Privacy Policy

1. Who we are

Koma is the data controller for the personal data you provide while using this application. For privacy questions, contact us at privacy@heykoma.com.

2. What we collect

• Your email address (for sign-in via one-time code).
• Your first name, if you give it to us.
• Your pay date, home currency, and chosen corridor.
• Your basic salary, if you enter it (used for pay-cycle and gratuity planning).
• Transactions you log (amount, category, optional note).
• Budgets and savings goals you create.
• The names you give the family members you track support for, including an optional Arabic spelling.
• Your Telegram chat id, only if you choose to link the Telegram bot.
• A push notification token, only if you turn on notifications.
• Device information (browser, language, timezone) for session handling.

3. Lawful basis

We process this data on the lawful basis of your explicit consent under Article 6 of the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021).

4. How we use it

• Budgeting and spending insights tailored to your pay cycle.
• Tracking the money you set aside for family, and your goals.
• AI-assisted logging when you choose to use the chat assistant.
• Sending you the notifications you asked for.

5. Artificial intelligence processing

When you type into the chat assistant, log a transaction in your own words, or message the Telegram bot, that text is sent to Google and processed by the Gemini model so Koma can understand it. Koma does not store your chat messages as message records. The transaction, budget, or goal that results from the text is stored, because that is the thing you asked Koma to remember.

6. Who processes your data

We use the following processors, each bound to process data only on our instructions:

• Google (Gemini): processes text you type, as described above.
• Supabase: database and authentication.
• Vercel: application hosting.
• Sentry: crash and performance diagnostics.
• Firebase Cloud Messaging: push notification delivery on Android.
• Resend: transactional email, including your sign-in code.
• Upstash: caching and rate limiting.
• CurrencyBeacon: exchange rates. No personal data is sent to it.

7. What we do not do

Koma contains no advertising, no advertising identifier, and no third-party analytics software. We do not track you across other apps or websites, and we do not sell or rent your personal data.

8. Security

Your data is encrypted in transit over HTTPS on every request, and encrypted at rest by our cloud infrastructure providers.

9. Retention

We keep your data while your account is active. You can delete your account at any time from Settings; after deletion, your data is removed from production systems within 30 days and from backups on the following rotation.

10. Your rights

Under the UAE PDPL you have the right to access, rectify, delete, or object to our processing of your personal data, and to withdraw your consent at any time. Account deletion (Settings) is the canonical path to exercise the right to withdraw consent.

11. Contact

For any privacy-related inquiry, or to exercise your rights, contact us at privacy@heykoma.com.