Privacy Policy

1. Introduction

KinLife is operated by KINTUTOR PTY LTD (ABN 83 693 239 977), trading as KINLIFEAI, a company registered in Australia ("we," "our," or "us"). We are committed to protecting your privacy and we handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service. Please read this policy carefully. If you do not agree with its terms, please discontinue use of our service.

2. Information We Collect

We may collect the following types of information:

• Account information: Name, email address, and profile picture provided when you sign in via Google or another authentication provider.
• Usage data: Information about how you interact with the service, including pages visited, features used, and actions taken.
• Content you provide: Files, documents, calendar events, and other content you upload or create within the service.
• Connected Gmail data: If you connect a Gmail mailbox, we read the messages that match the scope you chose and keep the message id, sender, subject, date, and a short summary we generate. Where we find something that needs doing, we also keep the suggestion we drafted from it: a title, a date, and one line that may carry a detail such as an amount, a reference, or an address. We do not store message bodies or attachments.
• Health information we hold: The Health Records and Meals features are switched off, so we are not collecting health information. We still hold records created while those features were available, such as appointments, immunisations, medications, allergies, conditions, test results, and growth measurements. Health information is sensitive information under the Privacy Act 1988 (Cth). Ask us and we will delete it, and deleting your account removes it.
• Device and log data: IP address, browser type, operating system, referring URLs, and timestamps.

We collect personal information directly from you and from the services you choose to connect. If we switch the Health Records or Meals features back on, we will collect health information only where you choose to record it, you will not have to provide it, and you will be able to delete it at any time.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the service.
• Authenticate your identity and manage your account.
• Process and sync calendar events to connected services (e.g., Google Calendar).
• Read a connected Gmail mailbox to find the things in it that need doing, and offer them to you as tasks, events, and reminders.
• Improve and personalize your experience.
• Communicate with you about updates, security alerts, and support.
• Comply with legal obligations.

4. How We Share Your Information

We do not sell your personal information. We may share your information with:

• Service providers: Third-party vendors who help us operate the service (e.g., cloud hosting, analytics), bound by confidentiality obligations.
• Google APIs: When you connect Google Calendar or Gmail, we interact with Google's APIs subject to Google's Privacy Policy.
• Legal requirements: If required by law or in response to valid legal process.
• Business transfers: In connection with a merger, acquisition, or sale of assets, with prior notice to you.

5. Third-Party AI Processing

KinLife uses Google Gemini (Google Cloud Vertex AI) to generate replies and perform tasks for the KinLife assistant. When you use these AI features, the following categories of personal data may be sent to Google Cloud for processing:

• Messages you type: Chat prompts, WhatsApp messages, and email text routed to the assistant.
• Photos and files you attach: Images, PDFs, and documents you upload or that tools analyse.
• Voice input: Speech-to-text transcripts when you use the microphone.
• Connected Gmail messages: If you connect a mailbox, the content of the messages that match the scope you chose, including attachments such as a PDF notice or an invoice and images carried in the message, so the assistant can work out what needs doing and write the short summary we keep. Attachments are read while we process the message and are not stored.
• Family context for answers: Calendar events, notes, memory pages, health records, and contacts, when relevant to your request.
• Account identifiers: Email, display name, and family membership, processed as part of your session.

This data is processed solely to generate replies and perform the tasks you request. It is not used to train general-purpose AI or machine learning models, and it is not sold. Processing occurs under Google Cloud's terms and data processing agreements. You can read more at Google Cloud Data Processing Agreement.

Where processing happens. These AI models run in data centres located in Australia and the United States. Other services we rely on to run KinLife, including cloud hosting, email delivery, and payment processing, also operate from the United States. This means your personal information may be stored or processed overseas, and we take reasonable steps to ensure it is handled consistently with this policy and the Australian Privacy Principles.

iOS users are asked to consent to this processing before using the assistant for the first time. You can review or withdraw consent at any time in Settings.

The assistant proposes, it does not decide. We use AI to draft replies and to suggest tasks, events, and reminders. It makes no automated decision that determines your legal rights or your access to a service. You choose whether suggestions are created for you automatically or shown to you first, and anything it creates can be edited or deleted.

