KINOS Privacy Notice

Version 1.0 · Effective [DATE OF PUBLICATION]

This notice explains how KINOS collects and uses personal information when you use our website (kinos.my), the KINOS app, and when you contact us. It is available in English and Bahasa Malaysia.

1. Who we are

KINOS is operated by KINOS SDN. BHD. (Company No. [SSM NO.]), [REGISTERED ADDRESS], Malaysia ("KINOS", "we", "us"). We are the data user (data controller) for the information described here.

For any privacy question or request, email [email protected]. Our privacy matters are handled by our director, [NAME].

2. The short version

• Your family book is private. Only you and the family members you invite can see it. KINOS staff look at it only to help you when you ask, to act on a safety report, or when the law requires.
• We do not sell your personal information, and we do not share it with advertisers.
• We use AI for two things only: to sort the photos in your book (including face grouping, if you switch it on) and to suggest places and activities that suit your child. Your photos, videos and notes are not used to train large AI models.
• Pregnancy details, ultrasound images, health records and face data are sensitive. We only process them after you give explicit consent in the app, and you can withdraw it.
• You can export everything, free, at any time, and you can delete your account in the app.

3. What we collect

Account details. Your name, email address, password (stored in scrambled form, never in plain text), language and sign-in records.

Your family book. What you and your family add: your child's name, date of birth (or due date, see below), gender if you choose to add it, photos, videos, notes, milestones, dates and captions, and who added each item.

Sensitive information (only with your explicit consent):

• pregnancy details, such as your due date and pregnancy weeks;
• ultrasound images, whether you upload them or your clinic sends them to your book at your request;
• health records you choose to keep, such as vaccinations and appointments;
• the "We've had a loss" setting, if you turn it on;
• which clinic introduced you, if you joined through a clinic, because this can show a pregnancy;
• face data, if you switch on face grouping (see "How we use AI" in section 4).

Family members you invite. When someone accepts your invitation, we record their account and their role in your book.

Purchases and bookings.

• Subscriptions bought in the app are handled by Apple or Google. We receive your subscription status, not your card details.
• Payments on our website, for subscriptions and bookings, are handled by Billplz. We receive the payment status and a reference, not your full card or bank details. If a refund has to be paid by bank transfer, we ask for your bank account details and use them only for that refund.
• For class and activity bookings: what you booked, the date, the number of people attending, and your child's age where the class needs it.

Device and usage information. Device model, operating system, app version, crash reports, a notification token so we can send you notifications, basic app usage events, and IP addresses in our server logs. We count how the app is used, such as how often a feature is opened, not what you keep in your book.

When you contact us. What you send us by email or WhatsApp.

Our website does not use cookies, analytics or tracking tools, and it has no forms. Anything interactive on it works entirely in your browser; nothing you type is sent to us. Our website host, Cloudflare, keeps server logs, including IP addresses, for security.

Where we get it from. From you; from family members you invite, about what they add; from your clinic, if you connect one; from Apple, Google and RevenueCat, about your subscription status; and from Billplz, about your payments.

What is required and what is optional. An email address and password are required to create an account, and a name and a date for your child are required to start a book (a nickname is fine). If the date is a due date, we ask for your explicit consent first. Everything else is optional. If you don't give it, some features won't work.

4. Why we use it

• To provide the app: store your memories, build your book, share it with the family members you choose, and keep backups.
• To sort your photos, and to suggest places and activities that suit your child (see "How we use AI" below).
• To add clinic uploads to your book when you ask your clinic to send them, and to run our partnerships with clinics.
• To process subscriptions, payments and bookings, including sending a merchant the details they need for your booking.
• To send service messages, such as sign-in codes, receipts, booking confirmations and important changes.
• To answer your questions and requests.
• To keep KINOS safe: prevent fraud and abuse, and fix errors.
• To improve KINOS using usage and crash information.
• To send marketing messages, only if you agreed. You can stop them at any time. If you turn on the "We've had a loss" setting, we stop all marketing to your family.
• To meet our legal obligations, such as tax and accounting records.

We may produce statistics that cannot identify you or your family. We will ask for your separate consent before we share any such statistics outside KINOS.

How we use AI

Sorting your photos. Automated tools sort the photos and videos in your book, for example by date, by milestone or by who is in them, so your book is easier to build and browse.

Face grouping, only if you switch it on. Face grouping finds the same person across the photos in your book, so you can see, for example, every photo of your child. To do this, it creates face data from the faces in your photos. Face data is biometric data, and we treat it as sensitive personal data.

• We only create face data after you give explicit consent in the app. It is off until you switch it on.
• Face data is used only to sort photos inside your own family's book. We do not use it to identify anyone outside your book, and we do not share or sell it.
• Your photos may show other people, such as relatives and friends. Face grouping sorts their faces too, but only inside your book, and their face data is never used outside it.
• You can switch face grouping off at any time. When you do, we delete the face data within [30] days. Your photos stay.

