Last updated: October 12, 2026
The French version prevails.
Privacy Policy
Introduction
Kamba (“we”, “us”, “our”) operates the website at kamba-app.com. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our Service.
We are committed to protecting your privacy and handling your personal data transparently and in accordance with the EU General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, and applicable Luxembourg data protection law.
By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.
Plain language summary
We collect only what we need to provide the Service. We do not sell your data. We do not use advertising trackers. You can delete your account and all associated data at any time.
Data We Collect
We collect the following categories of data when you use Kamba:
| Category | What we collect | Why |
|---|---|---|
| Account information | Email address, display name, hashed password (if you use email sign-in), profile photo URL (if you sign in with Google) | To create and manage your account, and to authenticate you |
| Usage data | Furniture projects and designs you create, cut lists, material selections, saved calculations, app preferences (e.g. preferred units and language) | To provide the core functionality of the Service and sync your work across sessions |
| Technical data | IP address, browser type and version, operating system, pages visited, timestamps, session identifiers, error logs | To maintain security, diagnose bugs, and understand how the app is used so we can improve it |
| Purchase data | Records of the build plans you purchase and unlock, the date of purchase, and the Paddle transaction reference. We never receive or store your payment card details. | To deliver the plan you bought, give you ongoing access to it, and keep a record of the transaction |
| Launch waitlist (only if you ask to be told when Kamba opens) | Your email address, the form you used (for example which type of furniture you were looking at), the note you wrote if you wrote one (280 characters at most), and the language of the page. We do not record your IP address with it. | To send you one email when Kamba opens, in your language, and to know which furniture people ask for |
| Newsletter (only if you subscribe to it) | Your email address, the language of the page, and the date and version of the consent you gave. We do not record your IP address with it. | To send you news from Kamba by email: new furniture types, guides |
When you buy a build plan, payment is processed by Paddle, which acts as the Merchant of Record for the sale: Paddle takes the payment, issues the invoice, and collects any applicable VAT. Kamba never receives or stores your payment card details. On our side we only keep purchase and unlock records together with the Paddle transaction reference. See our Terms of Sale and our Subprocessors page for details.
We do not collect sensitive personal data (such as health data, biometric data, or government ID numbers).
How We Use Your Data
We use the data we collect for the following purposes:
- Providing the Service. Storing your projects, generating cut lists and calculations, and personalising your experience based on your settings.
- Account management. Creating your account, authenticating your login, and communicating with you about your account (e.g. password reset emails).
- Transactional emails. Sending emails directly related to your use of the Service, such as account confirmation, password reset, and important service updates. We do not send marketing emails without your explicit consent.
- Security and fraud prevention. Monitoring for suspicious activity, investigating misuse, and enforcing our Terms of Service.
- Service improvement. Analysing aggregated, anonymised usage patterns to understand which features are used, identify bugs, and prioritise improvements. We do not build individual profiles for advertising purposes.
- Processing purchases. Where you buy a build plan, recording your purchase and unlock, delivering the plan, and giving you ongoing access to it. Payment itself is handled by Paddle as Merchant of Record (see Terms of Sale).
- Legal compliance. Fulfilling our legal obligations and responding to lawful requests from authorities where required.
We process your personal data on the following legal bases under the EU GDPR: contract performance (to provide the Service you signed up for), legitimate interests (security, fraud prevention, service improvement), legal obligation (compliance with applicable law), and your consent (the newsletter: you give it by ticking a box and then confirming your address, and you can withdraw it at any time with the unsubscribe link in every email).
Signing up to the launch waitlist, including through the “Notify me” button of a furniture type that is not available yet, also rests on your consent (Article 6(1)(a) GDPR): you give it by leaving your email address, and you can withdraw it at any time with the unsubscribe link in every email.
Where you purchase a build plan, we additionally process your purchase data on the basis of contract performance: to deliver the plan you bought, provide ongoing access, and keep a record of the transaction.
Data Storage & Security
Your data is stored securely using the following measures:
- Database. Your data is stored in a PostgreSQL database hosted by Neon, a managed cloud database provider. Data is stored in Germany (Frankfurt), in the European Union.
- Encrypted passwords. If you use email and password sign-in, your password is hashed using bcrypt before storage. We never store plain-text passwords.
- HTTPS everywhere. All data transmitted between your browser and our servers is encrypted using TLS (HTTPS). We enforce HTTPS across all endpoints.
- Access controls. Database credentials and API keys are stored as encrypted environment variables. Access to production systems is restricted to authorised personnel only.
While we take reasonable technical and organisational measures to protect your data, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.
In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the relevant supervisory authority as required by law.
Your Rights
Under EU data protection law (GDPR), you have the following rights regarding your personal data:
Request a copy of the personal data we hold about you.
Request correction of inaccurate or incomplete personal data.
Request deletion of your personal data (“right to be forgotten”). You can also delete your account directly from Account Settings.
Request that we restrict processing of your data in certain circumstances.
Request a copy of your data in a structured, commonly used, machine-readable format.
Object to processing of your data where we rely on legitimate interests as the legal basis.
To exercise any of these rights, email us at hello@kamba-app.com with the subject line “Data Request”. We will respond within 30 days. We may need to verify your identity before fulfilling a request. You also have the right to lodge a complaint with the CNPD, Commission nationale pour la protection des données (Luxembourg), at cnpd.public.lu, or with the supervisory authority in your EU country of residence.
Cookies
Kamba uses a single cookie, strictly necessary for the Service to function. We do not use advertising or cross-site tracking cookies.
| Cookie | Purpose | Duration |
|---|---|---|
| Session cookie (kamba_auth) | Keeps you logged in to your account across page loads and browser sessions | Until you sign out, or 30 days after you signed in (a fixed lifetime, not extended by using the site) |
This cookie is categorised as “strictly necessary” and does not require your consent under the ePrivacy Directive 2002/58/EC (as implemented in Luxembourg), because it is essential for the Service to work.
