1. Who we are
KumoTools ("we", "us") runs KumoTools and KumoMoments (together, the "Service"). This policy explains what personal data we collect when you use the Service, why we collect it, how long we keep it, and who processes it on our behalf.
2. What we collect
- Account data — email address, and any display name or avatar linked through Google sign-in.
- Source media you submit — Twitch VOD links and any audio or video we download and prepare on your behalf.
- Derived data — transcripts, clip suggestions, AI-generated titles/descriptions/hashtags, and Twitch timestamp exports produced from your source media.
- Preferences — email notification opt-in, theme, and notification email address if different from your account email.
- Payment metadata — transaction IDs, amounts, and status. Card details are collected and stored directly by Stripe. We never see or store your full card number.
- Operational data — server logs, error reports, and basic analytics (page views, feature usage) needed to run the Service and diagnose problems.
3. How we use it
- To provide, operate, and improve the Service.
- To process the analyses you request — download, transcribe, and generate clip / title / description / hashtag suggestions.
- To send transactional emails (e.g. "your analysis is ready").
- To take payment and prevent fraud.
- To respond to feedback and support requests.
- To meet legal obligations.
We do not sell your personal data, and we do not use Your Content to train third-party AI models.
4. Retention
- Projects, transcripts, and prepared audio — kept until you delete them or your account, subject to a per-user storage cap displayed in the app.
- Account data — kept while your account is active. When you delete your account we delete or anonymise associated data within 30 days, unless we must keep it longer to comply with law (e.g. tax records).
- Payment records — kept as required by tax and accounting rules, typically 7 years.
- Logs — rotated within 90 days.
- Promotional-abuse ledger — a one-way SHA-256 hash of your email address, together with a count of how many subsidised (introductory-free) VODs have been consumed under it. Retained indefinitely, including after account deletion, for the sole purpose of preventing repeated use of the introductory free-VOD allowance. The raw email address is never stored in this ledger and the hash cannot be reversed into your email. Legal basis: our legitimate interest in preventing promotional fraud (GDPR Art. 6(1)(f)). You can request removal by contacting us; we may then decline to grant introductory free VODs to that email in the future.
5. Sub-processors
We rely on the following third-party providers to run the Service. Each one only receives the data it needs to do its job:
- Supabase (database, authentication, storage) — hosts your account, projects, transcripts, and prepared audio.
- Fly.io (media worker) — downloads and processes VOD audio for analysis.
- Deepgram (speech-to-text) — receives audio via a signed URL to produce transcripts.
- Lovable AI Gateway (large language models) — receives transcript text to generate clip suggestions, titles, descriptions, and hashtags.
- Stripe (payments) — processes your payment and stores your card details under its own privacy policy.
- Cloudflare (hosting / edge network) — serves the app and processes basic request metadata.
- Email delivery provider — sends transactional emails from
notify.kumotools.com.
6. Cookies and local storage
We use a small number of strictly-necessary cookies and browser local-storage entries — for authentication (your Supabase session), theme preference, and language. We do not use third-party advertising or cross-site tracking cookies.
7. Your rights
Depending on where you live you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can:
- Delete individual projects from inside the app.
- Unsubscribe from transactional emails via the link in any email or from your account preferences.
- Request account deletion or a data export via the feedback button.
8. International transfers
Our sub-processors may store or process data in the United States and other countries. Where required, transfers are covered by standard contractual clauses or equivalent safeguards offered by each provider.
9. Security
We use HTTPS everywhere, row-level security in the database, scoped storage buckets, and signed URLs for media access. No online service can be 100% secure — please report anything suspicious via the feedback button.
10. Children
The Service is not directed at children under 13 (or the minimum digital-consent age in your country). We do not knowingly collect data from them.
11. Changes
We will update this policy as the Service evolves. Material changes will be announced in the app or by email; the "Last updated" date at the top always reflects the current version.
12. Your rights (access, export, deletion)
You can download a JSON copy of your data or permanently delete your account and all associated projects, transcripts, clips, and preferences from your Account page. Deletion is immediate and cannot be undone. For any other privacy request, email kumasubs2020@gmail.com.
13. Contact
Questions about this policy or your data? Email kumasubs2020@gmail.com or use the feedback button in the app.