Privacy Policy | Kumberi

This page is provided for transparency. It is not legal advice to you. We may update it; the published version applies.

1. Who We Are (Data Controller)

The data controller for personal data processed through Kumberi is K Imba Holdings Ltd, a company registered in England and Wales ("we", "us", or "our").

Contact: support@kumberi.co.uk. Website: https://www.kumberi.co.uk. You can also use our Contact page.

Registered office and Companies House company number: available on request / to be stated on this page once confirmed by the business.

This Privacy Policy explains how we collect, use, store, and share personal data when you use Kumberi, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What Personal Data We Collect

Depending on how you use the Service, we may process:

2.1 Account Data

email address, name (if provided), password (stored in hashed form), and account settings;
authentication and session-related identifiers needed to keep you signed in securely.

2.2 Scenario And Financial Inputs You Enter

information you choose to enter for modelling (for example income, expenses, property details, pensions, investments, debts, goals, household assumptions, and related scenario parameters);
saved journeys, simulation results generated for you, and progress updates you submit.

We do not connect to bank accounts or use Open Banking. Financial details in Kumberi come from what you enter (or from calculations we derive from those inputs).

2.3 Payment Metadata

subscription or purchase status, plan type, timestamps, and limited payment metadata needed to fulfil orders;
card and full payment details are processed by Stripe; we do not store full card numbers on our servers.

2.4 Technical And Security Logs

IP address, device/browser information, approximate location derived from IP where relevant for security, timestamps, and error or access logs;
security-related events used to protect accounts and the Service.

2.5 Support Communications

content of emails or messages you send to support (including via our Contact page), and our replies.

2.6 Analytics (Only With Consent)

if you consent to analytics cookies, PostHog (EU) and/or Google Analytics 4 may collect usage events, page views, device/browser technical data, and related analytics identifiers as described in our Cookie Policy.

3. Purposes And Lawful Bases

We process personal data for the following purposes:

Providing the Service (account creation, authentication, saving scenarios, running models, delivering paid features) — performance of a contract (UK GDPR Art. 6(1)(b)).
Payments and subscriptions — performance of a contract; related tax/accounting records where required — legal obligation (Art. 6(1)(c)).
Security, fraud prevention, and service integrity — legitimate interests (Art. 6(1)(f)), balanced against your rights.
Customer support — performance of a contract and/or legitimate interests.
Analytics cookies / product analytics —consent (Art. 6(1)(a); and PECR for non-essential cookies). You may withdraw consent at any time.
Service improvement using aggregated or de-identified insights where feasible — legitimate interests, without selling your identifiable financial inputs.
Legal compliance and defending claims — legal obligation and/or legitimate interests.

4. Financial Scenario Inputs — Sensitivity And Purpose Limitation

Information you enter about your finances and life plans can feel highly sensitive even when it is not a formal "special category" of data under UK GDPR. We treat it with care.

Purpose limitation: we use scenario and financial inputs to provide modelling and related Service features to you—not to sell your data, not to target you with third-party advertising, and not to share identifiable financial profiles with financial institutions for their marketing.
Security: we apply access controls, encryption in transit, secure hosting practices, and authentication controls appropriate to a consumer SaaS product. No method of transmission or storage is perfectly secure; we work to reduce risk and respond to incidents.
No bank connectivity: we do not pull transaction data from your bank. You remain in control of what you type into the Service.

5. Recipients And Processors

We use carefully selected service providers (processors) who process personal data on our instructions. The main ones are:

Stripe — payment processing and billing. Captures payment card details (on Stripe's systems, not ours), customer and subscription identifiers, billing email, and payment status metadata needed to fulfil purchases.
Render (or equivalent cloud host) — application hosting and infrastructure. Captures technical logs such as IP address, request metadata, and operational telemetry needed to run and secure the Service.
MongoDB Atlas (or equivalent) — database hosting for account, scenario, and related product data you save in Kumberi.
Brevo — transactional and support-related email delivery (for example verification, password reset, and support replies). Captures recipient email address, message content/metadata, and delivery status.
PostHog (EU) — product analytics, only if you consent to analytics cookies. Captures usage events, page views, feature interactions, and analytics identifiers. Configured toward an EU/EEA host where practicable. Session recording is not used as a core feature.
Google Analytics 4 — website/product analytics, only if you consent to analytics cookies. Captures page views, device/browser technical data, approximate location derived from IP (with IP anonymisation settings where applied), and analytics identifiers. Loaded only after consent.
Sentry — application error monitoring and performance diagnostics. Captures technical error reports, stack traces, environment metadata, and limited request context. We configure Sentry so default PII sending is disabled where supported; session replay (if enabled) masks text and media.

We may also disclose data if required by law, court order, or regulator, or to protect rights, safety, and security.

6. International Transfers

We aim to keep PostHog analytics processing in the EU/EEA where used. Other providers (including Stripe, Google Analytics, Sentry, Brevo, MongoDB Atlas, and hosting) may process personal data in the UK, EU/EEA, United States, or other countries. Where transfers occur outside the UK, we rely on appropriate safeguards recognised under UK data protection law (such as the UK International Data Transfer Agreement / Addendum, or adequacy regulations where applicable), and contractual protections with processors.

7. Retention

Account and scenario data: retained for the life of your account while you use the Service.
After account deletion: we delete or anonymise personal data from live systems within a reasonable period, subject to residual copies in encrypted backups that rotate out over a limited backup window, and any longer retention required for legal, tax, accounting, or dispute purposes (for example limited payment and transaction records).
Support emails: retained as long as needed to resolve your request and for a reasonable follow-up period.
Security logs: retained for a period appropriate to security monitoring (typically up to around 12 months unless needed longer for an investigation).
Analytics data (if consented): retained in line with PostHog and Google Analytics configuration and our operational needs, and stopped going forward when you withdraw consent (historic data may be deleted or anonymised on request where feasible).

8. Security Measures

We implement organisational and technical measures appropriate to the risks, including encrypted connections (HTTPS), hashed passwords, access controls, environment separation for secrets, monitoring for abuse, and vendor due diligence for processors. We encourage you to use a strong unique password and to keep your credentials confidential.

9. Your Rights

Under UK GDPR you may have the right to:

access your personal data;
rectification of inaccurate data;
erasure ("right to be forgotten") in certain circumstances;
restriction of processing in certain circumstances;
data portability for data you provided, where processing is based on contract or consent and carried out by automated means;
object to processing based on legitimate interests;
withdraw consent at any time where processing is based on consent (without affecting the lawfulness of processing before withdrawal)—including via cookie preferences for analytics.

To exercise these rights, email support@kumberi.co.uk or use our Contact page. We may need to verify your identity before fulfilling a request. You can also manage or delete much of your scenario data from within your account where those controls are available.

10. Complaints

If you have concerns, please contact us first so we can try to resolve them. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO): https://ico.org.uk.

11. Children's Data

The Service is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided data, contact us and we will take steps to delete it.

12. Changes To This Policy

We may update this Privacy Policy from time to time. The "Last Updated" date at the top shows the latest revision. Material changes will be reflected on this page (and, where appropriate, notified in the Service or by email). The published version applies from the date stated.

13. Contact

Privacy questions: support@kumberi.co.uk or Contact.