Privacy Policy

Kolis, portfolio reporting for private equity

Effective 4 September 2026 · Operated by Omar Husseini, The Courtyard, Wadi Abu Jmiel, Downtown, Beirut, Lebanon · Contact omar.husseini77@gmail.com

The short version This service holds financial information belonging to private companies and to the funds that invest in them. We do not sell it, we do not use it to train anything, and we do not use it for any purpose other than operating the service for the customer who put it there. The rest of this page says the same thing precisely, and says which third parties are involved.

1. Who is responsible for what

Two different relationships run through this service, and the law treats them differently.

Data	Our role	What that means
Account data: the names, email addresses and roles of the people who log in	Controller	We decide why and how it is held, because it is how the service authenticates people.
Reporting data: financial figures, uploaded documents, and everything a portfolio company files	Processor	The fund (our customer) decides why and how it is processed. We act on their instructions and nothing more.

Where we act as processor, the fund is the controller and is responsible for having a lawful basis for the data it puts here, and for its own relationship with its portfolio companies. A written data processing agreement governs that relationship and takes precedence over this page where the two differ.

2. What we hold

Account data

Name, email address, and the role assigned to the account (fund partner, portfolio company, or investor).
Authentication data held by our authentication provider. We never see or store passwords in readable form.
The fund and, where applicable, the portfolio company the account belongs to.

Reporting data

Quarterly financial figures filed by portfolio companies: profit and loss lines, balance sheet lines, and derived measures.
Documents uploaded in support of a filing, such as management accounts.
Where a fund connects an accounting system, the accounting data drawn from it for the periods it covers.

Reporting data is company financial information. It is not, in the ordinary case, personal data, but a management account or an uploaded document may incidentally contain names, salaries or other personal information, and it is treated with the same protection either way.

Operational logs

We record that a request happened: which route, which role, how long it took, and which fund and company it belonged to. We do not log the figures themselves, the contents of a question asked of the assistant, filenames, or email addresses. The log table has no free-form column capable of holding them, and an automated test scans it against a deliberately planted leak to confirm the scan can detect one before reporting that it found none.

3. Why we hold it, and on what basis

Purpose	Basis (UK/EU GDPR)
Operating the service for the customer	Performance of a contract; processor acting on the controller's instructions
Authenticating people and enforcing who may see what	Performance of a contract; legitimate interests in securing the service
Keeping operational logs to diagnose faults and detect misuse	Legitimate interests in a secure and functioning service
Meeting legal, tax and regulatory obligations	Legal obligation

We do not use reporting data for marketing, for analytics sold to anyone, or to build products for other customers. We do not sell personal data. We do not share it for behavioural advertising.

4. Artificial intelligence in this service

Two features send data to a third-party model provider, and it is worth being exact about which.

Document extraction. When a portfolio company uploads a document, its contents are sent to the model provider to extract the financial line items. The document text leaves our infrastructure for this purpose.
Scoped question answering. When a user asks a question about figures they are already permitted to see, those figures and the question are sent to the model provider to compose an answer.

In both cases the request is bounded by the same access rules as the rest of the service: the model is only ever sent data the requesting user was already entitled to read.

Stated plainly, because it is the question a fund partner will ask Our current agreement with the model provider is their standard commercial arrangement, under which customer inputs and outputs are not used to train their models. A zero data retention agreement is planned and is not yet in place. Until it is, request data may be retained by the provider for a limited period under their standard terms. We will not represent otherwise, and no real client data enters this system before that and the independent security review below are complete.

5. Sub-processors

These are the third parties that process data on our behalf. We will give notice before adding a new one.

Provider	What it does	Where
Supabase	Database, authentication, and document storage	Germany (Frankfurt)
Vercel	Application hosting and delivery	United States (Virginia)
Anthropic	Document extraction and question answering (see section 4)	United States
Intuit	Where a fund connects QuickBooks, accounting data is drawn from Intuit at the customer's instruction	United States

Transfers outside the UK and EEA are made under the UK International Data Transfer Addendum and the European Commission's Standard Contractual Clauses, as applicable.

6. How the data is protected

Split deliberately into what is enforced today and what is planned. Nothing planned is described here as current.

Enforced today

Separation is enforced by the database, not by application code. Row level security is forced on every table holding customer data, so the application cannot opt out of it. A request for another fund's data returns nothing rather than an error.
No bypass credential exists in the application. The deployed application has never held a key that overrides those rules.
Sessions are revalidated, not trusted. Every navigation reconfirms the session with the authentication server, and a user's role is read from the database rather than from anything the account holder can edit.
Uploaded documents are never public. Storage is private and every read goes through a signed link valid for sixty seconds.
Filings are append only. No filed figure can be deleted or rewritten by anyone in any role. A correction is a new filing that supersedes the previous one, and both remain on the record.
The database is in the European Union. Supabase runs in eu-central-1, Frankfurt. Application hosting and delivery is on Vercel in the United States, which is why the transfer clause below still applies.
Outbound email is disabled until a verified sending domain is configured.

Planned, and stated as planned

An independent security review of the separation model, signed off in writing. No real client data enters the system before that sign-off.
A zero data retention agreement with the model provider.
Point-in-time database recovery on the production tier.

7. How long we keep it

Reporting data is kept for as long as the fund's account is active, and then in accordance with the data processing agreement, and by default returned or deleted within 60 days of termination.
Account data is deleted within 60 days of an account being closed, except where a legal obligation requires otherwise.
Operational logs are kept for 12 months.

Filings are append only, so a correction does not erase what was previously filed. That is deliberate: an audit trail that can be quietly rewritten is not an audit trail. Deletion at the end of a relationship removes the whole record, chain included.

8. Your rights

Where UK or EU data protection law applies, individuals have the right to access their personal data, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable form. There is also a right to complain to a supervisory authority.

Where we act as processor, these requests belong to the fund, not to us. If you are a portfolio company employee or an investor and you make a request to us directly, we will pass it to the fund whose account holds the data and tell you that we have done so.

For account data, where we are the controller, write to omar.husseini77@gmail.com. We respond within one month.

9. Cookies

The service uses only cookies necessary to keep you signed in and to protect the session. There are no advertising cookies, no third-party analytics trackers, and no cross-site tracking.

10. Security incidents

If we become aware of a breach affecting customer data we will notify the affected fund without undue delay and in any event within 72 hours of becoming aware of it, with what we know, what we are doing, and what they may need to do. Where we are the controller, we notify the relevant supervisory authority as required.

11. Children

This is a business service. It is not directed at children and we do not knowingly collect data from anyone under 16.

12. Changes

If this policy changes materially we will notify account holders by email before the change takes effect. The effective date at the top of this page always reflects the current version.

13. Contact

Omar Husseini · The Courtyard, Wadi Abu Jmiel, Downtown, Beirut, Lebanon · omar.husseini77@gmail.com