Privacy Policy

1. Who is responsible for your data

Kambio is responsible for personal data processed through the service.

If you have privacy questions or want to exercise your rights, contact Kambio through the support channel made available in the service or by replying to an official Kambio email.

2. Personal data we collect

Kambio collects and processes the following categories of personal data:

• Account data, such as your name, email address, authentication provider identifier, profile photo and account settings.
• Profile and matching data, such as native language, learning language, interests, bio, likes, matches and onboarding choices.
• Scheduling and session data, such as planned session times, selected topics, Daily.co room references, attendance information and private notes you save.
• Communication data, such as emails sent for account, match, scheduling, billing or support purposes.
• Payment and subscription data, such as subscription status, trial information and Stripe customer or checkout identifiers. Kambio does not store full card numbers.
• Technical data, such as device, browser, IP address, cookies, logs, security events and approximate usage information.

3. How we use personal data

Kambio uses personal data to:

• Create and secure accounts, including Google sign-in through Supabase Auth.
• Show relevant partner profiles and enable likes, matches, scheduling and video sessions.
• Provide guided conversations, topic prompts, vocabulary and session history.
• Process subscriptions, free trials and billing through Stripe.
• Send necessary service emails, such as match, scheduling, account and billing notifications.
• Maintain service reliability, prevent abuse, troubleshoot errors and comply with legal obligations.
• Improve the product, including measuring aggregate feature usage and understanding where users encounter problems.

4. Legal bases for processing

Where the GDPR or similar laws apply, Kambio relies on the following legal bases: contract performance to provide the service you request; legitimate interests to secure, maintain and improve the service; consent where required for optional processing; and legal obligation where Kambio must keep records or respond to lawful requests.

5. Cookies and similar technologies

Kambio uses cookies and similar technologies for essential functions such as authentication, language preference and session security. Optional analytics or marketing cookies should only be used where configured with the required consent controls.

6. Sharing with service providers

Kambio shares personal data with trusted providers only as needed to operate the service. These providers may include Supabase for authentication, database, storage and realtime features; Daily.co for video rooms; Stripe for payments; and Resend for email delivery.

Service providers are expected to process personal data under appropriate contractual, confidentiality and security obligations.

7. International transfers

Some providers may process data in countries other than your own. Where required, Kambio relies on appropriate safeguards, such as standard contractual clauses or equivalent transfer mechanisms, to protect personal data transferred internationally.

8. Retention

Kambio keeps personal data only for as long as needed for the purposes described in this policy, including providing your account, maintaining records, resolving disputes, enforcing terms and complying with legal obligations.

When you delete your account, Kambio will delete or anonymise personal data that is no longer needed, unless retention is required for security, fraud prevention, accounting, legal compliance or legitimate dispute purposes.

9. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing of your personal data, request portability, withdraw consent and lodge a complaint with a data protection authority.

You can update much of your profile data in account settings. For other requests, contact Kambio through the available support channel. Kambio may need to verify your identity before completing a request.

10. Security

Kambio uses technical and organisational measures designed to protect personal data, including access controls, hosted infrastructure security, row-level security in the database and secure third-party providers.

No online service can guarantee absolute security. You should use a secure sign-in method and report suspected unauthorised access promptly.

11. Children

Kambio is not intended for children under 16 or under the minimum digital consent age in their country. Kambio does not knowingly collect personal data from children below the applicable age.

12. Changes to this policy

Kambio may update this Privacy Policy as the service, providers or legal requirements change. Material changes will be communicated through the service or by email where appropriate.