Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

• Company: Kamina.io (SASU)
• SIRET: 881 915 813 00011
• Address: 11 Rempart Saint Thiébault, 57000 Metz, France
• Contact: hello@kamina.io

2. Data We Collect

We collect the minimum data necessary to operate Murmure and deliver personalised bedtime stories.

a) Account data

When you create an account, we collect your email address and a hashed password. This is used to authenticate you and associate your stories and children's profiles with your account.

b) Children's profiles

To personalise stories, you provide your child's first name and age. We do not collect any other identifying information about your children, and this data is never shared or used for advertising.

c) Story content and audio

The highlights, mood, and preferences you provide are used to generate story text and audio. Generated stories and audio files are stored on your account so you can replay them. You may delete them at any time from the app.

d) Waitlist email

If you submit your email on our homepage, we store it to send you a single reminder when your story is ready. We do not send marketing emails without your explicit opt-in.

e) Technical and analytics data

Our infrastructure (Cloudflare) may log IP addresses, HTTP headers, and request metadata for security and operational purposes. We use Cloudflare Web Analytics in cookieless mode — no individual users are tracked across sessions or sites.

3. Legal Basis for Processing

• Performance of a contract (Art. 6(1)(b) GDPR): Account data, children's profiles, and story content are processed to deliver the service you subscribed to.
• Consent (Art. 6(1)(a) GDPR): Waitlist emails are stored based on your explicit submission. You may withdraw consent at any time by emailing us.
• Legitimate interests (Art. 6(1)(f) GDPR): Anonymised analytics to improve the service; security logging to protect our infrastructure.
• Legal obligation (Art. 6(1)(c) GDPR): Retention of billing and invoicing records as required by French tax and commercial law.

4. Data Retention Periods

• Account and story data: Retained for the duration of your account. You may delete your account and all associated data at any time from the app settings.
• Waitlist emails: Up to 12 months, or until you unsubscribe.
• Billing and invoicing records: 10 years, as required by French commercial law (Article L. 123-22 of the Code de Commerce).
• Security logs: Up to 30 days, per Cloudflare's data retention practices.

5. Third-Party Data Processors

We engage the following sub-processors. Transfers outside the EU/EEA are governed by Standard Contractual Clauses (SCCs) under Chapter V of the GDPR.

• Convex, Inc. (USA) — Database, authentication, and backend infrastructure. Your account, children's profiles, and story data are stored on Convex servers.
• ElevenLabs (USA) — Audio narration. Story text is sent to ElevenLabs to generate the whispered voice audio. No personal data about you or your child is included in the text payload.
• Anthropic / OpenAI (USA) — Story generation. The highlights and preferences you provide are sent to an LLM to generate story text. These providers do not retain prompts for training without explicit consent.
• Cloudflare, Inc. (USA) — CDN, DNS, DDoS protection, and cookieless web analytics. Privacy notice: cloudflare.com/privacypolicy

6. Your Data Subject Rights

Under the GDPR, you have the following rights with respect to your personal data:

• Right of access (Art. 15): Request a copy of the data we hold about you.
• Right to rectification (Art. 16): Request correction of inaccurate data.
• Right to erasure (Art. 17): Request deletion of your data, subject to our legal retention obligations.
• Right to data portability (Art. 20): Request your data in a structured, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interests at any time.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting prior processing.

To exercise any of these rights, contact us at hello@kamina.io. We will respond within 30 days. You also have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL) at cnil.fr.

7. Cookie Policy

Murmure operates a minimal cookie footprint. We use Cloudflare Web Analytics in cookieless mode — no tracking cookies are set and no individual users are tracked across sessions. Authentication state is managed via httpOnly session tokens set by Convex Auth, strictly necessary for the service to function. We do not use advertising cookies.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to account holders by email. The "Last updated" date at the top of this page always reflects the most recent revision.