This agreement explains how your personal data is processed, who processes it, and your rights. Questions: kintsugiutils@gmail.com
1. What This Document Covers
Think of this Data Processing Agreement (DPA) as the technical companion to our Privacy Policy. It gets into the specifics of how your personal data is handled when you use Kintsugi Utils. It's written to satisfy Article 28 of the GDPR, the UK GDPR, and Hong Kong's PDPO — so whether you're in Europe or Asia, the same protections apply.
2. Who's Responsible for Your Data
The data controller — meaning the party responsible for your data — is: Kintsugi Utils Development Team Hong Kong Special Administrative Region Contact: kintsugiutils@gmail.com
3. The Types of Data We Handle
Here's what we process: • Account data: your email and a hashed password (never plain text). • Usage data: which features you touch, how long you spend in the app, error reports. • Device data: browser type, OS, device model — collected anonymously for analytics and ads. • Advertising identifiers: your device's ad ID (IDFA/GAID), used by Google AdMob — only if you consent. • Your content: diary entries, tasks, habits, notes — stored on your device by default, only sent to servers if you enable cloud sync.
4. Why We're Allowed to Process It
Under GDPR Article 6, we rely on a few legal bases: • Contract (Art. 6(1)(b)): we need to process your data to actually provide the app — logging you in, saving your tasks, running the calculators. • Legitimate interests (Art. 6(1)(f)): keeping the app secure, preventing fraud, and improving features using anonymised, aggregated data. • Consent (Art. 6(1)(a)): for analytics cookies, personalised ads, and marketing emails. You can pull consent anytime in Settings → Privacy & Consent.
5. The Third Parties We Rely On
We don't do everything ourselves. These are the services that help run Kintsugi Utils: • Google LLC (AdMob/AdSense) — serves ads. Uses your advertising ID and device signals if you consent. Google's policy: policies.google.com/privacy. Google participates in the IAB TCF framework. • Base44 Inc. — hosts the app and provides the backend infrastructure. Processes account data and any cloud-synced content. They act as a data processor under agreement with us. • AI language model providers — power the Diary's AI writing feature. They process the text you send when generating an entry. We avoid sending personally identifiable information in these prompts. All of these operate under data protection agreements that require them to safeguard your data to the same standard we do.
6. When Your Data Crosses Borders
Some of our partners — notably Google — are based in the United States. If you're in the EEA or UK, your data may travel there. When it does, it's protected by the EU-US Data Privacy Framework and/or Standard Contractual Clauses approved by the European Commission. For data touching Hong Kong, we rely on our legitimate interests and PDPO-compliant safeguards.
7. How Long We Keep Data
We don't hold onto data longer than necessary: • Account data: kept while your account is alive; deleted within 30 days of account closure. • Analytics and ad signals: anonymised within 90 days; individual logs deleted within 12 months. • Your content (local): stays on your device until you clear it via Settings → Data. • Your content (cloud): kept until you delete your account or request deletion. Want your data erased? Email kintsugiutils@gmail.com.
8. How We Protect Your Data
Our security toolkit includes: • Encryption: AES-256 at rest, TLS 1.2+ in transit for anything server-side. • Access control: only authorised people can see personal data, and only when there's a genuine need. • Pseudonymisation: analytics events are tied to anonymous session IDs, not your real identity. • Regular reviews: we audit security and keep dependencies updated. • Local-first design: your content stays on your device unless you opt into cloud sync.
9. Your Rights as a Data Subject
You have the right to: • Access — see what data we hold about you. • Rectify — fix anything that's wrong. • Erase — have your data deleted. • Restrict — ask us to pause processing. • Port — get your data in a machine-readable format (Settings → Data). • Object — say no to processing based on legitimate interests. • Withdraw consent — take back any consent you've given, anytime. Email kintsugiutils@gmail.com to exercise any of these. We respond within 30 days.
10. The Specifics of Ad Consent
When you say yes to advertising in our consent manager, here's what you're agreeing to: • Google AdMob can store/access info on your device (IAB TCF Purpose 1). • Basic ad selection (Purpose 2). • Ad performance measurement (Purpose 7). • Audience insight research (Purpose 9). • Improvement of Google's ad products (Purpose 10). Say no, and you'll get non-personalised ads or none at all, depending on your region. You can change your mind in Settings → Privacy & Consent. Withdrawing consent doesn't retroactively make past processing unlawful.
11. If You Have a Complaint
If you think we've mishandled your data, you can complain to: • Your local EU/UK Data Protection Authority — find yours at edpb.europa.eu • Hong Kong's Office of the Privacy Commissioner for Personal Data — pcpd.org.hk We'd prefer you talk to us first at kintsugiutils@gmail.com so we can try to make it right, but you're free to go straight to the regulator if you'd rather.
12. Updates to This Agreement
We'll revise this DPA when laws change, our practices evolve, or we add or remove sub-processors. The "Last Updated" date will reflect the latest version. For significant changes, we'll notify you in the app. If you keep using Kintsugi Utils after being notified, that means you accept the updated terms.