KYMS+ Privacy Policy

1. Who We Are

This Privacy Policy explains how the KYMS+ mobile application (“KYMS+” or the “App”) processes personal data.

The Data Controller is:

The Data Protection Officer (“DPO”) may be contacted at:

dpo@ideasolutions.it

2. Scope of This Policy

This Privacy Policy applies to KYMS+, an iOS application that allows users to store and manage files locally on their device and, if they choose to activate the relevant feature, synchronize encrypted copies of those files with the KYMS+ cloud service.

KYMS+ does not require users to provide their name, email address, telephone number or other direct identification details.

The App instead creates a pseudonymous Technical Profile, protected by a passcode and a Recovery Card.

3. Technical Profile, Passcode and Recovery Card

During onboarding, KYMS+ generates a unique technical identifier used to operate the App and, where activated, associate the user’s encrypted cloud space with the relevant Technical Profile.

The identifier is not associated by IdeaSolutions with the user’s name, email address or telephone number.

The passcode selected by the user is not received or retained by IdeaSolutions in intelligible form.

The user may sign in to their KYMS+ account (the Technical Profile) using their Account ID and password, including on another device or following reinstallation of the App. The Recovery Card is not required when these credentials are available.

KYMS+ also generates a Recovery Card. If the user does not have their Account ID or password, the Recovery Card allows them to recover access on their current device, on another device or following reinstallation of the App.

Recovering access does not restore files stored only on a previous device. On another device or following reinstallation, only cloud content that was successfully synchronized and remains available in the cloud can be retrieved.

IdeaSolutions does not retain a usable copy of the Recovery Card and cannot regenerate it, recover it or replace it. If the user cannot sign in using their Account ID and password and does not possess the Recovery Card, IdeaSolutions cannot restore access to the account or encrypted content.

Users may expressly enable Face ID or Touch ID within the App and configure the biometric access duration in the App’s settings. Biometric unlocking is available during the configured period, subject to device availability and the App’s authentication requirements. Once the period expires, the user must use their password; the App may also require it before expiry. Biometric data is processed by the iOS operating system and is not received or stored by IdeaSolutions.

4. Categories of Data Processed

Depending on how the App is used, KYMS+ may process the following categories of data.

4.1 Technical Profile data

• a unique pseudonymous identifier generated by the App;
• cloud plan and entitlement status;
• synchronization and service status;
• information necessary to restore access through the Recovery Card.

4.2 Cloud metadata

When cloud synchronization is activated, the system may process:

• number of files and folders;
• storage space used;
• file upload dates;
• synchronization status.

This metadata is linked only to the pseudonymous Technical Profile and is not associated by IdeaSolutions with the user’s name, email address or telephone number.

File names, file contents, folder contents and media stored by the user are end-to-end encrypted.

4.3 App, analytics and diagnostic data

KYMS+ uses Google Analytics for Firebase, Firebase Analytics, Firebase Crashlytics, Firebase Cloud Messaging, Firebase Remote Config, Firebase Performance Monitoring and Adjust.

These services may process limited technical and usage information, including:

• provider-generated app installation identifiers;
• device type and operating system information;
• App version and technical configuration;
• App launches, feature interactions and service events;
• performance, error and crash information;
• campaign measurement and installation attribution information;
• push-notification tokens.

KYMS+ does not use these services to display advertising, create advertising profiles or collect the Apple advertising identifier (IDFA).

Adjust is used only to measure campaigns and attribute App installations. Google and Adjust data are not combined by IdeaSolutions with names, email addresses or the contents stored within KYMS+.

Where required by Apple or applicable law, KYMS+ may display Apple’s App Tracking Transparency permission request. Refusing that permission does not prevent access to the App’s core local-storage functions.

4.4 Subscription data

Paid subscriptions are purchased and managed through the Apple App Store.

IdeaSolutions does not receive or store the user’s payment-card details. Apple may provide KYMS+ with limited purchase information, such as the selected plan, subscription status, renewal status and transaction or entitlement identifiers, where necessary to activate the purchased services.

Apple processes payment and App Store account information in accordance with its own terms and privacy policy.

4.5 Permissions and device information

KYMS+ may request access to specific iOS permissions only when necessary for a requested feature, including:

• photos and media library, for importing and exporting content;
• camera, for scanning documents and using Intruder Catch;
• location, where expressly enabled for Intruder Catch;
• notifications, for operational App notifications;
• Face ID or Touch ID, where expressly enabled by the user.

Permissions may be refused or revoked at any time from the iOS settings. Refusing a permission may prevent the related feature from operating but will not affect unrelated functions.

5. Local Archive

Files imported, created, downloaded or scanned by the user are initially stored in the local KYMS+ archive on the device.

IdeaSolutions cannot view, access, modify or recover locally stored files.

Unless cloud synchronization is expressly activated by the user, no copy of those files is transmitted to the KYMS+ cloud service.

The user is responsible for protecting the device, retaining the Recovery Card and maintaining any additional copies considered necessary.

The Reset and Technical Profile deletion functions permanently remove the relevant local files and App data. Once deleted, those files cannot be recovered by IdeaSolutions.

6. KYMS+ Cloud

Cloud synchronization is optional and must be expressly activated by the user.

The available cloud plans and storage limits are:

• Free: up to 500 MB;
• Lite: up to 2 GB;
• Core: up to 10 GB;
• Plus: up to 100 GB.

