Privacy policy

Last updated 3 September 2026

Kimiiii is a private, internal revenue-operations tool operated by Sosa Projects, LLC ("we", "us"). It is used by the staff of a single creator-management agency. This policy explains what personal data the tool holds, why, and what you can ask us to do about it.

1. Who the data is about

Two distinct groups:

• Agency staff — the owners, managers, and chatters who sign in to Kimiiii.
• The agency's customers — the subscribers and fans of the creators the agency manages, whose purchase and messaging records the agency already holds on the creator platform it uses, and which Kimiiii reads in order to report on them.

2. What we hold about staff

• Name and work email address.
• A hashed password and a two-factor authentication secret. We never store your password in readable form.
• Session records, including the IP address and approximate time of each sign-in, kept so that we can detect unauthorised access.
• Your role in the agency, and which creators you are assigned to.
• Work you logged on the creator platform, which the tool reads back in order to produce your own performance and bonus figures.

3. What we hold about the agency's customers

Kimiiii does not collect anything directly from customers. It reads records the agency already holds in its account on the creator platform it uses to run its roster, and stores a working copy so that it can produce trends over time. That copy can include:

• The platform's own identifier and display name for the customer.
• Purchase history and totals, subscription and renewal dates.
• Activity and engagement timestamps.
• Message history between the customer and the creator's account, used to explain to a manager why a given recommendation was made.

Where the agency is the controller of that data and we process it on the agency's behalf, we act on the agency's documented instructions.

4. Why we hold it

• To provide the tool — reporting, forecasting, and prioritising work for the agency. Our lawful basis is the legitimate interest of the agency in understanding and running its own business.
• To secure the accounts — authentication, two-factor enrolment, and sign-in records. Lawful basis: legitimate interest in preventing unauthorised access.
• To meet the agency's obligations — where the agency must retain commercial records.

We do not use this data for advertising, and we do not sell it.

5. Who else sees it

Kimiiii runs on infrastructure we control, with a small number of processors:

• Hetzner Online GmbH — the single server the application and its database run on, located in Hillsboro, Oregon, United States.
• Cloudflare, Inc. — domain registration, DNS, TLS termination, and the tunnel through which the site is reached (United States).
• Anthropic, PBC and OpenAI, L.L.C. — where a manager explicitly asks the tool to summarise or explain a record, or where a scheduled summary runs. Only the records needed to answer that request are sent (United States).

We disclose data otherwise only where the law requires it.

Where the data is held. Kimiiii's server and database are in the United States, and the processors above are US companies. If you are in the UK or the EEA, this means your personal data is transferred outside your home jurisdiction. Those transfers rely on the European Commission's standard contractual clauses and the UK international data transfer addendum, as incorporated into our agreements with each processor.

6. How long we keep it

• Staff accounts — for as long as the account is active. When an owner removes an account, the login and its sessions are deleted; historical performance figures already reported to the agency may be retained.
• Sign-in and session records — expired sessions are removed automatically.
• Customer records — kept while the agency's relationship with the creator platform continues, and deleted when the agency's account is closed or on the agency's instruction.

7. How it is protected

• The site is served only over HTTPS. The application server exposes no inbound ports to the public internet at all — traffic reaches it through an outbound-only tunnel.
• Every account requires two-factor authentication.
• Agencies are isolated from one another in the database at the row level, so one agency's staff cannot read another's data even if the application were mistaken.
• Staff see only the data their role allows; those limits are enforced on the server.

8. Your rights

If you are in the UK or the EEA you can ask us for a copy of your personal data, ask us to correct or erase it, ask us to restrict or object to how we use it, and ask for it in a portable form. You can also complain to your local data protection authority.

Write to [email protected] and we will respond within one month. If your request concerns data the agency controls, we will pass it to the agency and tell you that we have.

9. If you are in California

Sosa Projects, LLC is a California limited liability company. Under the California Consumer Privacy Act you may ask us what categories of personal information we have collected about you, where we got it, and why we hold it; ask for a copy; and ask us to delete or correct it. We will not treat you differently for asking.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding twelve months. Make a request at [email protected].

10. Cookies

Kimiiii sets only the cookies strictly necessary to sign you in and keep you signed in, and only once you have signed in. They are removed when you sign out. We run no analytics, advertising, or tracking cookies on this site, and the public pages set no cookies at all.

11. Changes

If we change this policy materially we will update the date at the top and tell account holders by email.

12. Contact

Sosa Projects, LLC, 255 S Grand Ave, Los Angeles, CA 90012, USA.
[email protected]