Privacy, in plain language.

1. Who we are

KAREN is a LinkedIn content creation, editing, planning, analytics, and publishing service available through Telegram and a web application (the “Service”). The data controller is Eugene Bevziuk, a sole proprietor registered in Ukraine (“KAREN”, “we”, “us”).

2. Data we collect

Account and profile data

Telegram ID and username, email address where used, authentication data, language, timezone, LinkedIn or Buffer profile identifiers, subscription status, and settings.

Content you provide

Ideas, prompts, drafts, published posts, comments, hooks, voice-note transcripts, images, screenshots, links, documents, content plans, media attachments, and feedback or edits you make.

Content profile and style memory

Your role, industry, audience, expertise, goals, content pillars, preferred language, tone, vocabulary, topics to avoid, example posts, and patterns learned from your accepted or rejected variants.

Usage and technical data

Feature interactions, generation and version history, scheduling actions, timestamps, error logs, device/browser information, IP address, and security events. Where enabled, we also process LinkedIn performance metrics and monitored topics.

Payment data

Payments may be processed by a third-party payment provider. We generally receive billing status and transaction references, not full payment-card details.

3. How and why we use data

• Provide the Service: create, rewrite, store, schedule, and publish content; synchronize Telegram and web experiences; manage accounts and subscriptions. Legal basis: performance of a contract.
• Personalize output: apply your profile, prior edits, preferred style, and settings. Legal basis: performance of a contract and, where appropriate, legitimate interests.
• Analytics and trends: calculate content performance, best times to post, and relevant trend digests when enabled. Legal basis: performance of a contract or consent where required.
• Security and reliability: prevent abuse, debug failures, maintain idempotent publishing, and protect accounts. Legal basis: legitimate interests and legal obligations.
• Communications: send service notices, support replies, and product updates. Legal basis: contract, legitimate interests, or consent depending on the message.
• Legal compliance: maintain records and respond to lawful requests. Legal basis: legal obligation.

We do not sell your personal data.

4. Website analytics and session replay

With your prior permission, we use PostHog EU Cloud to understand how visitors use the public landing page and improve conversion and usability. We record purpose-built events such as sections viewed, CTA clicks, pricing choices, FAQ opens, scroll depth, and whether a waitlist submission succeeded. We do not send the email address entered into the waitlist form to PostHog.

If you allow analytics, PostHog may use first-party cookies or browser storage to distinguish visits. Session replay may record page layout, clicks, pointer movement, and scrolling. All form inputs are masked, the entire waitlist form is excluded from replay, request and response bodies are not recorded, and automatic capture is disabled. Analytics is not loaded before consent. You can refuse without losing any feature or withdraw your choice at any time through “Cookie settings” in the landing-page footer. Legal basis: consent.

5. AI processing

Your prompts and relevant content may be sent to configured AI providers to generate or improve output. Depending on service configuration, this may include Anthropic and an OpenAI fallback. Only data reasonably required for the requested operation is sent. AI output may be inaccurate; you are responsible for reviewing and approving content before publication.

KAREN does not publish automatically without an explicit user action or a schedule you have confirmed. We do not use solely automated decisions that produce legal or similarly significant effects about you.

6. Service providers and integrations

We share data only as needed to operate features you use. Provider categories may include:

• Telegram for bot messaging and authentication;
• AI model providers for content generation;
• Buffer for LinkedIn scheduling and publishing;
• PostHog EU Cloud for consented landing-page analytics and privacy-masked session replay;
• Apify for configured trend or profile-data collection;
• cloud hosting, PostgreSQL/database, logging, email, and security providers;
• Cloudflare R2 or another S3-compatible provider for public post media;
• payment providers where subscriptions are enabled.

Each provider processes data under its own terms and, where applicable, a data-processing agreement. We may also disclose data when legally required, to protect rights or safety, or in connection with a business transaction subject to appropriate safeguards.

7. Data retention

We retain account data while your account is active. Drafts, ideas, version history, scheduled posts, analytics, and style memory are retained so the Service remains persistent across sessions and restarts. Consented landing analytics and session replay are retained for the period configured in PostHog and are periodically reviewed for deletion. You can delete individual content where the interface allows or request account deletion. After deletion, data is removed or anonymized within a reasonable period, except for backups, security records, transaction records, or information we must keep by law.

8. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to processing, receive a portable copy of data, and withdraw consent. Some rights depend on the legal basis and circumstances.

Send requests to [email protected]. We may verify your identity. EEA/UK users may also complain to their local data protection authority; in Portugal this is the Comissão Nacional de Proteção de Dados (CNPD).

9. Security

We use reasonable technical and organizational measures designed to protect personal data, including access controls, encrypted transport, scoped user access, protected secrets, backups, and monitoring. No service can guarantee absolute security. Keep your Telegram, email, and connected accounts secure and tell us promptly about suspected unauthorized access.

10. International transfers

Some providers may process data outside your country or the EEA. Where required, we use recognized safeguards such as adequacy decisions or standard contractual clauses. Provider-specific locations and safeguards may change as our infrastructure evolves.

11. Children

The Service is intended for business and professional users aged 18 or older. We do not knowingly collect personal data from children.

12. Changes

We may update this policy as the Service changes. We will update the date above and provide additional notice when a change is material.