Kinlet™ — Privacy Policy
Version 2026-11-06
Last updated: 6 November 2026 — a correction to the version of 22 October 2026. It describes more accurately what Kinlet already stores about members (§ 2.1, § 2.3, § 6), when Kinlet sends messages (§ 2.2), where our off-site backups are kept (§ 4), and how we send business emails to community owners and who processes them (§ 3.1, § 4). Nothing else has changed.
Who we are: Kinlet is made by PurrGiants (sole trader, Business ID 2702464-3), 91800 Tyrnävä, Finland. Contact details in § 10.
1. The short version
Kinlet helps community operators notice when a member is drifting away, and invites that member back.
To do that, Kinlet reads activity timestamps and subscription status from the community platform. It does not store members' names, usernames, email addresses, profile details, or anything members write in messages or posts. The only message text it stores is the text of the messages Kinlet itself sends, so the operator can see exactly what was sent.
We have three different roles, and this policy keeps them apart:
| whose data | who decides | our role |
|---|---|---|
| members of a community that uses Kinlet | the community operator | processor — we act only on the operator's instructions (§ 2) |
| customers — the business that installs or buys Kinlet | us | controller (§ 3) |
| payment and accounting records about customers | us, as required by Finnish law | controller (§ 3) |
| community owners we contact about Kinlet by email | us | controller (§ 3.1) |
If you are a member and want to know what is held about you, or want it removed, contact the operator of your community. They decide; we act on their instruction.
2. Community members — we process on the operator's behalf
2.1 What Kinlet reads, and what it keeps
This list is taken from the code.
| what | why | stored by Kinlet? |
|---|---|---|
platform member ID (e.g. mem_…) |
to tell one member from another | yes — in the action log, see 2.3 |
| the member's display name or username | shown to the operator next to the member in the app, so they know who it is | no — read fresh each time the app is opened, never saved |
| date the member joined | new member or long-standing | no — read fresh on each run |
| who posted in the community's chat channels, and when (the author's member ID and the time of each member's latest post) | the drift signal: a member who has gone quiet | yes, only the date of each member's latest post, under a one-way keyed hash of the member ID — no message text. Kinlet then reads only the posts made since its last read. See 2.3 |
| whether the membership is cancelling or cancelled | never contact someone who is leaving on purpose | no |
| trial end date | tell a trial ending from a member going quiet | no |
| date of a failed payment, if any | a failed card is a fixable problem | yes, only the date — in the action log and the leaving-alert log, see 2.3 |
| whether the member has ever paid, their plan's recurring price and currency, and when their paid period ends | the operator's own bill is based on paying members; the "revenue at risk" figure and leaving alerts shown to the operator | no |
Kinlet does not store: names, usernames, email addresses, phone numbers, avatars, IP addresses, the content of messages or posts, course answers, or any special-category data. A member's name is only shown to the operator in the app, read fresh each time, and is never put into a message or an alert.
⚠ What passes through without being kept. The platform's interface returns some fields together with the ones Kinlet needs — for example a member's avatar. When Kinlet reads who posted in a chat channel and when, the platform returns the messages with their text. Kinlet discards the text immediately; it does not store, analyse or display it. Email addresses and phone numbers are never returned, because Kinlet does not ask the platform for permission to read them.
2.2 What Kinlet sends to members
When the operator has switched automatic mode on, Kinlet sends payment reminders on its own; any other message is sent only when the operator sends it. Every message goes to the member through the community platform's own notification system, addressed to specific members only. Kinlet does not have members' email addresses and does not email them.
⭐ A standing rule of this product: a message to a member never mentions, hints at, or implies that their absence was noticed, or that any tracking exists. Software blocks any message that breaks this rule.
On the Large plan, unless the operator switches it off, about 5 % of discretionary cases are deliberately left alone to measure whether the invitations help. Failed payments are never held back, and nothing is held back on Free, Starter or Growth.
