Privacy
3 November 2026
Who we are
Kav Yashar operates kavyashar.com. The service organizes a German citizenship application for descendants of people persecuted under the Nazis and for people of German descent. We do not file with the embassy or the BVA.
The company that operates this site is being registered. This page will name it and give its address once registration is complete. Until then, reach us at [email protected].
The short version
We never sell your data. No data brokers, and nobody uses it to train AI models. Advertising cookies stay off unless you turn them on, and even then Meta only learns that you visited, never what you told us.
You can delete everything yourself, at any time. In your account settings, https://www.kavyashar.com/dashboard/settings, Delete account erases your account, application, uploaded files, chats, and support messages right away. You do not have to email anyone.
On the same page, Export downloads a copy of everything as one file.
We also delete on our own: a chat with no account and no purchase after 6 months; uploaded files 12 months after you last use your account; an account with no activity for 3 years, with everything in it.
We do not file anything for you. Nothing reaches the embassy or the BVA unless you send it.
What we store
Name, email, the family chain you type, the files you upload, the chat conversation, your messages to support, and the payment state. Your card is processed by Stripe and never touches our servers.
What it is for
Preparing the letter, the list, and the package for your route. Sending your sign-in link, your receipt, and, if you leave an application half done, a reminder. Replying when you write to support.
We read chat conversations to find questions the chat answers badly. The notes we keep from that are paraphrased and never contain names, email addresses, or street addresses.
Who else handles your data
Supabase stores the database and files, encrypted at rest with AES-256. Stripe takes the payment. Anthropic runs the chat and the document check, and does not train its models on this data. Hetzner hosts the site. Twilio SendGrid sends the emails. Google Analytics and Microsoft Clarity load only if you accept analytics cookies, and never receive your answers or your documents.
The Meta Pixel loads only if you turn on advertising cookies. It lets us show our ads on Facebook and Instagram to people who visited and count how many came back. Meta receives the page you viewed and a few generic steps: that you started the check, opened a chat, created an account, began checkout, or paid, with the amount. It never receives your name, your email, your answers, your ancestry, or your documents, nor pages whose address holds personal details. You can change your choice at any time with Cookie settings at the bottom of every page; turning a kind off deletes its cookies. Meta's own use of this data is covered by its privacy policy (facebook.com/privacy/policy).
Your data is stored in the United States (the database, in Ohio) and in Europe (the website, on Hetzner servers).
How long we keep it
A job runs every day and deletes anything past these limits. You do not have to ask.
Chat with no account and no purchase: 6 months after the last message. Uploaded files: 12 months after you last use your account, meaning your last sign-in or your last change to the application. Account and application: 3 years after your last activity. Checkout error reports: 90 days.
Stripe keeps the record of each charge (name, email, amount, date, and card brand) for 7 years, because tax law requires it. It never contains your documents or your family history.
Deleted data can stay in encrypted backups for up to 30 days, until those backups expire. Nobody restores from them to recover deleted accounts.
Legal basis and transfers
Supabase, Anthropic, Stripe, Hetzner, and Twilio SendGrid are bound by data processing agreements that are part of their terms. Each one includes the European Commission's standard contractual clauses (Decision 2021/914) for transfers to the United States. If you turn on advertising cookies, Meta is responsible for the limited data it receives under Meta's terms.
We use your application, files, and payment state to provide the service you asked for. Stripe keeps the charge record because tax law requires it. We send a reminder about an unfinished application, keep the site secure, and read chats to improve the answers because we have a legitimate interest in doing so, and you can object at any time. Analytics and advertising cookies run only with your consent, which you can withdraw.
The family chain includes details about your parents and grandparents. Enter only what the application needs. Israel's Protection of Privacy Law applies to your data, and you can complain to the Privacy Protection Authority: https://www.gov.il/en/departments/the_privacy_protection_authority
Your rights
Deleting everything, removing one file on the documents page, and downloading a copy need no email: they are buttons in your account. The same account works on MaplePass, Linha Reta and Línea Recta, and it is deleted there too. If any step fails, nothing is half-deleted: you see an error and can try again.
To correct something, change it in your application or write to us. To stop emails, use the unsubscribe link in any email. We keep that address on a do-not-email list so we never write to it again.
If you only used the chat and want it deleted now, email us from the address you gave in the chat. We delete it within 7 days.
Security
The whole site uses HTTPS. Files sit in private storage with no public links, and the server checks that you own the account before it hands over a file. Database rules stop one account from reading another account's application. Only the people who run Kav Yashar can open the database, and only to answer your support request or fix a fault.
No system is perfectly secure. If we ever find that someone got into your data, we will email you without delay and say what was exposed.