6. Limited Use of Google User Data

When you connect Google Calendar, we ask Google for permission to read and write your calendar events so we can show them in KinLife and keep them in sync. When you connect Gmail, we ask for read-only permission so we can find the things in your mail that need doing and offer them to you as tasks, events, and reminders. How we handle that data is governed by the following commitment:

KinLife's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In plain terms, that means:

• We only use your Google Calendar data to run the calendar features you turned on, such as viewing, creating, and syncing events, and we only use your Gmail data to surface the items you asked us to look for. You choose the scope of mail we may read when you connect, you can narrow what we act on at any time in Settings, and you can disconnect at any time. Changing the read scope itself means reconnecting.
• We never sell this data, and we don't share it with anyone else except where it's needed to run the service, required by law, or part of a business transfer that we'd tell you about first.
• We do not use any data from Google Workspace APIs to develop, improve, or train general-purpose AI or machine learning models. Your calendar and Gmail data is never fed into model training. We do send it to Google Gemini to produce the replies and summaries you asked for, as described in the Third-Party AI Processing section above, and under Google Cloud's terms that processing is not used to train Google's models either.
• No one on our team reads your Google data unless you've asked us to help, we need to for security or legal reasons, or the data has been aggregated and stripped of anything that identifies you.

The Google data we keep is your encrypted access tokens, the minimal event identifiers we need to sync, and for Gmail the message id, sender, subject, date, the short summary we generate, and any suggestion we drafted from the message. We do not keep message bodies or attachments. Disconnecting revokes our access and deletes what we stored, as described in the Data Retention section below.

7. Overseas Disclosure of Personal Information

We operate from Australia, and some of the services we rely on to run KinLife are located overseas. Your personal information may therefore be stored or processed outside Australia, principally in the United States. This applies to:

• Cloud hosting, databases, and file storage, in Australia and the United States.
• AI processing, in Australia and the United States, as described in the Third-Party AI Processing section above.
• Messaging and email delivery, used to send the digests, reminders, and assistant replies you asked for.
• Payment processing, for subscriptions.

Before disclosing personal information to an overseas recipient we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles, including under the data processing terms those providers publish. Where Australian Privacy Principle 8 applies, we remain accountable for how that information is handled.

8. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the service. You may delete your account at any time, after which we will delete or anonymize your data within a reasonable period, except where retention is required by law.

If you disconnect a Gmail mailbox, we revoke our access with Google and delete the index we built from it, including the summaries. Deleting a message in Gmail also removes it from that index, because what we hold is a derived view of your mailbox rather than a second copy of it.

9. Security

We implement industry-standard security measures to protect your information, including encryption in transit (HTTPS) and at rest. No method of transmission over the internet is 100% secure, so we cannot guarantee absolute security.

10. Data Breaches

We keep procedures for identifying, containing, and assessing data breaches. If a breach of personal information we hold is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth).

11. Children's Privacy

You must be at least 13 years old to create a KinLife account for yourself. A child under 13 may use KinLife only with the consent and supervision of their parent or guardian, and a parent or guardian must confirm they are present before that child's account setup can be completed.

A parent or guardian can also add a younger child as a profile with no login, so the child never accesses the service directly.

Information about a child, such as their name, date of birth, school details, or health records, is provided and controlled by the parent or guardian rather than collected from the child. The parent or guardian can review, correct, or delete that information at any time, and deleting the profile removes the information we hold about that child.

We do not knowingly collect personal information from a child under 13 without the consent of their parent or guardian. If you believe a child has provided us with information without that consent, contact us at the email address below and we will delete it promptly.

12. Your Rights

Depending on your location, you may have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data.
• Object to or restrict our processing of your data.
• Data portability.

To exercise these rights, contact us at the email address below. If you are in Australia and you are not satisfied with how we have handled your personal information or a privacy complaint, you can also contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

How quickly we respond. We will acknowledge a request to access or correct your personal information and respond within 30 days. We do not charge for making a request. If we refuse a request, we will tell you why and how you can complain.

Using KinLife without identifying yourself. KinLife is a shared family account, so it needs an identity to work and we cannot offer it anonymously or under a pseudonym. You choose the name your family sees, and a child can be added as a profile with no account of their own.

Marketing. We do not sell your personal information, and we do not use it for third-party marketing. Digests, reminders, and notifications are features you turn on, and you can change them or switch them off in Settings, or use the unsubscribe link in any email we send.

13. Third-Party Links

Our service may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the "Last updated" date at the top of this page. Continued use of the service after changes constitutes acceptance of the updated policy.

15. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us at: help@kinlife.ai

KINTUTOR PTY LTD
ABN 83 693 239 977
Trading as KINLIFEAI
Australia