Privacy Policy

01

Who We Are

Kulas is a mobile application for group travel, developed and operated by Amit Meshulam ("we", "our", or "us"). The app is available on the Apple App Store under the bundle ID com.amit.kulas.

For the purposes of the General Data Protection Regulation (GDPR), we are the Data Controller of your personal information.

02

Information We Collect

Information you provide directly

• Account information — your name, username, and email address when you sign up
• Profile information — your profile photo and country of residence, if you choose to provide them
• Trip and checkpoint content — photos, videos, covers, expense amounts and allocations, repayments, activity plans, links you choose to share into Kulas, comments, and reactions
• Participation and Friends — trip/checkpoint membership, join and departure times, invitations, friendship connections, and shared travel names and dates used to display your shared history
• Partner codes — a code you enter, when it was assigned, checkout reservations, attributed purchases and renewals, and the code’s commission terms used for referral accounting
• Authentication data — credentials via Apple Sign In or Google Sign In (we never see your Apple or Google password)

Information collected automatically

• Crash and error reports — via Sentry, if the app crashes we collect device type, OS version, and the error stack trace. No personal content is included.
• Purchase and subscription information — Apple processes Trip Pass and Explorer payments. RevenueCat processes the Kulas account identifier, app/device information, receipts and transaction identifiers, purchased products, subscription tier, trial/billing status, renewal events, expiration, store, and purchase environment. Kulas stores the entitlement and event information needed to provide access, restore purchases, prevent duplicate processing, handle support, and account for partner referrals. We do not receive your full payment-card details. Purchase/subscription emails can include your email address, trip name, plan, price, and renewal information and are delivered through Resend.
• Currency conversion data — when you use multi-currency expense tracking, the exchange rate is fetched from Frankfurter (a public API). No personal data is sent.

Information we do NOT collect

• Precise or background location data
• Contacts or address book
• Device identifiers for advertising (IDFA)
• Browsing history or cross-app tracking data
• Payment card or banking information

03

How We Use Your Information

• To provide the service — creating and managing your account, enabling trip collaboration, storing and serving your uploaded photos
• To process purchases — verifying Trip Pass purchases and Explorer subscriptions, restoring access, synchronizing entitlements, and sending transaction notices
• To administer partner codes — validating a code you choose, providing the applicable offering, preventing abuse, attributing transactions and refunds, and calculating referral reports and commissions
• To provide customer support — responding to your enquiries sent to support@kulas.app
• To maintain stability — using crash reports to identify and fix bugs
• To comply with legal obligations — retaining certain records as required by applicable law

We do not use your data for advertising, profiling, or selling to third parties.

04

Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data under the following legal bases as defined by GDPR Article 6:

• Contract (Art. 6(1)(b)) — processing necessary to provide account management, shared trips/checkpoints, Friends, media storage, purchases, subscription access, and a partner discount you request
• Legitimate interests (Art. 6(1)(f)) — crash reporting, fraud and code-abuse prevention, referral accounting, and preserving shared financial history. These purposes are subject to your rights, including the right to object.
• Legal obligation (Art. 6(1)(c)) — retaining transaction records as required by applicable tax and commercial law
• Consent (Art. 6(1)(a)) — where we explicitly ask for your consent, such as optional profile information

05

Data Sharing & Third-Party Providers

We do not sell, rent, or trade your personal information. We share data only with the following service providers, solely to operate Kulas:

Shared content and Friends

Full members can access their shared trip. Checkpoint-only guests can access only their joined checkpoints, with join-time restrictions and exceptions for their own financial participation. Authorized participants can see the profile information and content needed for collaboration. Friends displays shared trip/checkpoint history; becoming a friend does not authorize access to unrelated trips. People who travel together may be connected automatically, and either person can remove the friendship.

Partner reporting

Referral administration uses code-level reports of redemptions, trials, conversions, estimated revenue, refunds, and commissions. Entering a code does not give its partner access to your private trip content, payment-card information, or Kulas account. Individual account identifiers used for attribution remain in Kulas’s restricted operational records.

Each provider is bound by their own privacy policy and, where applicable, by Data Processing Agreements that comply with GDPR requirements.

