Privacy Policy
Kolis, portfolio reporting for private equity
Effective 24 September 2026 · Operated by Omar Husseini, Beirut, Lebanon · Contact omar@kolis.io
The short version This service holds financial information belonging to private companies and to the funds that invest in them. We do not sell it, we do not use it to train anything, and we do not use it for any purpose other than operating the service for the customer who put it there. The rest of this page says the same thing precisely, and says which third parties are involved.1. Who is responsible for what
Two different relationships run through this service, and the law treats them differently.
| Data | Our role | What that means |
|---|---|---|
| Account data: the names, email addresses and roles of the people who log in | Controller | We decide why and how it is held, because it is how the service authenticates people. |
| Reporting data: financial figures, uploaded documents, and everything a portfolio company files | Processor | The fund (our customer) decides why and how it is processed. We act on their instructions and nothing more. |
Where we act as processor, the fund is the controller and is responsible for having a lawful basis for the data it puts here, and for its own relationship with its portfolio companies. A written data processing agreement governs that relationship and takes precedence over this page where the two differ.
2. What we hold
Account data
- Name, email address, and the role assigned to the account (fund partner, portfolio company, or investor).
- Authentication data held by our authentication provider. We never see or store passwords in readable form.
- The fund and, where applicable, the portfolio company the account belongs to.
Reporting data
- Quarterly financial figures filed by portfolio companies: profit and loss lines, balance sheet lines, and derived measures.
- Documents uploaded in support of a filing, such as management accounts.
- Where a fund connects an accounting system, the accounting data drawn from it for the periods it covers.
Reporting data is company financial information. It is not, in the ordinary case, personal data, but a management account or an uploaded document may incidentally contain names, salaries or other personal information, and it is treated with the same protection either way.
Operational logs
We record that a request happened: which route, which role, how long it took, and which fund and company it belonged to. We do not log the figures themselves, the contents of a question asked of the assistant, filenames, or email addresses. The log table has no free-form column capable of holding them, and an automated test scans it against a deliberately planted leak to confirm the scan can detect one before reporting that it found none.
3. Why we hold it, and on what basis
| Purpose | Basis (UK/EU GDPR) |
|---|---|
| Operating the service for the customer | Performance of a contract; processor acting on the controller's instructions |
| Authenticating people and enforcing who may see what | Performance of a contract; legitimate interests in securing the service |
| Keeping operational logs to diagnose faults and detect misuse | Legitimate interests in a secure and functioning service |
| Meeting legal, tax and regulatory obligations | Legal obligation |
We do not use reporting data for marketing, for analytics sold to anyone, or to build products for other customers. We do not sell personal data. We do not share it for behavioural advertising.
4. Artificial intelligence in this service
Two features send data to a third-party model provider, and it is worth being exact about which.
- Document extraction. When a portfolio company uploads a document, its contents are sent to the model provider to extract the financial line items. The document text leaves our infrastructure for this purpose.
- Scoped question answering. When a user asks a question about figures they are already permitted to see, those figures and the question are sent to the model provider to compose an answer.
In both cases the request is bounded by the same access rules as the rest of the service: the model is only ever sent data the requesting user was already entitled to read.
Stated plainly, because it is the question a fund partner will ask Our current agreement with the model provider is their standard commercial arrangement, under which customer inputs and outputs are not used to train their models. A zero data retention agreement is planned and is not yet in place. Until it is, request data may be retained by the provider for a limited period under their standard terms. We will not represent otherwise, and no real client data enters this system before that and the independent security review below are complete.5. Sub-processors
These are the third parties that process data on our behalf. We will give notice before adding a new one.
| Provider | What it does | Where |
|---|---|---|
| Supabase | Database, authentication, and document storage | Germany (Frankfurt) |
| Vercel | Application hosting and delivery | United States (Virginia) |
| Anthropic | Document extraction and question answering (see section 4) | United States |
| Intuit | Where a fund connects QuickBooks, accounting data is drawn from Intuit at the customer's instruction | United States |
Transfers outside the UK and EEA are made under the UK International Data Transfer Addendum and the European Commission's Standard Contractual Clauses, as applicable.
