Privacy Policy

1. Preamble

Kaiho is a coaching and quit-smoking companion application. It is not a medical app, a medical device, nor a therapeutic service. The content and features provided are part of a wellness/lifestyle coaching offering.

This privacy policy (the "Policy") describes how Kaiho processes your personal data in connection with:

• the website kaiho.fr;
• the Kaiho mobile application (iOS and Android);
• any communication with our team (email, support).

This Policy complies with the General Data Protection Regulation (EU Regulation 2016/679 of 27 April 2016 — "GDPR") and the amended French law n°78-17 of 6 January 1978 ("Data Protection Act").

2. Data controller

The data controller is:

• Kaiho SAS, a société par actions simplifiée with share capital of €1,000
• SIREN 104 211 768, registered with the Clermont-Ferrand Trade and Companies Register
• Registered office: Les Paccauds, 1 impasse de la Lauche, 63290 Paslières, France
• Email: contact@kaiho.fr

Kaiho is not legally required to appoint a Data Protection Officer (DPO) but has set up a dedicated email address for any privacy-related question: contact@kaiho.fr.

3. Data we collect

3.1 Data provided when creating an account

• Email (required): to create your account and contact you
• First name (optional): to personalize the application
• If you use Apple Sign-In or Google Sign-In: an ephemeral identifier (idToken) sent to our authentication provider, plus the profile information you agree to share (email, first name, last name)

3.2 Data provided when using the application

• Your tobacco consumption habits: cigarettes per day, pack price, currency, smoking duration
• Your quit date
• Your motivations and reasons for quitting
• Your quiz answers (dependency, motivation) and scores
• Your previous quit attempts and their duration
• Your activities in the application: exercises completed, craving help requests, lessons viewed, achievements unlocked

3.3 Connected health data (optional)

If you give explicit permission, the application can read the following data from Apple HealthKit (iOS) or Android Health Connect:

• Daily step count
• Active calories burned

This data is read and displayed on your device only: it is never sent to our servers or to any third party. You may revoke this authorization at any time from your phone's settings.

3.4 Technical data

• Device model and operating system
• Pseudonymous user identifier (UUID, generated by Kaiho)
• IP address (collected by the servers on each request, retained temporarily for security purposes)
• Language and timezone
• Push notification token (anonymous, provided by Apple or Google)
• Advertising measurement identifier: Adjust's own device identifier and, on Android, the device advertising ID (GAID). On iOS, the advertising identifier (IDFA) is only read if you accept Apple's "Allow tracking" prompt. These identifiers are never linked to your email (see section 11).

3.5 Subscription data

• Status of your subscription (free / paid)
• Apple or Google transaction identifier
• Renewal date

We never collect your bank or card details. Payments are handled exclusively by Apple App Store or Google Play, who only share with us the status of your subscription.

3.6 What we do NOT collect

• Your last name (unless provided via Apple or Google Sign-In)
• Your date of birth
• Your gender
• Your profile picture
• Your GPS location
• Your contacts or calendar
• Your photos, personal videos, files

4. Purposes and legal bases

We process your data for the following purposes, each based on a specific legal basis:

5. Who we share your data with

To run the application, we rely on a limited number of technical service providers (processors under the GDPR). Each is bound to Kaiho by a Data Processing Agreement (DPA) ensuring GDPR compliance.

We never sell your personal data. Your email, your smoking data and your progress are never sent to an advertising network. To measure our campaigns, Adjust can only tell the relevant network (Meta, TikTok, Google) that an install, a sign-up or a subscription came from one of its ads.

6. Transfers outside the European Union

Some of our providers (RevenueCat, Apple, Google, Cloudflare) and the advertising networks informed by Adjust (Meta, TikTok, Google) are based in the United States. When your data is transferred to them, we rely on the following GDPR safeguards:

• adherence to the EU-U.S. Data Privacy Framework (DPF), when the provider is registered;
• Standard Contractual Clauses (SCCs) adopted by the European Commission;
• additional technical measures (encryption in transit and at rest).

You may obtain a copy of these safeguards by writing to contact@kaiho.fr.

