Privacy Policy
Last updated: April 12, 2026
This Privacy Policy explains what Kumo ("we", "us") collects when you use store.kumos.dev, how we use it, who we share it with, and your rights over it. We keep data to a minimum and don't sell it.
1. Data We Collect
You give us
- Account + purchase data: email, name, order history, product access. Stripe holds your payment details; we never see or store your card number.
- Newsletter opt-in: if you subscribe, we store your email and subscribe date.
- Service inquiry data: if you fill out a services form, we collect the fields you enter (name, email, company, budget, timeline, message).
- Support email: anything you send us at kumo@makais.app.
We collect automatically
- Basic analytics: privacy-respecting metrics about pages visited and referrers. Aggregate only. No cross-site tracking, no ad profiles.
- Essential cookies: session cookies needed for sign-in and checkout. Details: Cookie Notice.
2. How We Use It
- To deliver the product or service you bought
- To authenticate your account and protect it
- To send transactional email (receipts, magic links, delivery)
- To send marketing email only if you opted in — unsubscribe any time
- To reply to support requests
- To keep the service working and improve it
- To comply with law and enforce our Terms
3. Who We Share It With
We use these vendors ("subprocessors"). Each has its own privacy terms; clicking through takes you to theirs.
- Stripe — payments. Stripe Privacy
- Supabase — database, auth, file storage. Supabase Privacy
- Vercel — hosting and CDN. Vercel Privacy
- Resend — transactional email. Resend Privacy
- Mailchimp — newsletter (opt-in only). Mailchimp / Intuit Privacy
- Gumroad — secondary checkout for certain legacy products. Gumroad Privacy
We do not sell personal information and do not share it with advertisers.
4. Retention
We keep account and order records while your account is active and for up to 7 years after, to meet tax and legal obligations. You can ask us to delete earlier — see §5.
5. Your Rights
Depending on where you live (including under the EU/UK GDPR and the California Consumer Privacy Act / CPRA), you may have the right to:
- Access the data we hold about you
- Correct inaccurate data
- Delete your data (subject to legal retention requirements)
- Export your data in a portable format
- Opt out of marketing email
- Opt out of the "sale" or "sharing" of your data — we do not sell or share for cross-context advertising, but you still have the right to ask
- Complain to your data protection authority
To exercise any of these, email kumo@makais.app from the address associated with your account. We respond within 30 days.
6. Security
Data is encrypted in transit (TLS) and at rest where our subprocessors support it. Authentication uses magic links, not passwords. No system is perfectly secure; if you see something suspicious, tell us.
7. International Transfers
Our subprocessors may process data in the United States and other jurisdictions. Where required, they rely on Standard Contractual Clauses or equivalent safeguards for cross-border transfers.
8. Children
Kumo products are not directed to children under 16 and we do not knowingly collect data from them. If you believe a child has given us data, email us and we will delete it.
9. Changes
We'll update this page when something material changes. The "Last updated" date at the top is the version marker.