Privacy Policy & Data Protection

1. Data Controller & Contact

The data controller responsible for the processing of personal data collected through the Kiplik service is Kiplik. For any questions, inquiries, or to exercise your privacy rights, please contact our Data Protection Officer at: privacy@kiplik.com.

2. Personal Data We Collect

When using Kiplik, we collect the following categories of personal data:

• Account & Identity Data: Full name, email address, unique user identifier (Firebase UID), and profile picture (if provided).
• User Content & Memoirs: Written stories, chapter drafts, uploaded audio notes/transcripts, uploaded photographs, and associated EXIF metadata.
• AI Assistant Interactions: Prompts, writing instructions, questions submitted to the creative assistant, and generated suggestions.
• Payment & Shipping Data: Transaction references, tokenized payment methods (handled directly by Stripe), physical delivery addresses, and recipient contact info for printed book orders.
• Technical & Usage Data: IP address, access logs, browser type, operating system, and session tokens.

3. Purposes & Legal Bases for Processing

Your data is processed for explicit purposes, each anchored on a valid legal basis:

4. Data Retention Period

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Account Data & Projects: Retained while your account remains active. Upon account deletion, all your projects, texts, and photos are permanently erased from our servers within 30 days.
• Temporary Audio Recordings: Processed immediately for transcription and then deleted or saved to your chapter based on your choice.
• Transaction & Invoicing Data: Kept for 10 years to comply with statutory fiscal and commercial recordkeeping obligations.
• Security & Technical Logs: Retained for up to 12 months before automatic deletion.

5. Your Rights & How to Exercise Them

Under GDPR and applicable privacy legislation, you hold the following rights regarding your personal data:

• Right of Access: Request confirmation of data processing and receive a copy of your personal data.
• Right to Rectification: Correct inaccurate or incomplete information.
• Right to Erasure ("Right to be Forgotten"): Request permanent deletion of your personal data.
• Right to Data Portability: Export your stories, drafts, and photos in a structured, machine-readable format.
• Right to Restrict or Object: Limit or object to specific processing operations for legitimate grounds.
• Right to Withdraw Consent: Revoke consent at any time for consent-based features.

6. Data Security & Encryption

Kiplik enforces rigorous technical and organizational security measures to protect your content from unauthorized access, loss, or alteration:

• Encryption in transit using modern HTTPS / TLS 1.3 encryption.
• Encryption at rest for databases and file storage (AES-256).
• Strict user isolation enforced by granular Firebase Security Rules.
• Server-side validation for media uploads (MIME type restrictions and file size caps).
• Role-based access control based on the principle of least privilege.

7. Cookies & Local Storage

Kiplik uses only essential cookies and local storage tokens strictly required for service functionality (authentication tokens, language preference). We do not deploy third-party advertising cookies or invasive tracking scripts.