2.3 What is stored about members, and for how long
| record | contents | kept |
|---|---|---|
| action log | member ID · what was done (e.g. "sent a chat invitation") · date · if it was about a failed payment, the date the payment first failed · whether it was automatic or the operator · the message sent · outcome (whether the member did what the message asked within 2 days, and whether they stayed 30 days later) | member ID removed after 12 months, or within 30 days after the operator uninstalls Kinlet or the service ends — whichever comes first |
| the same log after the member ID is removed | no identifier — it can no longer be linked to anyone | kept for the operator's monthly limit and statistics |
| leaving-alert log | member ID · whether the alert was about a cancellation, a failed payment, or a failed payment that later went through · the date of the alert · the date the payment failed (or, for a cancellation, the end of the paid period) · for a failed payment that later went through, the time it went through — so that the operator is told about the same event only once. The alert itself goes only to the operator and shows the event, the member's monthly price and the days left in their paid period, not the member's name | member ID removed after 12 months, or within 30 days after the operator uninstalls Kinlet or the service ends — whichever comes first |
| measurement log (Large only, when measurement is on) | member ID · that the case was deliberately left alone to measure whether invitations help · the date · whether the member stayed 30 days later | member ID removed after 12 months, or within 30 days after the operator uninstalls Kinlet or the service ends — whichever comes first |
| chat activity record | a one-way keyed hash of the member ID — it cannot be turned back into an ID or a person — with the date of the member's latest post in the community's chat channels, and for each chat channel how far back Kinlet has read. No message text | while installed; a member's date is deleted on request (see 2.4); everything is deleted, with its backup copies, within 30 days after the operator uninstalls Kinlet or the service ends |
| message opt-out marker | a one-way keyed hash of the platform user ID of a member who turned messages off, or whom the operator marked "Don't message", your community, and the time — no name | kept while the member keeps messages off; deleted when the member turns them back on, or within 30 days after the operator uninstalls Kinlet or the service ends |
| "would have sent" log | a one-way keyed hash of the member ID — it cannot be turned back into an ID or a person — together with the community, the case it concerns (the kind of signal and the date it started, for example a payment that failed on a given day), the kind of message and the date. Kept only while the operator's automatic mode is off, so that Kinlet can show the operator how many payment reminders automatic mode would have sent. Nothing is sent to the member | 30 days; deleted, with its backup copies, within 30 days after uninstall |
Nothing else about members is stored.
2.4 Members' rights
Members' requests (access, erasure, objection and others) go to the community operator, who is the controller. On the operator's request — or on a verifiable request from the member or from Whop — we remove the member's identifier from every record within 30 days, and tell the operator.
3. Customers — data we control
| what | source | why | legal basis (GDPR Art. 6) |
|---|---|---|---|
| your platform company ID and the user ID of the person who accepted our terms, the time, and the version of the terms | the app | proof of what was agreed and when | contract (b); legitimate interest in being able to prove it (f) |
| your business ID or VAT number, if given (optional), and your confirmation that you use Kinlet as a business, not as a consumer | you, in the app | showing that Kinlet is sold only to businesses | contract (b); legitimate interests (f) — being able to show who agreed to what |
| your app settings (automatic/manual, measurement on/off, leaving alerts on/off, price and trial notices already given) and the date your free trial started (from your first acceptance) | you, in the app | to run the service as you chose | contract (b) |
| payment events from Whop, reduced before storage to what bookkeeping needs: payment ID and status, amount, currency, dates, product / plan / membership IDs, the buyer's platform ID and billing country (needed for bookkeeping; Whop handles any VAT). Everything else Whop sends — name, username, email address, phone number, billing and shipping address, card details, card fingerprint, verification results and risk score — is dropped and never stored | Whop | billing and statutory bookkeeping | legal obligation (c) — Finnish Accounting Act |
| membership events from Whop (activated, deactivated), reduced before storage to platform IDs, event type, status and dates — name, username, email address, profile picture, checkout answers and the cancellation reason are dropped and never stored | Whop | knowing who has an active subscription | contract (b) |
| your emails to us | you | support | contract (b); legitimate interest (f) |
| technical records of requests to our webhook address that failed verification | anyone who sends them | security and fraud prevention | legitimate interest (f) |
| if Kinlet cannot recognise the plan of a paying member in your community: your platform company ID and the date | the app | so that we are alerted once a day and can fix it | legitimate interest (f) — keeping the service working |
We never see your full card number. Payment is handled by Whop; we receive Whop's record of the payment, as listed above.
Our hosting provider keeps short-lived technical logs of requests to our servers, which may include IP addresses; we do not add personal data to them.
