data to be corrected;
• ·withdraw consent to processing and to cross-border transfer;
• ·require data to be blocked, depersonalised (anonymised) or deleted if they are collected or processed in breach of the law, and to delete your account;
• ·object to processing;
• ·appeal against our actions to the authorised body for personal data protection or to a court.

Send requests to admin@korkem-ai.com. We reply within the period set by law and no later than 3 business days after receiving the request, unless the law sets a different period.

You can delete your account and all related data in two ways: in the service, under Settings → Delete account; or by writing to admin@korkem-ai.com from the address your account is registered to. Details are on the "Data deletion" page. Deletion removes posts from our service, not from social networks: posts in your accounts remain yours and are deleted by you.

Through Instagram and Threads we receive only the data you allowed access to when connecting the account: the account profile, your posts, incoming messages and, if you allow it, statistics. We use them only to provide the service to you, do not pass them to advertising networks or data brokers and do not use them to train models. If you remove the Korkem AI app in the Instagram or Facebook settings, the service's access to the account ends. We delete the saved tokens and connection data when you disconnect the account in the service settings or delete your account. We treat data from other platforms the same way.

• ·Social media tokens are encrypted with the AES-256-GCM algorithm.
• ·Data are transmitted only over secure channels (HTTPS).
• ·Access to data is granted when needed, not by default.
• ·We do not store passwords for the service: you sign in with a one-time code or with Google.
• ·A person responsible for organising the processing of personal data has been appointed.

When we discover a personal data security breach, we notify the authorised body within one business day and inform the affected users.

The service creates content and composes replies to clients automatically, using AI models. Posts are published only after you approve them. Replies to clients are limited to the script you have set and to the data in your product catalogue; you inform clients yourself that they are being answered by an AI system (section 5). You can turn automatic replies off at any time and reply yourself.

The website uses only necessary cookies: to keep you signed in to your account and to complete connecting a social network securely. The colour theme you choose is stored in your browser. We do not use advertising or analytics cookies and do not pass data to third-party visit counters. If you turn cookies off in your browser, you will not be able to sign in to the service.

The service is intended for businesses and persons over 18. We do not knowingly collect data of minors; if you believe such data have reached the service, write to us and we will delete them.

We announce changes to the policy in the service or by email. The revision date is shown at the top.