Privacy Policy

Progtic Consultant Inc. ("Progtic", "we"), the company that publishes Kumaa (kumaa.app), acts as the data controller for the personal data described below: we decide what data is collected, why, and how it is protected.

Data we collect

• Account: display name, email address, sign-in credential (encrypted password or Google sign-in), avatar.
• Voice content: your recordings, their transcription, and the generated analyses (scores, detected tics, exercises).
• Progress: goals, reminders, streaks, badges, session history.
• Technical: IP address, device and browser type, usage and diagnostic data, push notification tokens.
• Anti-fraud: a random, locally generated device identifier (`signup_device_id`) and clicks on referral or influencer links, used to detect reward abuse.
• Support: messages you send us.

Payment data (card, billing address) is collected and processed directly by Paddle, our Merchant of Record. We never have access to your card number.

Why, and on what legal basis

• Creating and managing your account, providing analyses, history, and reminders — performance of a contract.
• Processing subscriptions, billing, and tax compliance via Paddle — performance of a contract and legal obligation.
• Security, fraud and abuse prevention, product improvement (aggregated statistics) — legitimate interest.
• Push notifications and optional marketing communications — consent, which you can withdraw at any time.
• Keeping accounting records — legal obligation.

Your recordings and transcripts are never sold, nor used to train AI models.

Who we share data with

• Technical providers (processors): hosting and database, AI model providers for transcription and analysis, notification delivery service, diagnostic tools.
• Paddle.com, Merchant of Record, for sales, subscription management, payments, billing, and tax compliance.
• Professional advisors: legal and accounting, when necessary.
• Authorities: when required by law.

International transfers

Our providers may process data in Canada, the United States, and the European Union. When data leaves Canada or the EEA, such transfers are governed by standard contractual clauses or adequacy decisions.

Retention

We retain your data for as long as your account is active. Deleting your account from Settings → Privacy is immediate and permanent: profile, recordings, transcripts, analyses, goals, reminders, badges, XP, quests, challenges, projects, referrals, and your sign-in identity are erased; anti-fraud traces are anonymized. Billing records are retained by Paddle for the legally required period (up to 7 years).

Your rights

Depending on your jurisdiction (Quebec/Canada, GDPR within the EU/EEA, and the UK), you may request: access to your data, its rectification, its erasure, restriction of its processing, its portability, objection to certain processing, and withdrawal of your consent. Export and deletion are available directly from Settings, or by email at info@progtic.com — we respond within one month. You may also file a complaint with your supervisory authority (Quebec's Commission d'accès à l'information, or your own country's authority).

Security

We implement appropriate technical and organizational measures: encryption in transit and at rest, per-user access control at the database level, authentication, and internal access limited to what is strictly necessary.

Cookies

Kumaa uses two categories of trackers. Essential cookies and storage (keeping you signed in, language preference, offline functionality) are required for the service and set without consent. Analytics and attribution trackers are only set after your explicit consent.

• PostHog (usage analytics, EU hosting): usage events, IP address, pseudonymous visitor ID, `ph_` cookies — consent*.
• Landing page attribution: `kumaa_landing_variant`, `kumaa_landing_source` (up to 180 days) to know which page version brought you here — consent.
• Referral code: `kumaa_ref` (up to 30 days) to credit whoever invited you — consent; without consent the code is kept for the current session only.

We use no advertising cookies and never sell data. You are asked on your first visit and can change your choice at any time in Settings → Privacy → Cookies and trackers, including withdrawing consent — trackers already set are then deleted.

Aggregated audience measurement (cookie-free)

Separately from the trackers above, we count visits to our public pages directly on our server, with no cookies and no trackers, in order to measure how our campaigns perform (for example: how many people actually opened the page after an ad click). We record: the page viewed, the country code, campaign parameters present in the URL (`utm_*`), the referring site's domain, the page version served, plus a device indicator (mobile or desktop) and an in-app browser indicator (social apps).

What we do not keep: no IP address, no full user agent, no cookies, no identifier reusable from one day to the next. To roughly distinguish visitors within a single day we compute a non-reversible, truncated technical fingerprint that is renewed daily and cannot re-identify you or track you beyond that day. Legal basis: legitimate interest (aggregated audience measurement, no profiling).

Contact us

Progtic Consultant Inc. — info@progtic.com

This English version is provided for convenience. In the event of any discrepancy or ambiguity between this English version and the original French version, the French version shall prevail.