Notice: This Policy describes how Kuma Finances S.A.S processes the personal data of users of the Kuma Finances application, the website kumafinances.com and the AI assistant "Ren", in compliance with Colombia's Law 1581 of 2012 and Decree 1377 of 2013 (Habeas Data), and, where applicable, the General Data Protection Regulation (GDPR) of the European Union. By registering for and using the Services, you give your free, prior, express and informed authorization for the processing of your data under the terms described herein.

1. Data Controller (Responsable del Tratamiento)

Legal name: KUMA FINANCES S.A.S
Tax ID (NIT): 902.057.407-1
Registered address: Cra 57 # 160-90, Bogotá D.C., Colombia
Contact email for personal data matters: kuma_admin@kumafinances.com

2. Information We Collect

Account data: Email address, name and unique identifiers provided during registration or through Sign in with Apple/Google.
Financial data: Budgets, income, expenses, debts, investment portfolios and goals that the user enters manually, by voice, by photographing receipts or through integrations (e.g., transaction notifications that the user chooses to enable).
AI interactions: Conversation history, images and audio sent to "Ren" in order to provide contextual responses.
Usage and device data: Technical data required for operation (session identifier, language/theme preferences, aggregated usage metrics).
Website cookies and analytics: on kumafinances.com, and only if you accept the notice shown when you arrive, Google Analytics 4 sets the _ga and _ga_* cookies to measure, in aggregate, pages visited, traffic source and clicks on the main buttons (see Section 12).
Payment data: Processed securely by our providers (Apple App Store, Google Play, RevenueCat). Kuma does not store credit card numbers.

Kuma does NOT connect to your bank accounts. The user controls what financial information is recorded.

3. Purposes of Processing

Your data is processed exclusively to:

Provide, maintain and personalize the Services.
Generate financial analyses and personalized responses through Ren.
Process and validate subscriptions and payments.
Send notifications and reminders that the user has enabled.
Improve security, prevent fraud and comply with legal obligations.

We do not use your personal financial data to train third-party AI models. We do not sell your data.

4. Authorization and Legal Basis

Processing is based on the authorization you grant by accepting this Policy. For users subject to the GDPR, the legal bases are the performance of a contract (provision of the service), consent and legitimate interest in the security of the service. You may withdraw your authorization at any time (see Section 6).

5. Data Sharing and International Data Transfers

Kuma does not sell your data. We share only the information strictly necessary with infrastructure providers that act as data processors (encargados del tratamiento):

Supabase: secure database hosting and authentication.
RevenueCat, Apple, Google: management and validation of subscriptions and payments.
OpenAI: natural language, voice and image recognition processing for the Ren assistant.
Google LLC (Google Analytics 4): aggregated measurement of the use of the kumafinances.com website, only with your consent (Section 12). Not used in the application.

International transfer: some of these providers process data on servers located outside Colombia (e.g., the United States). By accepting this Policy, you authorize such international transfer, which is carried out under contractual security and confidentiality commitments with each provider.

6. Your Rights (Habeas Data / GDPR)

As the data subject, you have the right to:

Know, access and rectify your personal data.
Request the deletion (cancellation) of your data and revoke your authorization.
Object to specific processing activities.
Request proof of the authorization granted.
Under the GDPR: data portability and the right to erasure ("right to be forgotten").

You may exercise these rights by deleting your account and all your data directly from Settings → Delete account in the application, or by writing to kuma_admin@kumafinances.com. We will respond to inquiries within a maximum of ten (10) business days and to complaints within a maximum of fifteen (15) business days, in accordance with Law 1581.

7. Data Retention

We retain your personal data while your account is active and for as long as necessary to fulfill the purposes described or to comply with legal obligations. When you delete your account, your financial and profile data are permanently erased from our database, except for information we are required to retain under legal or accounting obligations.

8. Security

We implement technical and organizational measures to protect your data: encryption in transit (HTTPS/TLS), row-level security (RLS) access control in the database, secure authentication and server-side payment validation. No measure is infallible, but we work continuously to protect your information.

9. Minors

Kuma Finances is rated for ages 9 and up in terms of content, but registration and use of financial features are intended for persons with legal capacity. Data of minors is processed with regard to their best interests and, where applicable, with the authorization of their legal representative.

10. National Database Registry (RNBD)

KUMA FINANCES S.A.S has registered its databases with the National Database Registry (Registro Nacional de Bases de Datos, RNBD) of the Superintendence of Industry and Commerce (Superintendencia de Industria y Comercio, SIC), in accordance with Colombian personal data protection regulations.

11. Changes to This Policy

We may update this Policy. We will publish the current version on this page with its update date. Material changes will be notified through the application.

12. Website Cookies and Analytics

The kumafinances.com website uses Google Analytics 4, a service of Google LLC (United States), to measure in aggregate how the site is used: pages visited, traffic source and clicks on the main buttons. We use that information to improve the site; it is not used for personalized advertising and we do not sell your data.

Consent: analytics cookies (_ga and _ga_*, valid for up to 2 years) are set only after you accept the notice that appears when you arrive. If you decline, no analytics cookie is set and no information is sent to Google.
Withdrawal: you can change your decision at any time from the Cookie preferences link in the footer, which displays the notice again.
Retention: Google Analytics retains event data for the period configured in the property, up to a maximum of 14 months.
International transfer: Google processes this data on servers outside Colombia, under the terms of Section 5.
Technical browser storage (no consent required): your decision about analytics (in the browser's local storage) and, only for the duration of the session, the campaign parameters of the address you arrived with (utm, ref, invitation code) so they are preserved when you continue to the application.

The Kuma application (iOS, Android and app.kumafinances.com) does not use Google Analytics.

13. Contact

To exercise your rights or resolve questions about the processing of your data, write to us at kuma_admin@kumafinances.com.