Privacy
Kova is an independent design studio based in Bavaria, Germany. This page explains what personal data we collect, why we collect it, how we protect it, and the rights you have over it. It is written to comply with the EU General Data Protection Regulation (GDPR) and applies to everyone who visits our site or works with us.
Who we are
Kova is operated by Alexander Gese, sole proprietor, Monbrunner Straße 20, 63897 Miltenberg, Germany. Reach us at contact@kovalead.com for anything on this page.
What we collect
We collect only what is necessary to run the studio's services. In practice, this is one of the following depending on how you interact with us:
- Contact and enquiry data. When you email us or fill in the contact form on kovalead.com, we receive your name, email address, and the message you send.
- Client portal accounts. If we set up a client workspace for you at kovalead.com/portal, we store your email address, the brand name you gave us, your account password (hashed, never in plain text), and the records of projects, meetings, files, invoices, and ad reviews attached to your workspace.
- Meeting bookings. When you book a meeting through our booking page, we store your name, email, chosen time, and any topic notes you enter.
- Billing information. Invoices and payment records are handled by Stripe. We store the invoice metadata (amount, description, status) on our side but not your card details.
- Cold outreach records. If we reach out to your brand with a portfolio pitch, we record your business email, the brand name, and whether you responded. We do not buy contact lists — we find prospects manually from public sources like the Meta Ad Library and brand websites.
- Basic technical logs. Our hosting provider (Vercel) records anonymous access logs — IP address, browser, response times — which help us keep the site running and secure.
Why we collect it
Every piece of data has one of these purposes, and no others:
- To reply to your enquiry (GDPR Article 6(1)(b) — pre-contract).
- To provide services you have signed up for (Article 6(1)(b) — contract performance).
- To send you invoices and receive payment (Article 6(1)(b) and legal record-keeping obligations under German commercial law).
- To follow up on cold outreach interactions we have started (Article 6(1)(f) — legitimate interest in business development, balanced against your right to opt out at any time).
- To keep our site secure and operational (Article 6(1)(f) — legitimate interest in service integrity).
Who else touches your data
We use a small stack of third-party services. Each is under a data processing agreement (DPA) with us, and each only sees the data it needs to do its job:
- Supabase — hosts our database and authentication. EU data centre where possible.
- Vercel — hosts our website and processes requests.
- Stripe — processes payments and stores payment method details on their PCI-compliant infrastructure.
- SMTP mail provider — sends transactional emails (booking confirmations, invoice notifications, outreach emails).
- OpenAI — used server-side to help draft outreach copy and generate ad mockups. We send them the prompt and reference information required for that specific request; we do not send them our client database.
We do not sell, rent, or share your data with any advertising network, data broker, or analytics reseller. Ever.
How long we keep it
Contact enquiries are kept for 24 months after our last correspondence unless you ask us to delete them sooner. Client account data is kept while your workspace is active plus 6 months after cancellation. Invoice and payment records are kept for 10 years to comply with German tax law (§ 147 AO). Cold outreach records where you did not respond are deleted within 90 days.
Your rights
Under the GDPR you have the right to access, correct, delete, or restrict the personal data we hold about you, and the right to object to processing based on legitimate interest. You can also request a machine-readable copy of your data (portability). To exercise any of these, email contact@kovalead.com and we will respond within 30 days.
You also have the right to lodge a complaint with a supervisory authority. For a private business in Bavaria that is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), based in Ansbach.
Cookies
Our site uses only strictly-necessary cookies for authentication (keeping you signed in to the client portal). We do not use analytics cookies, tracking pixels, or advertising cookies. Because we do not set any non-essential cookies, we do not display a cookie banner.
Changes
If we materially change this policy we will update the "last updated" date at the top of this page and, if you have an active client workspace with us, notify you by email. Older versions can be requested at contact@kovalead.com.
Contact
Alexander Gese, Kova Design Studio, Monbrunner Straße 20, 63897 Miltenberg, Germany.
Email: contact@kovalead.com