3.1 Community owners we contact about Kinlet
If you run a paid community on Whop and have published a business contact address yourself — on your website, your terms or privacy page, or your Whop store page — we may email you once about Kinlet, with a link to the install page on whop.com. We do not send reminders or follow-ups. If you reply, we answer that conversation only.
We send these one-time business emails one at a time from tero@kinletapp.com, using the email service Migadu (Migadu-Mail GmbH, Switzerland). Each email is addressed to that community and approved word for word by us before it is sent; we do not use bulk-mailing software. Our AI assistant (Claude, by Anthropic) helps us prepare and send these emails and read the replies, so Anthropic also processes the address and the email conversation (§ 4).
| what | source | why | legal basis (GDPR Art. 6) |
|---|---|---|---|
| your community's name, the published address, the page where we found it, a first name if it is published on that same page, when we wrote and how you replied (replied / no / no reply / bounced) | the page you published it on | offering Kinlet to the businesses it is built for | legitimate interest in business-to-business direct marketing (f) |
- We never buy lists, guess addresses or use personal addresses that were not published for business contact.
- You can object at any time — reply "no" (or "no thanks") and we never contact you again. We then keep only the address on a do-not-contact list, so that it is never used again.
- The address is not shared with anyone except our email provider and Anthropic (§ 4), and is used only for this email conversation.
4. Who else processes data
| recipient | role | what | where |
|---|---|---|---|
| Supabase (Supabase Pte. Ltd.) | our processor (hosting: database and webhook receiver) | everything we store (§ 2.3, § 3) | EU — Frankfurt (eu-central-1) |
| Whop, Inc. — app interface | hosts Kinlet's interface inside Whop; requests reach our API through Whop's proxy | the signed-in user's identity | USA |
| Whop, Inc. | the community platform and payment provider; an independent controller under its own privacy policy, not our processor | members' data originates there; notifications are delivered there; payments are taken there | USA |
| Cloudflare (Cloudflare, Inc.) | hosts our websites kinlet.pages.dev and getkinlet.com (the calculator, these terms and policies, and the calculator's privacy notice) — not the Kinlet app — and passes emails sent to support@getkinlet.com on to our Gmail inbox | technical data of website visitors that any web server sees (IP address, browser details) in Cloudflare's own logs; your emails to our support address, which it forwards to Gmail; nothing you type into the calculator, and no member data | Cloudflare's global network, including the USA; Cloudflare states that it is certified under the EU–US Data Privacy Framework |
| Google (Gmail, Google Drive) | our email provider (Gmail); storage of our accounting records, and an off-site backup of our customer records (Google Drive) | your emails to us; accounting records; payment records and purchase records (with the paying customer's user and membership ID); customers' acceptance records (company and user ID, time, version, business confirmation); install and uninstall dates; trial records; founding-place records; records of which notices an operator has been sent; service and security logs, which may contain a company ID — never member identifiers | may be processed in the USA; Google LLC is certified under the EU–US Data Privacy Framework |
| Migadu (Migadu-Mail GmbH) | email provider for tero@kinletapp.com, from which we send the one-time business emails to community owners (§ 3.1) | the published business address, our email to it and any reply | Switzerland, which the European Commission recognises as providing an adequate level of data protection |
| our accountant, if one is engaged | statutory bookkeeping | payment records | Finland |
| Anthropic, PBC | our AI assistant (Claude): helps us read and answer business email, prepare and send the one-time business emails in § 3.1, and explain internal monitoring alerts | business emails (including the § 3.1 address and email conversation) and server diagnostics — no member personal data | USA; Anthropic states that it relies on the European Commission's Standard Contractual Clauses (Art. 46 GDPR) |
We do not sell data. We do not share it with advertisers. We do not use members' data to train machine-learning models.
⭐ Member data is stored in the EU. Supabase is a US company, but the database and the webhook receiver run in Frankfurt, where the data is stored and primarily processed. Supabase's own subprocessors (listed at supabase.com/legal/customer-resources/subprocessor-list) may process it elsewhere under Standard Contractual Clauses or other safeguards (DPA § 5–6).
5. Transfers outside the EU/EEA
Where personal data is transferred outside the EU/EEA, we rely on the European Commission's Standard Contractual Clauses or another valid mechanism under Chapter V GDPR. Details per provider: DPA § 5.
