Legal
Privacy Policy
This Privacy Policy explains how Kleyn ("Kleyn", "we", "us" or "our") collects, uses, shares and protects your personal data when you use the Kleyn mobile application (the "App") and the related website (together, the "Service").
We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data (Wet betreffende de bescherming van natuurlijke personen met betrekking tot de verwerking van persoonsgegevens / Loi relative à la protection des personnes physiques à l'égard des traitements de données à caractère personnel, the "Belgian Data Protection Act").
If you have questions about this Policy, you can contact us at privacy@kleyn.app.
1. Who is the controller?
The controller of your personal data is:
Lange Schouwenstraat 39
B-3520 Zonhoven
Belgium
Registered with ID: 0775.474.814
Email: privacy@kleyn.app
2. Scope of this Policy
This Policy applies to:
- the Kleyn App for iOS and Android;
- our website and any sub-domains;
- the back-end services that support the App (databases, file storage, edge functions);
- communications we send you (such as account verification and password reset emails).
This Policy does not apply to third-party websites, apps or services that we link to. Please review their privacy policies separately.
3. What personal data do we process?
We only process the data we actually need to operate the Service. Concretely, we process the following categories of personal data.
3.1 Account data
When you create an account we collect:
- your name;
- your email address;
- your password (stored as a salted hash by our authentication provider — never in plain text);
- a one-time verification code (OTP) sent during registration to confirm your email address;
- the date your account was created and the date of your last login.
3.2 Content you create in the App ("User Content")
When you use the App you create content that we store on your behalf, such as:
- Boxes: the name you give a box (e.g. "Garage box 3"), an optional location label (e.g. "attic", "basement"), and an optional emoji;
- Items: the names and descriptions you add to items inside a box;
- Photos: photos you take or upload of the contents of your boxes;
- QR codes that you generate and link to your boxes.
Box names, location labels and item descriptions are free-text fields. Please do not enter sensitive personal data (such as health data, government identifiers or financial details) into these fields.
3.3 Subscription and purchase data
If you purchase a paid plan or an AI credit pack, we process:
- your subscription tier (Free, Starter, Premium);
- your remaining AI ("intelligence") credit balance and the date these reset;
- the product identifier of the purchased plan or credit pack;
- the status of your purchase (active, cancelled, refunded, in trial, etc.).
The actual payment is handled by Apple App Store. We never receive or store your full payment card details, IBAN or bank account number.
3.4 Technical and diagnostic data
To keep the App stable and secure, we process limited technical data:
- crash reports and unhandled errors (stack traces, error messages);
- performance traces (sampled at 20% of sessions);
- the device model, operating system and version, app version and language;
- a pseudonymous installation identifier;
- the IP address from which a request to our back-end was made (used for security and rate limiting, then discarded or shortened).
We do not use third-party advertising or marketing trackers, and we do not build advertising profiles.
3.5 Camera and photo library
The App uses the camera to scan QR codes and to take photos of your boxes. With your permission it can also import photos from your photo library. Images you import or capture are only processed when you actively choose to add them to a box. We do not access your photo library in the background.
On paid plans, photos you add to a box are sent to our AI provider for analysis as part of your subscription; the Free plan does not include AI analysis. See Section 5 for details.
Please avoid photographing other people. Kleyn is designed to photograph objects inside storage boxes, not people. Please do not photograph household members, visitors, children or any other identifiable person when you take or upload pictures for the Service. If another person is incidentally visible in a photo, please obtain their permission before uploading it, or crop them out first. When you upload a photo you confirm that you have the right to do so and that any identifiable person shown has consented to the processing described in this Policy. We process these images on your instructions, as the account holder, and we rely on you to make sure those instructions are lawful.
3.6 What we do NOT collect
We do not collect:
- your precise or approximate location (the App requests no location permission);
- your contacts;
- biometric data;
- microphone audio;
- data about your activity in other apps;
- special categories of personal data within the meaning of Article 9 GDPR.
4. Why we process your data and on what legal basis
Under Article 6 GDPR every processing activity needs a legal basis. The table below summarises ours.
| Purpose | Categories of data | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Creating and managing your account, signing you in, resetting your password | Account data | Performance of a contract — Art. 6(1)(b) |
| Storing the boxes, items and photos you create | User Content | Performance of a contract — Art. 6(1)(b) |
| Generating an AI inventory list and searchable attributes from photos you add to a box — automatic on paid plans, not available on the Free plan | Photo of the box, derived item list and attributes (brand, colour, material, category, object type) | Performance of a contract — Art. 6(1)(b) |
| Generating anonymous Derived Data (see Section 8.1) to improve the Service and build new features | A de-identified projection of the AI output, never linked to your account | Performance of a contract — Art. 6(1)(b) (paid plans) and legitimate interest — Art. 6(1)(f) for the anonymous corpus itself |
| Processing in-app purchases and managing your subscription | Subscription and purchase data | Performance of a contract — Art. 6(1)(b) |
| Sending transactional emails (verification, password reset, important service notices) | Email address, name | Performance of a contract — Art. 6(1)(b) |
| Diagnosing crashes, fixing bugs, preventing abuse, ensuring security | Technical and diagnostic data | Legitimate interest — Art. 6(1)(f) |
| Complying with statutory obligations (e.g. responding to lawful requests, tax administration) | All relevant data | Legal obligation — Art. 6(1)(c) |
| Defending or asserting legal claims | All relevant data | Legitimate interest — Art. 6(1)(f) |
We do not currently send marketing emails. If we ever introduce them, we will only do so on the basis of your prior consent (Art. 6(1)(a) GDPR), and you will be able to withdraw that consent at any time.
