Privacy Policy

1. Who we are

Kamaia is a platform for contract lifecycle and legal project management, available on the web (app.kamaia.cc) and as iOS and Android apps.

The platform is operated by [Nome completo ou denominação social do responsável], tax number (NIF) [NIF], located at [Morada completa, Luanda, Angola] (“Kamaia”, “we”).

This policy explains which personal data we process, why, who we share it with, how long we keep it and how you can exercise your rights, under Angolan Law no. 22/11 of 17 June (Personal Data Protection Law).

2. Controller and processor

Kamaia acts in two different roles:

• Controller — for your user account data (name, email, credentials, preferences), for the security of the service and for subscription billing.
• Processor — for the content your organisation puts on the platform (contracts, documents, entities, tasks, messages). There, the controller is the customer organisation, which decides what it records and why; Kamaia processes that data only to provide the service and on the organisation’s instructions.

If you have a question about data an organisation stored about you in Kamaia (for example, as a party or representative in a contract), please contact that organisation first. We help it respond.

3. What data we process

• Account: first and last name, email, phone (optional), job title, profile photo (optional), language and notification preferences. If you sign in with Apple, Google or Microsoft, we receive your email, that account’s identifier and, when you share it, your name. With Apple you can choose to hide your email — in that case we receive an Apple relay address.
• Credentials and security: password (stored only as a bcrypt hash), two-factor authentication secret and recovery codes (encrypted), active sessions, last sign-in date, failed sign-in attempts.
• Technical and audit logs: IP address and browser or device identification linked to sessions, sign-ins and relevant actions (for example, who created, changed, exported or deleted a contract).
• Organisation content: contracts and their versions, documents and files, key dates, obligations, tasks, projects, calendar events, comments and internal chat messages.
• Third-party data recorded by the organisation: identification of parties and counterparties (name, tax number, identity card number, address, marital status, matrimonial property regime, profession), contacts (name, job title, email, phone) and due-diligence documents (KYC/AML).
• External collaborators and signatures: name and email of people collaborating on a contract through a shared link; for electronic signatures, name, email, identification number, job title, signature image, IP, browser identification and approximate location (city and country).
• Mail: emails forwarded to the organisation’s triage address (sender, subject, text and attachments); if you connect your Outlook account, the sender, subject, preview and link of each message in the folder you choose — the full body is not stored.
• Calendar: events you create and, if you connect Outlook or Google Calendar, the events from those calendars.
• AI assistant (Cibelle): the questions you ask, the answers and the excerpts of contracts and documents the assistant consults to answer.
• Mobile app: the device’s push notification identifier and platform (iOS/Android). Photos and files are only accessed when you choose to attach a document. Biometrics (Face ID / fingerprint) are checked by the phone’s operating system and never reach us.
• Subscription billing: organisation details (name, tax number, address) and the reference and amount of each payment. We do not receive or store card data.

We do not, on our own initiative, process sensitive data (health, racial origin, religious or political beliefs). If an organisation records such data in a contract or document, it is responsible for having a legal basis to do so.

4. What we use data for and on what basis

We do not sell personal data, show advertising on the platform or use your data for marketing profiles.

5. Artificial intelligence

The Cibelle assistant and automatic field extraction use Google’s Gemini model through its API. When you use these features, we send Google your question and the excerpts needed to answer it (for example, the text of a contract, up to a few thousand words, or search results for entities, tasks and deadlines).

Google processes that data as a processor, under the API terms, to generate the answer. Kamaia does not use your content to train its own models.

Text recognition in scanned documents (OCR) runs on our servers, without sending data to third parties.

AI answers may contain mistakes and do not replace a professional’s review.

6. Who we share data with

We use the following processors, which process data only to provide their service to Kamaia:

Only if you or your organisation connect them: Microsoft (Outlook — mail and calendar) and Google (Google Calendar and Sign in with Google). In those cases, data flows between Kamaia and your account with that provider, within the permissions you granted, and you can disconnect at any time.

Within your organisation, data is visible to other users according to the roles and access permissions set by administrators. External collaborators only see what is shared with them.

We may also disclose data when required by law or by order of a competent judicial or administrative authority.

7. International transfers

Kamaia’s servers and most processors are located outside Angola, mainly in the United States. This means data is transferred abroad.

We choose providers with recognised security practices, bound by data processing terms that require them to process data only to provide the service, with appropriate security measures and a duty of confidentiality. These transfers are carried out under Law no. 22/11, including the applicable regime of the Data Protection Agency (APD).

8. How long we keep data

• User account: while the account exists. When you delete it, your name, email, phone, photo and credentials are erased immediately; workspaces where you were the only member are closed.
• Organisation content: while the organisation keeps the service, or until it deletes it. Deleted documents stay 30 days in the recycle bin and are then permanently erased — except those with evidential value (signed contract versions, powers of attorney, tax receipts and KYC documents), which the organisation must keep.
• Audit and security logs: while the organisation exists in the service, to ensure the integrity and proof of operations.
• Invoices: for the period required by Angolan tax law.
• Push identifier: until you sign out on the device or the device is no longer registered.
• On your phone: the app keeps the session in the system’s secure vault (Keychain/Keystore) and a temporary copy of the data you viewed, for up to 24 hours, to work offline. AI conversations, chat and opened documents are not cached. All of this is erased when you sign out.

When an organisation ends the service, it may request an export of its data before deletion.

9. Your rights

Under Law no. 22/11, you have the right to:

• Information and access — know what data about you we process and obtain a copy;
• Rectification — correct inaccurate or incomplete data (you can correct much of it yourself in your profile);
• Objection — object to processing based on legitimate interest;
• Erasure — ask for your data to be deleted when no longer needed, without prejudice to what the law or the customer organisation must keep;
• Withdraw consents you gave (for example, Outlook or Google connections, push notifications).

You can delete your account at any time, in the app (More → Delete my account) or on the web (Settings → Security). Deletion erases your identifying data, ends all sessions and removes Outlook and Google connections; if you are the only administrator of an organisation with other members, you will first need to appoint another administrator.

To exercise your other rights, write to privacidade@kamaia.cc from your account’s email. We reply within 30 days at most. If the data belongs to a customer organisation, we forward the request to it and let you know.

You also have the right to lodge a complaint with the Angolan Data Protection Agency (APD) — www.apd.ao.

10. Security

We apply technical and organisational measures proportionate to the risk, including:

• encrypted communications (HTTPS/TLS) between the apps and the servers;
• passwords stored with bcrypt hashing and lockout after failed attempts;
• two-factor authentication (mandatory for administrators);
• AES-256-GCM encryption of two-factor secrets and integration credentials (Outlook, Google);
• isolation of each organisation’s data and per-contract access control;
• second-person approval for sensitive exports and deletions;
• audit log of relevant actions;
• signed, time-limited document links;
• request rate limits to mitigate abuse.

No system is completely secure. If we detect a data breach posing a risk to data subjects, we notify the APD and, where the risk is high, the people affected, without undue delay.

11. Cookies and local storage

The web app only uses essential cookies: the sign-in session and your language choice. We do not use advertising cookies or third-party analytics tools on the platform.

12. Children

Kamaia is a professional service for people aged 18 or over, used within organisations. We do not knowingly collect data from minors.

13. Changes to this policy

We may update this policy when the service or the law changes. The date of the current version appears at the top. If the change is material, we will give notice in advance on the platform or by email.

14. Contact

[Nome completo ou denominação social do responsável] — NIF [NIF]

[Morada completa, Luanda, Angola]

Privacy and data protection: privacidade@kamaia.cc