Privacy Policy
Last updated: [DATE] · Draft v0.1
1. Controller
Kemuva, operated by [Seller legal entity], 1309 Coffeen Avenue STE 1200, Sheridan, WY 82801, USA, [email protected].
EU representative (GDPR art. 27): [TBD — to be appointed/confirmed before EU launch.] UK representative: [TBD].
2. What we collect
- Order data: name, email, product, amount (payment card data is handled only by Stripe).
- Material you upload: photos, voice recordings, documents and notes, which may include images, voices and personal stories of you and your family members, including children and deceased relatives.
- Communications with us.
3. Why and on what legal basis
- To make and deliver your order — performance of contract (GDPR art. 6(1)(b)).
- Legal/accounting records — legal obligation (art. 6(1)(c)).
- Fraud prevention and service security — legitimate interests (art. 6(1)(f)).
Concerning third parties in your material, you confirm you have their permission (or a parent's/guardian's) to share it. We do not use your material to train AI models, and we do not sell personal data.
4. Retention
- Uploaded material and working files: deleted 30 days after final delivery (or earlier on request).
- Voice wave audio: stored separately and kept hosted for as long as the QR code is offered, minimum 5 years, so the QR code keeps working (performance of contract). You can request deletion at any time; deletion disables the QR code.
- Final delivered file: download link available for 30 days, then deleted from our storage.
- Order and invoice records: kept as required by tax law (typically up to 7 years).
5. Processors
- Stripe (payments)
- Resend (transactional email)
- Cloudflare (website hosting and file storage)
- AI generation and transcription providers (e.g. OpenAI, Higgsfield) — used only to create your order, under their API terms that do not use submitted data for training where offered.
Some processors are in the United States; transfers rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses.
6. Your rights
EU/UK: access, rectification, erasure, restriction, portability, objection and complaint to your supervisory authority. California (CCPA/CPRA) and other US states: right to know, delete and correct; we do not sell or share personal information for cross-context behavioral advertising. Email [email protected] to exercise rights.
7. Children
Our services are for adults. Material about children is provided by their parent or guardian, who consents on their behalf.
8. Security
Files are stored in private, encrypted storage with time-limited access links.
Contact
Kemuva, operated by [Seller legal entity], 1309 Coffeen Avenue STE 1200, Sheridan, WY 82801, USA · [email protected]