5. AI photo analysis (Google Gemini)
AI photo analysis is included with paid plans (Starter and Premium). The Free plan does not include AI analysis and photos on the Free plan are never sent to Google.
On paid plans, when you add a photo to a box the photo is sent over an encrypted connection to Google's Gemini API (gemini-2.5-flash-lite), hosted in the European Union, so that Google can return:
- a list of recognised items;
- structured attributes for each item (brand, object type, colour, material, category, estimated count);
- a short description used to power in-app natural-language search such as "where are my red Nike sneakers?".
The transmission is initiated by our secure back-end and is authenticated server-side; we do not expose API keys to the App.
Important points to know:
- Google acts as our processor / sub-processor for this purpose.
- We do not give Google your name, email address or other account identifiers together with the image.
- According to Google's terms for the paid Gemini API, your prompts and responses are not used to train Google's generative models. We rely on those terms; please consult Google's documentation for the most up-to-date information.
- The recognised item list, the structured attributes and a numerical "embedding" of the description are stored in your account so that you can edit the list and so that search works offline from Google.
- Anonymous insights derived from the analysis are separately covered by Section 8.1.
You are informed of this processing during onboarding, before your first upload, and you can read this Section 5 again at any time. If you prefer not to have your photos analysed, do not upgrade to a paid plan: the Free plan is fully functional without AI.
6. Who we share your data with
We do not sell your personal data. We only share it with the limited number of carefully selected processors and partners listed below.
6.1 Processors (acting on our behalf under a Data Processing Agreement)
| Provider | Role | Data processed | Location |
|---|---|---|---|
| Supabase | Authentication, database, file storage, edge functions | Account data, User Content (incl. photos), subscription data, IP address | EU region (Frankfurt) |
| Sentry | Crash and performance monitoring | Diagnostic data, pseudonymous user ID, device/OS/app version, IP address (truncated) | EU region |
| Google (Gemini API) | AI photo recognition on paid plans (automatic when you add a photo) | The specific photo you add and the structured attributes extracted from it | Google data centres in the European Union; see Section 5 |
6.2 Independent controllers / partners
| Provider | Role | What they receive |
|---|---|---|
| RevenueCat | Manages subscription state and entitlements | Your Kleyn user ID (a UUID), the product purchased and its status |
| Apple App Store | Processes in-app purchases on iOS | Payment details (handled directly by Apple), your Apple ID |
Apple acts as an independent controller for the payment transaction itself. Their privacy policy applies to that processing.
6.3 Other situations
We may also share your data:
- with professional advisers (lawyers, accountants, auditors) under a duty of confidentiality;
- with competent authorities, courts or regulators when we are legally required to do so;
- with a successor entity in the event of a merger, acquisition or sale of assets — in which case we will inform you in advance.
7. International transfers
Our primary infrastructure (Supabase, Sentry) is hosted in the European Union. Some sub-processors — in particular Google (Gemini API) and Apple — may process data outside the European Economic Area, including in the United States.
Where we transfer personal data outside the EEA, we rely on one of the safeguards permitted by Chapter V GDPR:
- an adequacy decision of the European Commission (e.g. the EU–US Data Privacy Framework, where the recipient is certified);
- Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) supplemented by additional technical measures;
- one of the derogations of Article 49 GDPR where strictly necessary.
You can request a copy of the relevant safeguards by emailing privacy@kleyn.app.
8. How long we keep your data
We do not keep personal data longer than necessary for the purposes for which we collected it.
| Data | Retention period |
|---|---|
| Account data and User Content | For as long as your account exists. Deleted within 30 days of account deletion, except where legally required to keep longer. |
| Photos in storage | Deleted together with the account or earlier if you delete the photo or box. |
| Subscription / purchase records | Up to 7 years after the transaction, to comply with Belgian tax and bookkeeping law (in particular Article 60 of the Belgian VAT Code and Article 315 of the Income Tax Code 1992). |
| Crash reports and performance traces | Up to 90 days, then aggregated or deleted. |
| Server access logs | Up to 30 days. |
| Backups | Encrypted backups are rotated and overwritten within 35 days. |
When you delete your account, deletion cascades through our database (boxes, items, photos, memberships) and storage bucket.