6. How long data is kept
| data | kept |
|---|---|
| member IDs in the action log, the leaving-alert log and the measurement log | 12 months, or 30 days after uninstall / end of service — whichever first |
| action log without member IDs | while needed for limits and statistics; contains no personal data. For an installation that never paid, the company ID on these log rows is replaced with a one-way keyed hash, so the log no longer shows which company it was, and our record of when Kinlet was installed and removed is deleted, within 30 days after uninstall |
| acceptance records, business ID, business-use confirmation | customers who have paid: 6 years from the end of the calendar year in which the customer relationship ended — these records show what was sold and on which terms, and are kept with the accounting material that the Finnish Accounting Act requires us to keep. Installations that never paid: deleted, with their backup copies, within 30 days after uninstall |
| trial marker | when the acceptance record of an installation that never paid is deleted, we keep a one-way keyed hash of its company ID together with the date its free trial started and, if it was invited with a longer trial, the number of extra days — it cannot be turned back into a company or a person — so that the free trial stays once per business (Terms § 4); kept for as long as we offer Kinlet |
| founding-place marker | if you buy a founding-price plan, we keep a one-way keyed hash of your company ID (or, if the purchase cannot be linked to a company, of the buyer's user ID) — it cannot be turned back into a company or a person — so that the 20 founding places are counted once per customer across all versions of Kinlet (Terms § 4.3); kept for as long as we offer founding prices |
| app settings | while installed; deleted, with their backup copies, within 30 days after uninstall |
| message opt-out marker | while the member keeps messages off; at the latest 30 days after uninstall or end of service |
| chat activity record | the date of each member's latest chat post, under a one-way keyed hash of the member ID (it cannot be turned back into an ID or a person), and for each chat channel how far back Kinlet has read; while installed — a member's date is deleted on request (see 2.4); everything is deleted, with its backup copies, within 30 days after uninstall |
| "would have sent" log | 30 days; deleted, with its backup copies, within 30 days after uninstall |
| accounting vouchers, including the payment events they are based on | 6 years from the end of the calendar year in which the financial period ended |
| accounts and financial statements | 10 years from the end of the financial period |
| membership events from Whop | reduced to IDs, event type, status and time; kept 6 years like the sales records they support |
| webhook requests that failed verification | their content is not stored at all; only the arrival time, the three signature headers and the rejection reason are kept, for security monitoring |
| monitoring notes that contain your company ID | 30 days, or as soon as we see that Kinlet was uninstalled — whichever comes first |
| your emails to us | 3 years after the matter was closed |
| community owners we contacted (§ 3.1) | 12 months after our last email, unless you become a customer; an address that replied "no" stays on the do-not-contact list for as long as we send such emails |
⚠ Accounting records cannot be deleted on request. Finnish law requires them to be kept and forbids altering them. A deletion request cannot remove a payment record. This is the one place where the law overrides a request, and we say so plainly.
7. Your rights
If you are in the EU/EEA you have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data, and to lodge a complaint with a supervisory authority. In Finland that is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), tietosuoja.fi.
Members: direct requests to the operator of your community (§ 2.4). Customers: contact us (§ 10). We reply within one month. Community owners we contacted: reply to our email or contact us (§ 10).
8. Security
- All traffic is encrypted in transit (HTTPS).
- Payment events are cryptographically signed by Whop; we verify every signature and a 5-minute time window, and reject anything that fails.
- Stored payment events cannot be altered, and are removed only when their retention period in § 6 ends; each carries a checksum, so any change would be detectable. Accounting records are kept in a hash chain for the same reason.
- Database tables are closed to every public access role; only the server-side service key can read or write them.
- Access to production data is limited to the operator of this service.
⚠ No service can promise that a breach is impossible. If a breach affects customers' personal data and is likely to result in a risk to their rights, we notify the supervisory authority within 72 hours and inform the affected customers. If it affects members' data, we notify the community operator as described in the DPA § 9.
9. Changes to this policy
We post material changes in the app at least 14 days before they take effect — 30 days before adding or replacing a subprocessor (DPA § 5).
10. Contact
Kinlet is made by PurrGiants (sole trader, Business ID 2702464-3), 91800 Tyrnävä, Finland.
Email: support@getkinlet.com