Privacy Policy — FolioAsk

Effective date: 13.10.2026

1. Controller

FolioAsk ("we", "us") is provided by KHUNCHRO, Heinrichstraße 97, 99092 Erfurt, Germany. Contact for privacy matters: info@khunchro.com.

FolioAsk is a document question-and-answer app: you upload documents (PDF, DOCX, TXT, or images) and ask questions, and the app returns answers with page citations. It is an AI assistant — it reads your documents; it does not provide professional, legal, financial, or medical advice (see §11).

2. Data we process

FolioAsk is a cloud service: your documents are stored on our servers so they can be processed and searched. We process:

• Account data: email address and authentication identifiers (Email/Password, Google, or Apple Sign-In).
• Documents: the files you upload (PDF, DOCX, TXT, images).
• Extracted content: text extracted from your documents, indexed and embedded as vectors for search.
• Chat history: your questions and the assistant's answers within a document.
• Usage data: document and question counts (to enforce plan limits), document and question language.
• Crash/analytics: anonymized crash reports (Firebase Crashlytics) and basic usage analytics (Firebase Analytics).

3. Where data is stored and processed

• Documents, extracted content, and chat history are stored with Firebase (Cloud Firestore and Cloud Storage), region europe-west3 (Frankfurt, Germany).
• Document processing (text extraction, language detection, embeddings) and question answering use Google Vertex AI (Gemini) and a self-hosted Qdrant vector database on Google Cloud Run, both in the EU.
• Subscriptions are managed by RevenueCat; payment card details are processed by the app stores (Apple / Google) and are never sent to us.

Google Ireland Ltd acts as processor for the Firebase, Cloud Storage, and Vertex AI services. Where processing involves a transfer of data outside the European Economic Area (for example, to Google infrastructure in the United States), the transfer is covered by the EU–U.S. Data Privacy Framework and/or the EU Standard Contractual Clauses.

4. Legal bases (Art. 6 GDPR)

• Performance of a contract (Art. 6(1)(b)): storing and processing your account, documents, extracted content, and chat history to provide the service.
• Legitimate interests (Art. 6(1)(f)): crash reporting and basic analytics to keep the service reliable and secure.
• Consent (Art. 6(1)(a)): where applicable.

5. Data sharing and third parties

We share data only as necessary to provide the service:

• Google (Firebase, Cloud Storage, Vertex AI/Gemini) — hosting, document processing, embeddings, and answer generation, all in the EU.
• Qdrant (self-hosted vector database on Google Cloud Run, EU) — stores document embeddings for retrieval.
• RevenueCat — manages subscription status; does not receive document content.
• Apple / Google — sign-in and payment processing per their terms.

We do not sell your data, use it for advertising, or use your documents to train models.

6. Security

Data in transit is encrypted with TLS (uploads and API calls). Data at rest is protected by the encryption of Google's cloud infrastructure (Cloud Storage and Cloud Firestore encrypt data at rest). In the event of a personal-data breach affecting data we process, we will notify you as required by law.

7. Analytics and tracking

The app uses Firebase Analytics (aggregated, pseudonymous usage) and Firebase Crashlytics (crash reporting). We do not serve advertising and do not track you across third-party apps or websites.

8. Retention and deletion

• Documents and chat history are retained while your account is active.
• Deleting a document removes it from Cloud Storage, Firestore, and the vector database.
• Deleting your account (Settings → Delete account) removes your profile, documents, and chat history.
• Crash and analytics data is retained per Google's standard retention periods.

If you contact us by email (e.g., info@khunchro.com), we retain that correspondence only as long as necessary to handle your request, then delete it.

9. Your rights (GDPR)

You may access, rectify, erase, restrict, or port your personal data; withdraw consent; object to processing based on legitimate interests; and lodge a complaint with a supervisory authority. Most rights are exercised in-app (e.g., deleting documents or your account). For other requests, contact info@khunchro.com.

10. Children

FolioAsk is not directed at children under 16.

11. AI and accuracy

Answers are generated by an AI model from your document's content. They may be incomplete or incorrect — verify important answers against the cited source. FolioAsk does not provide professional, legal, financial, medical, tax, or other advice; always consult a qualified professional.

12. Changes

We may update this policy. Material changes will be communicated in the app.

13. Contact

info@khunchro.com