Privacy Policy

Kaizena Life is a personal life app with an AI assistant. It helps you keep track of tasks, health, money, people and plans. This policy explains, in plain language, what personal data we collect, why, who helps us process it, how long we keep it, and the rights you have.

Who we are

HumanWeb AS, a company registered in Norway, operates Kaizena Life and is the data controller for the personal data described here. You can reach us about anything in this policy at support@kaizenlifetracker.com.

Data we collect

We collect what you give us, what is created as you use the app, and what you let us fetch from services you connect:

• Account data: email address, display name, sign-in details (handled by Supabase Auth), language and app settings.
• Your content: tasks, reminders, checklists, notes, projects, finance entries, work records, files and other items you create.
• Health and body data: things like weight, height, date of birth, sex, sleep, training, nutrition and readings from wearables, plus health documents you upload. This is special-category data under the GDPR, and we only process it with your explicit consent.
• Voice: audio from voice chats and phone calls with the assistant, and the transcripts made from them.
• Assistant conversations: messages you send to the assistant, images you share with it, and the replies and actions it produces.
• Assistant memory: facts and preferences the assistant remembers about you so it can help you better. You can turn memory off in Settings.
• People you add: names, contact details and notes about contacts you store in the app.
• Vault: logins and card details you choose to save. Card numbers are stored encrypted, and we do not store card security codes.
• Community content: posts, comments, messages and profile details you share in the community.
• Billing data: plan, status and transaction identifiers from Stripe, Apple, Google or RevenueCat. We never see your full card number for subscriptions.
• Connected services (optional): if you connect an account such as Google, a social network or a wearable, we store access tokens encrypted and copy the data needed for the features you use.
• Notification tokens: device and browser push tokens so we can send you reminders.
• Technical data: device type, app version, error reports and server logs used for security and reliability.
• Website chat: if you use the chat on our public website, we do not store what you type. We keep only short labels about the topic raised (for example "pricing"), any hesitation expressed and whether our assistant failed to answer. These labels are not linked to anyone.
• Website page signals: we count page views on our public website and measure how far a page was scrolled and how long it was read. We do not store your IP address, browser user agent or the query string of the page.

Why we use your data, and our legal basis

• To provide the service you signed up for (contract): running and syncing your workspace, the assistant and its tools, reminders and notifications, connected features, support and subscriptions.
• With your consent: processing health and other special-category data, analytics and marketing cookies on our website, and connecting optional services. You can withdraw consent at any time; this does not affect processing that took place before.
• Our legitimate interests: keeping the service secure, preventing fraud and abuse, fixing errors, improving the website, and producing anonymised, aggregate insights. One example is the collective memory pool, which only uses patterns shared by at least 50 people and never identifies anyone. You can opt out of it in Settings, and you can object to any processing based on legitimate interests.
• Legal obligations: keeping accounting and billing records, and answering lawful requests from authorities.

How the AI works with your data

When you use the assistant, voice, image or research features, the relevant parts of your request are sent to the AI provider that powers that feature, together with the context the assistant needs, such as related tasks, notes or memories. Some requests go through our own assistant gateway server.

Some accounts in the community are AI personas. They are AI, not people, and they are labelled as such.

The assistant can act for you, for example by creating tasks, drafting emails or posting. When you are not present, or after it has read outside content such as an email or web page, it asks for your approval before it sends, publishes, spends money or deletes anything.

We configure providers not to use your data for training where the provider offers this. Providers may keep data for a limited time under their own terms, for example to detect abuse. AI output can be wrong, so check anything important.

Who processes data for us

We use these service providers (processors) to run Kaizena Life. They only process data on our instructions and under data processing agreements:

• Supabase: database, sign-in and file storage (EU, Ireland).
• Vercel: hosting; our server functions run in Dublin, Ireland.
• OpenAI: the assistant, voice, embeddings for search and memory, and understanding images. Requests may be routed through OpenRouter when that is configured.
• OpenRouter: an optional gateway to AI models.
• Our own assistant gateway server, which runs some assistant tasks.
• ElevenLabs and Fish Audio: speech and voices; ElevenLabs also handles phone calls with the assistant.
• fal.ai: image generation. HeyGen (LiveAvatar): the video avatar.
• LiveKit: real-time audio and video rooms.
• Tavily: web research for the assistant.
• Resend: email. Twilio: SMS and phone.
• Stripe: web payments. RevenueCat, Apple and Google: app-store subscriptions.
• Firebase Cloud Messaging and Web Push services in your browser: push notifications.
• Google Tag Manager, Google Analytics, Meta Pixel and Microsoft Clarity: on our marketing website only, and only if you consent.
• Services you choose to connect, which receive and send data on your behalf: Google (Gmail, Calendar, Drive), Meta, X, LinkedIn, Spotify, YouTube, Strava, Whoop, Oura, Garmin, Polar, Coros, Fitbit and Kaizen Store. Their own privacy policies apply to what they hold.

Cookies

The app uses the cookies it needs to keep you signed in and remember your settings. On our website, our built-in page signals are cookieless. Google Analytics, Microsoft Clarity and the Meta Pixel set cookies only after you consent. You can change your choice at any time through the cookie settings link in the website footer.

International transfers

Our database and server functions are in the EU. Some processors, including the AI, voice, messaging and analytics providers, are based in the United States or process data there. These transfers rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.

How long we keep data

• Account data and content: for as long as your account is active. When you ask us to delete your account, it is permanently deleted 30 days later.
• Logs and operational data: error logs 60 days, security audit logs 180 days, website chat labels 180 days, website page signals 180 days.
• Billing records: as long as Norwegian bookkeeping law requires.

Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Take your data with you. You can download a JSON export of your data yourself in Settings.
• Correct data that is wrong or incomplete; most of it you can edit directly in the app.
• Have your data deleted. You can delete your account yourself in Settings; it is permanently deleted after a 30-day grace period in which you can change your mind.
• Ask us to restrict processing while a question about your data is being resolved.
• Object to processing based on our legitimate interests.
• Withdraw consent at any time, for example by disconnecting a service or changing your cookie choice.
• Complain to the Norwegian Data Protection Authority, Datatilsynet, or the authority where you live.

To use any of these rights, contact support@kaizenlifetracker.com. We answer within one month.

Children

Kaizena Life is for people aged 16 and over. We do not knowingly collect data from younger children. If you think a child has given us data, contact us and we will delete it.

Security

Data is encrypted in transit and at rest. Access tokens for connected services and vault contents are additionally encrypted. Database access rules ensure you can only reach your own data and what others share with you, and internal access is limited to what is needed.

Changes to this policy

We update this policy when the service or the law changes. The date at the top shows the latest version. If a change is significant, we will tell you in the app or by email.

Contact

Questions about privacy: support@kaizenlifetracker.com. See also our Terms of Service.