Privacy policy

1. Controller and privacy contact

For privacy questions, rights requests or objections, use privacy@kinavela.com. This is the privacy contact. No formal Data Protection Officer has been appointed; this address must not be understood as a DPO contact.

2. Data we process

Kinavela processes account and authentication data; family and discovery data; guardian-managed child data; messages, stories, recordings, transcripts, reports and moderation data; and the minimum consent, notification, push, metrics and technical security data needed to operate the features. After separate marketing consent, only public-landing PageView and confirmed-signup CompleteRegistration events are sent to Meta, without Kinavela profile or content parameters. Cultural, heritage and language information is voluntary and may reveal sensitive identity aspects. Do not enter information about another person unless authorised.

3. Purposes and legal bases

Requested account, family, Roots, messaging and community features are processed under Art. 6(1)(b) GDPR. Security, abuse prevention, moderation, incidents and integrity use legitimate interests under Art. 6(1)(f) GDPR and legal obligations where applicable under Art. 6(1)(c). Optional product email and metrics require consent. Meta Pixel advertising measurement and campaign optimisation require separate explicit consent under Art. 6(1)(a) GDPR and can be withdrawn on the Cookies page; statutory accounting and tax records use Art. 6(1)(c).

4. Children and guardians

Kinavela is adult-led. A parent or authorised guardian enters and manages child information. Child profiles are private by default. Do not publish a child’s exact address, direct contact details, exact birth date, school details or sensitive media. A guardian may request correction, export or deletion through account controls or privacy@kinavela.com.

5. Recipients and processors

Production uses Supabase for authentication, PostgreSQL, private Storage and Realtime; Zoho Europe SMTP for account and opted-in notification email; Nominatim / OpenStreetMap for explicit city or postcode searches; Stripe for hosted Roots Family billing; and Sentry in its Germany region for technical error and performance monitoring. Sentry receives minimized error and stack-trace data, route patterns, runtime, browser or device information and sampled performance data; a technical IP address may be processed in network transit. Default personal data, Session Replay, forms, request bodies, messages, stories, transcripts and child data are disabled or filtered before sending. OpenAI, other third-party analytics, CAPTCHA and Web Push delivery are not enabled in production. The Meta Pixel is enabled only after marketing consent.

After marketing consent, Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland receives Meta Pixel events. Kinavela sends only PageView on public landing pages and CompleteRegistration after confirmed registration, with no names, emails, phone numbers or Kinavela child, family, community, location, culture, language or content values passed as parameters. Meta necessarily processes event, browser/device, referrer, cookie-identifier and network data; an IP address may be processed in transit.

6. International transfers

Transfers may occur when a processor or infrastructure is outside the EEA. We use safeguards required by applicable law, including an adequacy decision, standard contractual clauses or another permitted mechanism where required.

7. Retention and deletion

Data is retained no longer than needed for its purpose. Account deletion removes private media first, deletes child and story content where technically possible, anonymises authored messages and leaves only a minimal safety/integrity tombstone where immediate physical deletion is prevented.

8. Your rights

Subject to legal conditions, you may request access, correction, deletion, restriction, portability or object to processing. You may withdraw consent at any time. Use Settings where available or contact privacy@kinavela.com. You may also complain to the competent supervisory authority.

9. Supervisory authority

The authority for the controller’s seat is Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (LfDI Rheinland-Pfalz), Postfach 30 40, 55020 Mainz; visitor address Hintere Bleiche 34, 55116 Mainz; telephone +49 (0) 6131 8920-0; email poststelle@datenschutz.rlp.de; datenschutz.rlp.de.