8.1 Derived Data
During the life of your Account we generate anonymous and aggregated information from your Content — for example category and sub-category labels produced by AI recognition, dominant colours and materials, seasonality, a coarse scene description, counts bucketed into ranges (1 / 2–5 / 6–10 / 11+) and — subject to the threshold described below — widely used brand names. Each Derived Data record is written without any identifier that would link it back to you, to your household or to your specific home: no account ID, no item ID, no photo reference, no precise timestamp (we retain the year and month only) and no free-text description.
Brand names in Derived Data. We only include a brand name in the Derived Data store when that brand is represented across a sufficiently large number of distinct users in our customer base (a "k-anonymity" threshold, initially set at k = 50). Brand names that fall below the threshold are generalised or omitted, so that a rare or local brand can never act as a quasi-identifier. We also exclude Derived Data entirely for items whose category is sensitive within the meaning of Article 9 GDPR — in particular medication, adult products, firearms and religious or political items — regardless of brand.
Because Derived Data prepared in this way no longer qualifies as personal data within the meaning of Article 4(1) GDPR and Recital 26, it falls outside the scope of this Policy. Kleyn may retain and use Derived Data indefinitely for any lawful purpose, including training and improving our AI systems, producing insights and market statistics, developing new features, and operating the Service. The ownership of Derived Data between you and Kleyn is governed by Section 7 of our Terms of Use.
Deleting your Account removes your raw Content — including photos, item lists, the personal attributes we stored on your items for in-app search (brand, colour, material, object type, embeddings) and all information that can still be linked to you. It does not delete Derived Data that was already de-identified before your Account was deleted, because such data is no longer personal data and the right to erasure in Article 17 GDPR does not apply to it.
9. Your rights under the GDPR
You have the following rights in respect of your personal data:
- Right of access (Art. 15) — to obtain confirmation of whether we process your data and a copy of it;
- Right to rectification (Art. 16) — to have inaccurate data corrected;
- Right to erasure / "right to be forgotten" (Art. 17) — to have your data deleted;
- Right to restriction of processing (Art. 18);
- Right to data portability (Art. 20) — to receive your data in a structured, machine-readable format;
- Right to object (Art. 21) — in particular to processing based on legitimate interests;
- Right to withdraw consent (Art. 7(3)) — without affecting the lawfulness of prior processing;
- Right not to be subject to a decision based solely on automated processing (Art. 22). The AI scan only proposes a list for you to review and edit; it does not produce legal effects.
You can exercise most of these rights directly in the App: edit your name, change your password, delete individual boxes, items and photos, or delete your entire account from the profile screen.
For other requests, email privacy@kleyn.app. We respond within one month (Art. 12(3) GDPR). You also have the right to lodge a complaint with a supervisory authority such as the Belgian Gegevensbeschermingsautoriteit (GBA).
10. Security
We take appropriate technical and organisational measures to protect your data, including:
- TLS / HTTPS encryption for all traffic between the App and our back-end and between our back-end and sub-processors;
- encryption at rest for the database and the photo storage bucket;
- row-level security policies that ensure each user can only access their own data;
- short-lived signed URLs (1-hour expiry) for photo downloads;
- salted password hashing handled by our authentication provider;
- principle of least privilege for staff and infrastructure access;
- monitoring and alerting for unusual activity;
- regular software updates and dependency reviews.
Despite these measures, no online service can guarantee absolute security. If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données) within 72 hours in accordance with Article 33 GDPR and, where required by Article 34 GDPR, inform affected users without undue delay.
11. Children
The Kleyn App is not intended for children under 16. We do not knowingly collect personal data from children under 16. If you become aware that a child has provided us with personal data without verifiable parental consent, please contact us at privacy@kleyn.app and we will delete that data.
12. App permissions
When you use Kleyn, your operating system will ask your permission for the following:
| Permission | Why we ask |
|---|---|
| Camera | To scan QR codes attached to your boxes and to take photos of box contents. |
| Photo Library / Media Images | To let you pick existing photos to attach to a box. |
| Notifications (optional) | To send you reminders or important account messages, only if you grant permission. |
| Internet | To sync your account and content with our back-end. |
You can revoke any of these permissions at any time in your device settings. Some features will then no longer work (for example, you cannot scan a QR code without camera access).
13. Cookies and similar technologies
The Kleyn mobile app does not use browser cookies. It uses local secure storage on your device to keep you signed in (a Supabase session token) and to remember basic preferences. These are first-party, strictly necessary, and required for the App to function.
Our website may use a small number of strictly necessary cookies and, where applicable, analytics cookies. A separate Cookie Notice is published on the website; analytics cookies are only set after your prior consent in line with Article 129 of the Belgian Act of 13 June 2005 on electronic communications, transposing Article 5(3) of the ePrivacy Directive (2002/58/EC as amended).
14. Changes to this Policy
We may update this Policy from time to time, for example to reflect changes in the Service or in applicable law. The "Last updated" date at the top of this Policy will always reflect the most recent version.
If we make material changes, we will notify you in the App and/or by email before they take effect, and — where required by law — we will ask for your consent.
15. Contact
For any question, request or complaint about this Policy or the way we handle your data: