Privacy Policy

Last updated: June 20, 2026

Who we are

Kembo (ByteStronauts) ("Kembo", "we", "us", or "our") is operated by ByteStronauts, based in Slovenia. Kembo provides authentication and optional analytics services for mobile and web applications. Contact: contact@bytestronauts.com. Website: https://bytestronauts.com.

This Privacy Policy explains what information we collect, how we use it, and the choices you have when you use the Kembo dashboard or when your data is processed because you use an app that integrates Kembo.

Information we collect

  • Dashboard account information: email address, name, profile picture, and sign-in provider details when you create a Kembo dashboard account.
  • Project data: project names, API keys, OAuth configuration, billing information, and related settings you provide in the dashboard.
  • End-user authentication data: when end users sign in to a customer's app through Kembo, we process identifiers such as email, name, profile image, sign-in provider, and session tokens on the customer's behalf as a data processor under our Data Processing Agreement.
  • Platform usage data: logs, device/browser information, and analytics needed to operate, secure, and improve the Kembo dashboard and platform.
  • Project analytics (Pro, opt-in): when a project owner enables analytics, Kembo stores usage events from that app — such as event names, platform, city and country (coarse location derived from connection metadata; IP addresses are not stored), browser/OS family, and generic screen names. The app may send a random identifier per install (stored on the device) to count unique visitors; it is not linked to Kembo accounts or email. Kembo stores only a daily hash of that identifier, not the raw value. We do not store Kembo end-user IDs, referrer URLs, or cookies for this feature, and we do not use third-party advertising or analytics trackers.

Project analytics and your app users

If you enable Kembo Analytics for your app, you are typically the data controller for information about your end users, and Kembo acts as a processor on your behalf under the DPA. Kembo Analytics is designed to collect pseudonymous usage statistics only — not names, email addresses, or Kembo account IDs. When used as documented (including the privacy policy snippet in the Kembo dashboard), it does not use cookies and typically does not require a cookie consent banner under the ePrivacy rules. You should still include the provided snippet in your app's privacy policy and ensure you have a lawful basis (such as legitimate interest) where applicable. Kembo blocks common PII fields in custom event properties, applies k-anonymity in country breakdowns, deletes raw events after 12 months, and does not sell analytics data.

How we use information

We use collected information to:

  • provide, maintain, and secure the Kembo platform;
  • authenticate dashboard users and mobile app end users;
  • process subscriptions and billing;
  • respond to support requests and communicate service updates;
  • detect abuse, fraud, and security incidents;
  • comply with legal obligations.

Legal bases (EEA/UK)

Where GDPR applies, we rely on:

  • Contract — to provide the Services you sign up for;
  • Legitimate interests — to secure and improve Kembo, prevent abuse, and support customers, balanced against your rights;
  • Legal obligation — where we must retain or disclose data by law;
  • Consent — where required (for example certain marketing, if offered).

Customers who enable Kembo for their end users determine their own lawful basis as controllers.

Sharing

We do not sell personal information. We share data only with service providers that help us operate Kembo (such as hosting, email, and payment processors), when required by law, or to protect rights and safety. Sub-processor categories are described in the DPA.

Data retention

We retain information for as long as your account or project is active and as needed to comply with legal obligations, resolve disputes, and enforce agreements. Project analytics events are automatically deleted after 12 months. End-user deletion requests are handled as described on our Data Deletion page.

Your rights

Depending on your location, you may have rights to access, correct, delete, restrict, object to, or export your personal data, and to lodge a complaint with a supervisory authority. In the EU, you may contact your local data protection authority; in Slovenia, the Information Commissioner (Informacijski pooblaščenec). Contact us at contact@bytestronauts.com to exercise your rights.

If you are an end user of a third-party app that uses Kembo, contact that app's developer first; they are usually your controller. We will assist them as described in the DPA.

Security

We use technical and organizational measures appropriate to the risk, including encryption in transit, access controls, and monitoring. No method of transmission or storage is 100% secure.

International transfers

We may process data in the EEA and other countries. Where transfers require safeguards, we use appropriate mechanisms such as Standard Contractual Clauses or equivalent measures offered by our providers.

Children

Kembo is not directed at children under 16. Customers must not use Kembo to process children's data without appropriate consent and safeguards required by law.

Changes

We may update this policy by posting a revised version. Material changes will be communicated where practicable.

Contact

Questions about this policy? Email contact@bytestronauts.com. Business customers: see also our Terms of Service and DPA.