6. How the data is protected
Split deliberately into what is enforced today and what is planned. Nothing planned is described here as current.
Enforced today
- Separation is enforced by the database, not by application code. Row level security is on for every table, and the application connects to the database only as an ordinary signed-in user, which has no way to switch it off. A request for another customer's data returns nothing rather than an error.
- No bypass credential exists in the application. The deployed application has never held a key that overrides those rules.
- Sessions are revalidated, not trusted. Every navigation reconfirms the session with the authentication server, and a user's role is read from the database rather than from anything the account holder can edit.
- Uploaded documents are never public. Storage is private and every read goes through a signed link valid for sixty seconds.
- Filings are append only. No filed figure can be deleted or rewritten by anyone in any role. A correction is a new filing that supersedes the previous one, and both remain on the record.
- The database is in the European Union. Supabase runs in eu-central-1, Frankfurt. Application hosting and delivery is on Vercel in the United States, which is why the transfer clause below still applies.
- Outbound email is disabled until a verified sending domain is configured.
Planned, and stated as planned
- An independent security review of the separation model, signed off in writing. No real client data enters the system before that sign-off.
- A zero data retention agreement with the model provider.
- Point-in-time database recovery on the production tier.
7. How long we keep it
- Reporting data is kept for as long as the fund's account is active, and then in accordance with the data processing agreement, and by default returned or deleted within 60 days of termination.
- Account data is deleted within 60 days of an account being closed, except where a legal obligation requires otherwise.
- Operational logs are kept for 12 months.
Filings are append only, so a correction does not erase what was previously filed. That is deliberate: an audit trail that can be quietly rewritten is not an audit trail. Deletion at the end of a relationship removes the whole record, chain included.
8. Your rights
Where UK or EU data protection law applies, individuals have the right to access their personal data, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable form. There is also a right to complain to a supervisory authority.
Where we act as processor, these requests belong to the fund, not to us. If you are a portfolio company employee or an investor and you make a request to us directly, we will pass it to the fund whose account holds the data and tell you that we have done so.
For account data, where we are the controller, write to omar@kolis.io. We respond within one month.
9. Cookies
The service uses only cookies necessary to keep you signed in and to protect the session. There are no advertising cookies, no third-party analytics trackers, and no cross-site tracking.
10. Security incidents
If we become aware of a breach affecting customer data we will notify the affected fund without undue delay and in any event within 72 hours of becoming aware of it, with what we know, what we are doing, and what they may need to do. Where we are the controller, we notify the relevant supervisory authority as required.
11. Children
This is a business service. It is not directed at children and we do not knowingly collect data from anyone under 16.
12. Changes
If this policy changes materially we will notify account holders by email before the change takes effect. The effective date at the top of this page always reflects the current version.
13. If you are in Lebanon
We operate from Beirut, so Lebanon's Law No. 81 of 10 October 2018 on Electronic Transactions and Personal Data applies to the personal data we hold, alongside UK and EU law. It covers information about identifiable people, not about companies, so in this service it reaches account data and any personal details that happen to appear in a filed document. The information its article 88 requires us to give you is on this page:
| What the law asks | Where it is answered |
|---|---|
| Who is responsible for the processing | Section 1: us for account data, the lender or fund for reporting data |
| Why the data is processed | Section 3 |
| Which information you must give, which is optional, and what happens if you do not give it | A name, an email address and a role are needed to sign in, and without them there is no account. Nothing else is asked of you |
| Who receives it | The customer whose account holds it, and the sub-processors in section 5. Nobody else |
| Your right to see it, correct it, and object to its use for a legitimate reason | Section 8. Write to omar@kolis.io; we answer within one month |
We apply the stricter of the two regimes wherever they differ. Where the lender is a bank, information about its clients is also covered by the Lebanese Banking Secrecy Law; how we handle that is set out in section 15 of the data processing agreement.
14. Contact
Omar Husseini · Beirut, Lebanon · omar@kolis.io
Kolis is operated by Omar Husseini as a sole trader. Where a company is later incorporated to carry on this business, this policy and the obligations in it transfer to that company on notice to account holders.