7. Retention period

8. Data security

We implement appropriate technical and organizational measures to protect your data:

• Encryption of data in transit (HTTPS/TLS 1.2+) on all communications
• Encryption of data at rest on Supabase servers (AES-256 encryption), hashed passwords (bcrypt)
• Two-factor authentication for access to administration tools
• Strict access partitioning: each user can only access their own data, enforced server-side; only authorized Kaiho personnel can access user data, and only when necessary
• Daily backups, with restoration tested
• Security incident management in compliance with article 33 of the GDPR (notification to CNIL and data subjects within 72h in case of serious breach)

9. Your rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access: obtain a copy of the data we hold about you
• Right to rectification: correct inaccurate or incomplete data
• Right to erasure ("right to be forgotten"): request the deletion of your data
• Right to data portability: receive your data in a structured, machine-readable format
• Right to object to data processing for legitimate reasons
• Right to restriction of processing
• Right to withdraw consent at any time, where processing is based on consent
• Right to provide directives regarding the fate of your data after your death

To exercise any of these rights, write to contact@kaiho.fr. We will respond within one month at most.

Direct deletion from the application: you may delete your account at any time from the application settings. Deletion is immediate and permanent: it cannot be undone. Remember to also cancel your subscription from the App Store or Google Play, which manage it.

10. Minors

The Kaiho application is reserved for people who are of legal age (18+), in line with the legal age for tobacco consumption in France and most European Union countries.

We do not knowingly collect data from minors. If we discover that data concerning a minor has been collected, we will delete it without delay. If you are a parent or guardian and believe your child has provided us with data, contact us at contact@kaiho.fr.

11. Cookies and trackers

kaiho.fr website

The kaiho.fr website uses no cookies and no advertising trackers. Nothing is written to or read from your browser when you visit: no cookie, no local storage, no session storage.

We do, however, measure the audience of our presentation pages with PostHog (servers in the European Union), in so-called "cookieless" mode: your browser stores nothing, and the visit identifier is an irreversible hash computed on PostHog's servers from a random salt that is renewed daily and then deleted. Your IP address is not retained, and is not used to geolocate you.

What we measure, and nothing else: pages viewed, how far down the page was read, clicks on the App Store and Google Play download links, and the opening of frequently asked questions.

Because these pages involve no storage on your device, this measurement does not require the prior consent set out in article 82 of the French Data Protection Act; it relies on our legitimate interest in understanding whether our pages are useful (art. 6.1.f). You can object at any time by enabling your browser's "Do Not Track" setting: we honour it, and no measurement then takes place.

Legal pages and support pages are not measured at all.

Mobile application

The application does not use cookies (cookies are a web technology). It uses technical identifiers to function properly:

• a session identifier to keep you logged in;
• a pseudonymous identifier (UUID) for product analytics (PostHog);
• a local cache (PowerSync / SQLite) to enable offline use;
• an Adjust measurement identifier, to know whether your install came from one of our ads.

On iOS, the advertising identifier (IDFA) is only read if you accept Apple's "Allow tracking" prompt; otherwise, measurement relies on Apple's anonymous system (SKAdNetwork). On Android, the advertising ID (GAID) is read for the same measurement; you can delete it at any time in your phone settings (Google › Ads).

If you turn off "Share usage statistics" in your profile, neither PostHog nor Adjust receives anything from the app anymore.

12. Changes to this Policy

We may update this Policy to reflect legal, technical or business changes. The last update date is shown at the top of this document.

In the event of a substantial change (new purposes, new recipients, significant changes to your rights), we will notify you by email or by an in-app notification before the change takes effect.

13. Contact and complaints

For any question regarding this Policy or your personal data:

• Email: contact@kaiho.fr
• Mail: Kaiho SAS, Les Paccauds, 1 impasse de la Lauche, 63290 Paslières, France

If, after contacting us, you believe your rights are not being respected, you may lodge a complaint with the French data protection authority (CNIL):

• www.cnil.fr/en/plaintes
• 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
• Phone: +33 1 53 73 22 22

You may also contact your national data protection authority in any other EU/EEA country where you reside.