Data Protection

Last updated: 2026-07-29

This page explains your rights over the personal data Kindryn holds about you, how to exercise them, and which third parties process that data. It sits alongside the Privacy Policy, which describes what is collected and why.

1. Who is responsible for your data

Kindryn is the data controller for data collected through this service, and engages the sub-processors listed below to deliver specific features. Where Kindryn provides the platform to another organisation running its own community, that organisation is the controller and Kindryn acts as a processor on its instructions.

2. Your rights

Wherever you live, the following are available to you. Under the UK/EU GDPR and comparable laws they are legal rights; elsewhere they are offered as a matter of policy.

Access. Get a copy of the personal data held about you.
Portability. Export your data in a machine-readable format — available self-serve from your account settings.
Rectification. Correct anything inaccurate, mostly editable directly in your profile.
Erasure. Delete your account and personal data. Also self-serve; see section 4 for what erasure does to content you posted.
Restriction. Ask that processing be limited while a dispute is resolved.
Objection. Object to processing based on legitimate interests, including any profiling.
Withdraw consent. Where processing relies on consent — notifications, optional integrations — withdraw it at any time without affecting what happened before.
Complain. Lodge a complaint with your local supervisory authority. You do not have to contact us first.

3. Exercising them

Export and deletion are available directly in your account settings and do not require anyone's approval. For anything else, contact Kindryn through the address published on the homepage or in your account settings. Requests are answered within one month; if a request is complex, you will be told inside that month and given a revised timeframe.

Verification is proportionate: normally being signed in to the account is enough. Additional proof is only requested where there is genuine doubt about who is asking.

4. What erasure actually does

Personal data — name, email, profile details, contact information — is always removed or irreversibly scrubbed. What happens to content you posted depends on the policy the community has chosen, because deleting one member's posts can make other members' conversations unreadable:

Full delete. Your content is deleted along with your account.
Blank content. Your posts remain as empty placeholders, keeping surrounding threads coherent.
Anonymise. Your content remains, attributed to a removed member rather than to you.

In every case your identity is severed from the content. Records we are legally required to keep — such as financial transaction records for tax purposes — are retained for the period the law requires and no longer.

5. Sub-processors

These third parties may process personal data depending on which features Kindryn has enabled. A processor not listed here is not in use.

Processor	Purpose	Data shared
Stripe	Payments	Name, email, payment details (held by Stripe, not in our database)
LiveKit	Video rooms — gatherings, coaching, calls, livestreams	Display name, audio/video streams
Zoom	Optional meeting delivery + attendance	Name, email, attendance
Email provider	Transactional + notification email	Name, email
Twilio	Optional SMS notifications	Phone number, message content
Object storage	Uploaded media — avatars, attachments, recordings	Any content you upload
Meilisearch	Full-text search	Indexed post + profile content
Mapbox	Geocoding a chosen city to a map location	City name only — never device GPS
Sentry	Error and crash reporting	Account id, page or route, technical error detail — never message content

6. International transfers

Some sub-processors operate outside your country. Where data leaves the UK/EEA it is transferred under Standard Contractual Clauses or an equivalent approved mechanism.

7. Retention

Data is kept while your account is active and for as long as needed for the purposes in the Privacy Policy. After account deletion, personal data is removed promptly except where a legal obligation requires retention.

8. Security incidents

If a personal-data breach occurs that is likely to result in a risk to your rights, the relevant supervisory authority is notified within 72 hours of it becoming known, and affected members are told directly where the risk is high.