← Kumo

Privacy Policy

Effective date: 1 July 2026  ·  Last updated: 1 July 2026

Kumo ("we", "us", or "our") is committed to protecting your personal data. This Privacy Policy explains what information we collect, how we use it, and your rights under the General Data Protection Regulation (GDPR) and applicable privacy laws.

1. Data Controller

Kumo is the data controller for personal data collected through the Kumo mobile application. For enquiries about this policy or your data rights, contact us at privacy@kumo.travel.

2. Data We Collect

Account data

• Email address — required to create and identify your account.
• Display name — optional, used to identify you to collaborators.

Trip and travel data

• Itineraries, schedule items, packing lists, trip notes, and expense records you create or that are shared with you.
• Ratings and comments you post on activities or destinations.
• Chat messages sent within trip groups.

Usage data

We do not run third-party analytics or advertising SDKs. Standard server logs (IP address, request timestamps) are retained by our infrastructure provider (Supabase) for up to 30 days for security purposes.

Launch waitlist (marketing website)

If you sign up for launch updates on our marketing website (kumo.travel), we store only the email address you provide, based on your consent, solely to send a one-time email when Kumo launches. We keep it until you unsubscribe (a link is included with that email, and available anytime on the website) or the launch email has been sent, whichever comes first. This address is never sold, shared with third parties, or used for anything other than that one message.

3. Legal Basis for Processing (GDPR)

• Contract performance (Art. 6(1)(b)) — providing the app features you signed up for.
• Legitimate interests (Art. 6(1)(f)) — preventing fraud, securing the service.
• Consent (Art. 6(1)(a)) — where we ask for it explicitly (e.g. the launch-announcement waitlist on our marketing website).

4. How We Use Your Data

• Authenticate your identity and maintain your session.
• Enable real-time collaboration on shared trips.
• Generate AI itinerary suggestions on your request (data is sent to Anthropic's API; see Section 5).
• Display your name and avatar to trip collaborators you invite.
• Respond to support requests.

5. Data Sharing & Sub-processors

We do not sell your data. We share data only with the following sub-processors to operate the service:

• Supabase, Inc. (USA) — database, authentication, real-time messaging, and file storage. Data is stored on servers in the EU (Frankfurt) region.
• Anthropic, PBC (USA) — AI itinerary generation. Destination and travel-preference data is transmitted when you use the Katha AI feature. Anthropic's data use is governed by their API terms.
• Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service) — delivering push notifications to your device. Every notification includes the sender's name and the trip title; the text of the message is included only if you turn on "Show message preview" in your Notifications settings (off by default).
• Apple / Google — app distribution and in-app purchase infrastructure (if applicable).

6. International Transfers

Kumo operates globally, so your data may be accessed or processed from a country other than your own. Supabase stores your data in the EU (Frankfurt). Anthropic's servers are in the United States. Transfers out of the EU/UK rely on Standard Contractual Clauses (SCCs) adopted by the European Commission; transfers from other jurisdictions (including India, Brazil, Japan, and Canada) rely on your consent to this Privacy Policy, together with SCCs or an equivalent contractual safeguard with each sub-processor, and the same EU-hosted infrastructure — we do not maintain a separate copy of your data in any other country.

7. Data Retention

Your data is retained for as long as your account is active. When you delete your account, all personal data — including itineraries, expenses, packing lists, messages, and ratings — is permanently deleted within 30 days. Aggregated, anonymised statistics may be retained indefinitely. If you forward a trip-related email (e.g. a flight confirmation) to your trip's Kumo email alias, we keep a metadata-only record (sender address, subject line, forward count — never the message body) for up to 90 days to support delivery troubleshooting, then delete it automatically.

8. Your Rights, by Region

Kumo operates globally. Regardless of where you live, you can always access, correct, or remove your own data via Profile → Privacy, or by contacting privacy@kumo.travel. The rights below reflect the specific laws that apply depending on your location; contact us if you are unsure which applies to you.

European Economic Area & United Kingdom (GDPR / UK GDPR)

• Access & Portability — download a machine-readable (JSON) copy of your profile, trips, expenses, packing lists, ratings, sent messages, and published posts via Profile → Privacy → Download my data.
• Rectification — correct inaccurate data via Profile → Edit Profile.
• Erasure ("right to be forgotten") — delete your account via Profile → Privacy → Delete Account.
• Restriction — request we limit processing in certain circumstances.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, you may withdraw at any time.

You also have the right to lodge a complaint with your national data protection authority.

United States (CCPA/CPRA, VCDPA, CPA, and similar state laws)

• Right to know/access, correct, and delete your personal data.
• Right to opt out of the sale or sharing of personal data, and of targeted advertising — not applicable here: we do not sell or share your personal data, and we do not use it for targeted advertising, so there is nothing to opt out of.
• Right to non-discrimination for exercising these rights, and the right to appeal a denied request.

We honor the Global Privacy Control (GPC) signal, where legally required, as a valid request to opt out of sale/sharing. Since we do not sell or share personal data in the first place, GPC has no practical effect on how your data is processed today, but we detect it and this applies automatically if that ever changes.

India (Digital Personal Data Protection Act, 2023)

• Right to a summary of your personal data and how it is processed.
• Right to correction, completion, updating, and erasure of your personal data.
• Right to withdraw consent at any time, as easily as it was given.
• Right to grievance redressal, and to nominate another individual to exercise your rights in the event of your death or incapacity.

Grievance Officer: Privacy Team, privacy@kumo.travel.

Brazil (Lei Geral de Proteção de Dados — LGPD)

• Confirmation that we process your data, and access to it.
• Correction of incomplete, inaccurate, or outdated data.
• Anonymization, blocking, or deletion of unnecessary or excessive data, or data processed without your consent.
• Portability to another provider; deletion of data you consented to share; information about who we share data with.
• Revocation of consent, and information about the consequences of not consenting.

Encarregado (Data Protection Officer): Privacy Team, privacy@kumo.travel.

Japan (Act on the Protection of Personal Information — APPI)

• Right to request disclosure, correction, addition, deletion, or cessation of use of your retained personal data.
• Cross-border transfers of your data (see Section 6) rely on your consent to this Privacy Policy together with contractual safeguards equivalent to Japan's requirements.

Contact privacy@kumo.travel to exercise these rights.

Canada (PIPEDA, and provincial laws including Quebec's Law 25)

• Right to access and correct your personal information.
• Right to withdraw consent at any time.
• Right to file a complaint with the Office of the Privacy Commissioner of Canada, or the applicable provincial authority.

Privacy Officer: Privacy Team, privacy@kumo.travel.

To exercise any right listed above, contact privacy@kumo.travel. We will verify your identity before acting on a request and respond within the timeframe required by the applicable law (typically 30–45 days).

9. Discoverability & Visibility

Your display name is visible to other users only within trips you are a member of. You can disable discoverability in Profile → Privacy Settings so your name does not appear in invite searches. Public itineraries you choose to share are visible to all users in the Discover feed.

10. Security

We use HTTPS for all data in transit. Authentication tokens are stored in the platform secure keychain (iOS Keychain / Android Keystore). Row-Level Security (RLS) policies on our database ensure users can only access data they own or have been invited to.

11. Children

Kumo requires every account holder to be 18 or older, enforced at signup and re-checked on every write to our database — not just requested. We do not knowingly collect personal data from anyone under 18. If you believe a minor has an account, contact privacy@kumo.travel.

12. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via an in-app notice or email before the change takes effect. Continued use after the effective date constitutes acceptance.

13. Contact

Kumo Privacy
privacy@kumo.travel