Privacy Policy

1 Information We Collect

Account Registration

• First and last name
• Email address
• Password (stored as a hashed credential via Firebase Authentication)
• Phone number (optional)

Creator Profile

• Profile photograph (uploaded from your photo library)
• Biography / personal description
• Instagram and TikTok handles
• Creator type (Influencer or Content Creator)
• Portfolio images selected from your photo library
• City and general location

Collaboration & Activity Data

• Collaboration applications and their status
• Guest count for bookings
• Content posting status self-reported by the user
• Ratings and reviews submitted after completed collaborations
• Whether each type of content is free or paid, and an optional starting price, if you accept direct requests from businesses
• The visit details and fee a business proposes in a conversation, and whether you and the business each confirmed them

Any fee is agreed between you and the business. Komando records it in the conversation. Komando does not collect, hold, or pay that fee.

Instagram connection (optional)

Connecting a professional Instagram account is optional. The collaboration flow works without it. If you choose to connect, we collect:

• Your Instagram user id and username.
• An access token, stored encrypted on our servers. It is not stored in the app.
• The list of your posts and reels (identifier, caption, type, date, link, and, when Instagram provides them, the image or video address), so you can choose the content for a collaboration.
• The link of the post you attach, saved on that collaboration and shown to the restaurant.
• A copy of the image or video of the post you attach, when Instagram provides the file, so the restaurant can reuse it for that collaboration.
• Performance statistics of the content you attach (such as reach, views, and engagement), shown to the restaurant of that collaboration.

We request the Instagram permission instagram_business_basic to read your professional profile and media. When collaboration statistics are used, we also request instagram_business_manage_insights. We do not publish, comment, or send messages on your behalf.

You can disconnect Instagram in the app settings. Disconnect deletes the access token. A post link, statistics, or media copy already saved on a collaboration stays with that collaboration until the collaboration data is deleted.

Communications

• Messages exchanged via the in-app messaging system between creators and businesses

Technical & Device Data (Automatic)

• Firebase-assigned user identifier (UID)
• FCM token and Apple APNs device token (push notifications only)
• Account creation and last activity timestamps
• Product events via Firebase Analytics, to understand how the app is used and to fix problems. Not used for advertising.
• Crash reports via Firebase Crashlytics. A report may include your account identifier so we can investigate a crash on your account. It is not used for advertising.
• On the public website (komando.app): anonymized page views, referrers, country, and device type via Vercel Web Analytics. No advertising cookies.

Product-activity log

While you use the app, we keep a log linked to your account: sign-ins, profile edits, applications, the venues and offers you open (the name only), and when you open the map. If you take a screenshot or start a screen recording while Komando is open, we record that a capture happened and which screen was showing. We do not receive the image or the video. Our team uses this log to operate the service, answer support requests, and detect abuse. It is not used for advertising.

Location Data (Optional)

Approximate device location is collected only when you grant permission and only while using the Map feature. Location data is processed on-device and is not stored on our servers.

2 Permissions We Request

3 How We Use Your Information

• Account management: To create, authenticate, and maintain your account.
• Platform functionality: To match you with offers, manage applications, and facilitate communications.
• Push notifications: To send transactional alerts about your account activity.
• Profile display: To show your profile to a business when you apply to one of its offers. If you choose how you accept direct collaboration requests, a short version of your profile is also shown to businesses in the creator directory, unless we have hidden it at your request.
• Instagram collaborations: To show the restaurant the post you attached, and, when those features are used, its statistics and a saved copy of the image or video.
• Safety and trust: To enforce our Terms of Service and detect fraud.
• Service improvement: To analyze anonymized usage patterns and fix issues.
• Legal compliance: To meet our obligations under applicable law.

We do not use your data for behavioral advertising or sell it to third parties.

4 Data Sharing

We do not sell, rent, or trade your personal information. We share it only as follows:

• With Businesses: Your creator profile is shared when you submit a collaboration application, so the business can evaluate it. If you set how you accept direct requests, businesses can also see a short directory profile: first name, profile photo, Instagram handle, city, and whether your content is free or paid (including a starting price, if you set one). Ask us at support@komando.app if you want that directory profile hidden. If you attach an Instagram post to a collaboration, that business also sees the post link and, when those features are used, its statistics and a saved copy of the image or video.
• Resend (Resend Inc.): Sends transactional email, such as account and collaboration notices. Data is processed in the United States under standard contractual clauses.
• Meta Platforms (Instagram): When you start an Instagram connection, we exchange the authorization with Instagram to obtain your access token and to read the data described above. Governed by Instagram’s Privacy Policy.
• Firebase / Google LLC: Our infrastructure provider for Authentication, Firestore, Storage, FCM, Analytics, and Crashlytics. Governed by Google’s Privacy Policy.
• Vercel Inc.: Hosts komando.app and processes anonymized website analytics (page views, referrer, country, device). Governed by Vercel’s Privacy Policy.
• Internal admin team: Restricted access for moderation and support, bound by confidentiality obligations.
• Legal reasons: If required by law, court order, or to protect our rights or safety.
• Business transfer: In the event of a merger or acquisition, with prior notice to you.

5 Data Retention

We retain your data for as long as your account is active. If you delete your account:

• Profile data, application history, and messages are permanently deleted within 30 days.
• Push notification tokens (FCM / APNs) are deleted on sign-out or account deletion.
• The Instagram access token is deleted when you disconnect Instagram or delete your account.
• Deleted data may persist in encrypted backups for up to 90 days before being permanently purged.

You can delete your account at any time via Profile → Settings → Delete Account.

6 Data Security

We implement appropriate technical and organizational measures, including:

• Encrypted data transmission (HTTPS / TLS)
• Encryption at rest via Firebase / Google Cloud infrastructure
• Passwords stored via secure hashing — we never access your plaintext password
• Production data access restricted to authorized personnel on a need-to-know basis
• Instagram access tokens encrypted before they are stored

While we take reasonable precautions, no method of internet transmission is 100% secure.

7 Your Rights

• Access — Request a copy of the personal data we hold about you.
• Correction — Update your profile information at any time within the App.
• Deletion — Delete your account and all associated data via App settings.
• Portability — Request an export of your data in a machine-readable format.
• Objection / Restriction — Object to or restrict certain processing activities.
• Withdraw Consent — Revoke notification or location access at any time in iOS Settings. Disconnect Instagram at any time in the app settings.

GDPR (European Users): You may lodge a complaint with your local data protection authority. In France: CNIL. Full GDPR details: komando.app/legal/gdpr.

CCPA (California Residents): We do not sell your personal information. Contact us to request disclosure of data categories collected.

To exercise any right: support@komando.app — we respond within 30 days.

8 Children's Privacy

Komando is not intended for users under the age of 18. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact us at support@komando.app and we will delete it.

9 Third-Party Links

The App may display links to third-party profiles (e.g., Instagram, TikTok). The Instagram login page is operated by Meta. This Privacy Policy does not apply to third-party websites. We encourage you to review their respective privacy policies.

10 International Data Transfers

We are based in France. Firebase / Google infrastructure is primarily located in the United States. Transfers from the EEA are covered by Standard Contractual Clauses (SCCs) and Google’s Data Processing Agreement. Contact us for a copy of the applicable transfer mechanisms.

11 Changes to This Policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date and, where required, notify you via in-app notification or email. Continued use of Komando after changes take effect constitutes acceptance of the revised policy.

12 Contact

For any privacy questions or to exercise your rights:

Email: support@komando.app
Website: komando.app