Suggestions for places and activities. We use [your child's age or pregnancy stage, the area you tell us you live in, and what you save or book in KINOS] to suggest places to go, and classes and activities that suit your child.

Training. Your photos, videos, notes and face data are not used to train large AI models, such as the general-purpose models behind chatbots. We do not use them to build or improve AI for anyone else, and we choose service providers that are not allowed to do so.

5. Consent

By creating an account, you consent to us processing your personal information as described in this notice. For sensitive information (section 3), we ask for your explicit consent in the app before you first use those features.

You can withdraw consent at any time, in the app or by emailing [email protected]. If you withdraw consent for sensitive information, we will stop processing it and those features will stop working for you. Before anything is deleted, the app shows you what will be deleted and lets you export it first.

6. Who we share it with

• Family members you invite, according to the role you give them.
• Clinics, only if you connect one. A clinic can send ultrasound images into your book. A clinic cannot see your book.
• Merchants (class and activity providers), only the details needed for your booking, such as the name on the booking, number of attendees and your child's age where needed. Merchants never see your book or your photos.
• Service providers who work for us and only on our instructions:
  • Amazon Web Services (app servers and database, in Malaysia);
  • Cloudflare (photo and video storage) and Backblaze (a second backup copy);
  • Google (Firebase for notifications, crash reports and app analytics; Google Workspace for our email);
  • [AI provider for photo sorting, if one is used];
  • Sentry (error reports), Resend (service emails), RevenueCat (subscription status), Cloudflare (website hosting);
  • Billplz (website payments) and Meta (if you message us on WhatsApp).
• Apple and Google, when you buy through their stores. Their own privacy policies apply.
• Professional advisers and authorities, when required by law or to protect our rights, our users or the public.
• A buyer or successor, if KINOS's business is sold or merged. We will tell you first, and this notice will continue to protect your information.

7. Transfers outside Malaysia

Our app servers and database are in Malaysia. Some service providers store or process information outside Malaysia, including in the United States, Europe and Singapore. This includes where your photos and videos are stored. When we transfer personal information outside Malaysia, we do so as allowed under section 129 of the Personal Data Protection Act 2010, including by choosing providers with adequate protection and binding them by contract.

8. How we protect it

• Information is encrypted when it travels between your device and us.
• It is stored with providers that encrypt it at rest.
• Only people who need access have it.
• Originals are kept with two separate providers, so a problem at one provider is much less likely to lose your memories. If a paid plan ends, content over the Free limit is kept with two providers for 12 more months, and then with one provider until you renew.

No system is perfectly secure. If a personal data breach happens, we will notify the Personal Data Protection Commissioner and, where required, the families affected, within the time the law requires.

9. How long we keep it

• While your account is open, we keep your book, including after a paid plan ends. KINOS is built to keep memories for many years.
• Face data is deleted within [30] days after you switch face grouping off or delete your account.
• Items you delete go to Trash and are permanently deleted after [30] days, or straight away if you choose "Delete for good".
• When you delete your account, we delete your account and content from our live systems within [30] days, and from backups within a further [35] days.
• Records we must keep by law, such as payment and tax records, are kept for 7 years.
• Records of your consents are kept after your account is deleted, so that we can show what you agreed to. They do not include your photos or notes.

10. Your rights

You can:

• access the personal information we hold about you;
• correct it if it is wrong;
• withdraw consent;
• stop marketing messages;
• take your data with you: export your whole book, free, at any time, in the app, or ask us to send your data to another organisation where this is technically possible;
• delete your account, in the app or through our support page (kinos.my/support).

To make a request, use the app or email [email protected] from the email address on your account. We may need to confirm your identity. We will reply within 21 days, and we do not charge a fee.

If you are not satisfied with our reply, you can complain to the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi, pdp.gov.my).

11. Children

KINOS accounts are for adults aged 18 or over. Children do not use KINOS accounts. The information in a family book about a child is added by their parents or guardians, the family members they invite and, if they connect one, their clinic. Parents or guardians give consent on the child's behalf, decide what is kept and can delete it at any time.

KINOS is designed so that, one day, a child can receive their own book. Before we offer this, we will explain how it works and ask the parents who hold the account for their consent.

12. Changes to this notice

If we change this notice in a way that matters, we will tell you in the app or by email before the change takes effect. The version number and date are at the top.

13. Language

This notice is available in English and Bahasa Malaysia. If the two versions differ, the English version applies.

14. Contact

KINOS SDN. BHD. (Company No. [SSM NO.])
[REGISTERED ADDRESS]
Email: [email protected]