Disclosure required by law

We may disclose your information if required to do so by law, court order, or governmental authority, or if we believe in good faith that such action is necessary to comply with a legal obligation or protect the rights and safety of Kulas users.

06

Data Retention

• Active account data — retained for as long as your account exists
• Trip/checkpoint content — retained while the shared trip exists unless deleted by an authorized participant or owner; account-deletion exceptions for shared financial history are described below
• Purchase, subscription, and referral records — restricted records can remain after account deletion for transaction verification, support, fraud prevention, and accounting or legal obligations. They can include transaction identifiers, internal account identifiers, referral codes, and receipt-delivery snapshots containing an email address. Contact us to request erasure or restriction; legal retention requirements and unresolved transaction claims can limit erasure.
• Crash reports — retained by Sentry for 90 days
• Account deletion — successful deletion removes the sign-in account, profile, friendships, memberships, comments, reactions, and the user’s uploaded media and activities. File cleanup is retried if a service failure prevents completion. Shared financial and restricted transaction records are exceptions, not a promise that every record disappears.

Request deletion via Profile → Settings → Delete Account. Shared expenses, original allocations, payer records, and repayments involving other participants may remain with an internal identifier and without the deleted profile, so balances do not change. That identifier does not grant access. Trips with no remaining member or active checkpoint guest are deleted; otherwise ownership may transfer to a remaining full member, or the trip remains read-only for remaining checkpoint guests. Checkpoint deletion removes its associated records and queues unreferenced files for asynchronous cleanup.

Account deletion does not cancel an Apple subscription. Manage or cancel it separately in your Apple Account subscription settings.

07

Your Rights

Depending on your location, you have the following rights regarding your personal data:

To exercise any of these rights, contact us at support@kulas.app. We will respond within 30 days.

08

California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know — request disclosure of what personal information we collect, use, disclose, and sell
• Right to Delete — request deletion of your personal information
• Right to Opt-Out of Sale — we do not sell personal information. No opt-out is needed.
• Right to Non-Discrimination — we will not discriminate against you for exercising any CCPA rights
• Right to Correct — request correction of inaccurate personal information
• Right to Limit Use of Sensitive Personal Information — we do not process sensitive personal information beyond what is necessary to provide the service

To submit a CCPA request, email us at support@kulas.app with the subject line "CCPA Request". We will verify and respond within 45 days.

09

Children's Privacy

Kulas is not directed at children. The minimum age to use Kulas is:

• 13 years old — in the United States (COPPA)
• 16 years old — in the European Economic Area and United Kingdom (GDPR Art. 8)
• The applicable local minimum age — in all other jurisdictions

We do not knowingly collect personal information from children below these ages. If you believe a child has provided us with personal information, please contact us immediately at support@kulas.app and we will delete it promptly.

10

Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:

• All data encrypted in transit using TLS
• All data encrypted at rest in Supabase infrastructure
• Row-Level Security (RLS) policies so access is limited to authorized accounts, trip members, and checkpoint guests according to their participation
• Trip and checkpoint media accessible only to authorized members or checkpoint guests through access-controlled links
• No storage of payment card information — all payments processed by Apple

No method of transmission over the internet is 100% secure. If you believe your account has been compromised, contact us immediately at support@kulas.app.

11

International Data Transfers

Kulas is operated from Israel. Your data is stored on Supabase infrastructure located in the EU West (Ireland) region. Some of our third-party providers (such as RevenueCat and Sentry) may process data in the United States.

Israel has been granted an adequacy decision by the European Commission, meaning transfers to Israel are treated equivalently to transfers within the EEA. For transfers to other third countries (including the US), our providers use Standard Contractual Clauses (SCCs) or other approved mechanisms under GDPR Chapter V to ensure adequate protection of your data.

12

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the app, our practices, or applicable law. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Notify you via an in-app notification for significant changes

Your continued use of Kulas after changes are posted constitutes your acceptance of the revised policy. We encourage you to review this page periodically.

13

Contact Us

For any questions, requests, or complaints about this Privacy Policy or your personal data, please contact us:

If you are in the EEA and are unsatisfied with our response, you have the right to lodge a complaint with your national data protection authority. A list of EU data protection authorities is available at edpb.europa.eu.