Browser local storage. Your display preferences (language, units, country and currency) are saved in your browser's local storage. If you are signed in to your account, they are also saved in that account, in our database (language, country, currency and units), so that you find them again on another device.
Your browser’s local storage also holds two items that relate to you, each under its own key:
- The email address you left on the waitlist (key kamba_waitlist_signed), so that the page shows “you are on the list” instead of the form when you come back. It is written when you sign up, from any of the waitlist forms.
- The piece of furniture you are designing (key kamba_onboard_state): the text you wrote to describe it, its type, dimensions, material, number of shelves, country and project name, so that you find it again when you return. The tool rewrites it at each change. If you create an account or sign in from the older version of the tool to download a plan, a copy of the design is kept under a third key (kamba_pdf_after_auth) and erased as soon as it has been used.
Neither of the first two keys has an expiry date. Kamba erases the waitlist address from your browser in two cases: when you delete your account, and when you remove yourself from the waitlist with the link in an email from the list, on the device where you do it. In every other case, and for the design in progress in every case, Kamba does not erase them itself, not even when you sign out or delete your account. They stay in your browser, on this device, until you clear this site’s data in your browser settings; the design in progress is also replaced by the next one you start.
Launch price. If you open the link in the email that announces the opening, your browser's local storage also keeps the identifier of your launch price (key kamba_launch): the technical identifier, at Paddle, of the code created for you, with neither your name nor your email address in it, so that this price stays applied until you pay. It is erased from your browser once it has been used for a purchase; after its end date, it is erased at your next visit to the design tool.
For privacy-friendly usage analytics we use Plausible Analytics, hosted on an EU-based instance. Plausible is cookieless: it sets no cookies on your device, collects no personal data, and performs no cross-site or advertising tracking. It produces only aggregated, anonymous statistics that help us understand which features are used.
We do not use Google Analytics, Meta Pixel, or any other third-party analytics or advertising cookies. If this changes, we will update this policy and request your consent.
Cookie banner. Because the only cookie we use is strictly necessary and our analytics is cookieless, our position is that no cookie consent banner is required. This position is pending confirmation by legal counsel.
Third-Party Services
We use a small number of trusted third-party services (sub-processors) to operate Kamba. The table below summarises the main ones. For the complete list, including each provider’s role, location, and EU→US data-transfer mechanism, see our dedicated Subprocessors page.
| Service | Purpose | Data shared |
|---|---|---|
| Neon | Managed PostgreSQL database hosting | All data you store in Kamba (encrypted at rest) |
| Render | Application hosting (web server) | Data processed in transit while serving the app, plus server and error logs |
| Cloudflare R2 | Hosting of two images: the Kamba logo and the site icon | Nothing about you is stored there, and neither are your plans: a plan is generated as a PDF when you download it and we do not keep a copy. When your browser loads the logo or the icon, Cloudflare receives that request (your IP address and browser details), as any web host does. |
| Resend | Transactional email delivery (e.g. password reset, account confirmation), the launch waitlist and the newsletter | Your email address and the content of system emails sent to you. If you joined the launch waitlist: your email address, the form you used, your note and the language of the page. If you subscribed to the newsletter and confirmed it: your email address and the language of the page. |
| Paddle | Payment processing as Merchant of Record (checkout, invoicing, VAT) | Billing details you enter at checkout (handled by Paddle). Kamba receives only the transaction reference and purchase/unlock status: no payment card details. |
| Plausible | Privacy-friendly, cookieless usage analytics (EU instance) | Aggregated, anonymous usage statistics. No cookies and no personal data. |
| Google Sign-In (optional) | OAuth authentication if you choose to sign in with Google | Your Google account email, name, and profile photo. We do not receive your Google password. |
We do not sell, rent, or share your personal data with any third party for marketing or advertising purposes.
We may disclose your data if required to do so by law, or if we believe in good faith that such disclosure is necessary to protect our rights, your safety, or the safety of others.
Data Retention
We retain your personal data for as long as your account is active and for as long as necessary to provide you with the Service.
- Active accounts. Your account data, projects, and designs are retained for the duration of your account.
- Account deletion. When you delete your account (via Account Settings or by emailing us), we permanently delete your personal data and all associated projects within 30 days. Anonymised, aggregated data derived from your usage (which cannot be used to identify you) may be retained for analytical purposes.
- Launch waitlist. Your entry is kept in our database and in a contact list at Resend, our email provider, until the email announcing the opening has been sent to you. It is deleted from both within 30 days of that email. Every email sent to the list carries a link that removes you in one click, without an account; you can also write to hello@kamba-app.com. If you have an account, deleting the account deletes your waitlist entry as well.
- Newsletter. Your address is kept in our database, and in a separate contact list at Resend once you have confirmed it, until you unsubscribe. Every newsletter carries a link that unsubscribes you in one click, without an account. A subscription that is never confirmed receives nothing and is deleted after 30 days. If you have an account, deleting the account deletes your subscription as well.
- Recovery copies. Our database provider keeps a recovery history of the database for a limited time. Data you delete can remain in it until that history expires.
- Legal holds. In some circumstances (such as a legal dispute), we may be required to retain certain data for longer than the above periods.
You can delete your account at any time from your Account Settings page. Account deletion is permanent and cannot be undone.
Contact
If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal data, please contact us:
- Email: hello@kamba-app.com
- Website: kamba-app.com
We aim to respond to all privacy-related enquiries within 5 business days. For formal data subject access requests (DSARs), we will respond within 30 days as required by law.