Core and Plus also provide access to premium features.

Cloud content is stored using Amazon Web Services infrastructure. The storage region is selected according to the country associated with the user’s App Store account in order to keep the data within an appropriate geographical area wherever operationally available.

All synchronized file contents are end-to-end encrypted. Encryption and decryption take place through credentials available to the user’s App and Recovery Card. Neither IdeaSolutions nor Amazon Web Services can decrypt or access the contents of the files.

IdeaSolutions can process only the limited cloud metadata described in Section 4.2.

KYMS+ does not create a separate recoverable backup of the encrypted cloud archive.

7. Intruder Catch

Intruder Catch is an optional premium feature available from the Core plan.

The feature is disabled by default and must be expressly activated by the user. If enabled, Intruder Catch may take a photograph following the first incorrect passcode attempt and record the date and time of the event.

If the user has granted location permission, the App may also record the device location when the incorrect passcode attempt occurs. KYMS+ does not use this feature for continuous location monitoring.

If location permission is not available, the photograph, date and time may still be recorded without location information.

Intruder Catch records remain exclusively within the local KYMS+ archive. They are not synchronized to the KYMS+ cloud and are not accessible to IdeaSolutions or external service providers.

The user may delete these records manually or by using the Reset function.

Users must activate and use Intruder Catch in compliance with applicable laws and the rights of any person who may be photographed.

8. Media Import, Scanner and Private Browser

Media imported through KYMS+ and documents created using the scanner are initially stored locally. They are synchronized only if the user places them within an archive for which cloud synchronization is active.

The private browser connects directly to the websites selected by the user. Browsing history, favorites, cookies and downloads managed by KYMS+ remain on the device and are not stored by IdeaSolutions.

IdeaSolutions does not receive the URLs visited, search queries or website contents. Third-party websites may independently process the user’s IP address, cookies and other browsing information under their own privacy policies.

9. Invite a Friend

The “Invite a Friend” feature allows the user to share a standard KYMS+ link through an external application selected by the user.

IdeaSolutions does not access the user’s address book, identify the recipient or receive the contents of the message. The external application used to send the invitation operates under its own privacy terms.

10. Purposes and Legal Bases

KYMS+ processes data for the following purposes:

Providing the App and cloud services

Technical Profile data, subscription status, cloud metadata and synchronization information are processed to provide the services requested by the user and perform the applicable contract.

Security and fraud prevention

Limited technical information is processed to protect the App, encrypted archives and cloud infrastructure and to prevent misuse or unauthorized access.

This processing is based on performance of the contract and the legitimate interests of IdeaSolutions in maintaining the security and integrity of the service.

Diagnostics and service improvement

Firebase diagnostics, crash and performance information may be used to identify errors, maintain compatibility, improve reliability and understand the use of App functions.

This processing is based on the legitimate interests of IdeaSolutions in maintaining and improving KYMS+. Where consent is required by applicable law, the processing will be based on that consent.

Campaign measurement and installation attribution

Adjust and Google Analytics may be used to measure the effectiveness of KYMS+ campaigns and attribute App installations without accessing the contents stored in the App.

This processing is based on the legitimate interests of IdeaSolutions in measuring and improving the distribution of KYMS+. Where consent is required by applicable law, the processing will be based on that consent.

Legal obligations and legal claims

Data may be processed where necessary to comply with applicable law, respond to lawful requests or establish, exercise or defend legal claims.

11. Recipients and Service Providers

Personal data may be processed by:

• Amazon Web Services, for encrypted cloud storage and infrastructure;
• Google and Firebase, for analytics, diagnostics, configuration, performance monitoring and push messaging;
• Adjust, for campaign measurement and installation attribution;
• Apple, for App Store distribution, subscriptions, payments, device permissions and push notifications;
• professional advisers, public authorities or courts, where required by law or necessary for legal claims.

IdeaSolutions does not sell personal data and does not provide KYMS+ file contents to advertisers.

12. International Processing

KYMS+ is distributed worldwide.

Encrypted cloud storage is assigned according to the country associated with the user’s App Store account. Technical, analytics, diagnostic, subscription and support providers may nevertheless process information in countries outside the user’s country of residence.

Where the GDPR applies and personal data is transferred outside the European Economic Area, the transfer will be based on an adequacy decision, appropriate contractual safeguards or another mechanism permitted by applicable data-protection law.

13. Retention and Deletion

Locally stored information remains on the device until deleted by the user, removed through the Reset or Technical Profile deletion function, or removed together with the App or device storage.

Cloud content remains available while the relevant cloud service is active.

When a paid subscription expires, a 15-day grace period begins. The existing cloud archive remains available for access and download during that period. After the grace period, the storage allowance of the plan available on the user’s Technical Profile applies. If no other valid paid plan is available, Free applies, with up to 500 MB of encrypted cloud storage. Expiry does not itself deactivate an active cloud service.

A downgrade to a lower cloud storage allowance also has a 15-day grace period, beginning on the effective date of the downgrade, during which the existing cloud archive remains available for access and download. After the applicable grace period, if the cloud archive exceeds the resulting limit, KYMS+ may remove cloud copies and their associated metadata only as necessary to bring the archive within that limit. The most recently uploaded files are removed first. This quota-based removal keeps the cloud service active and preserves copies already present on the device.

Removed cloud copies cannot be recovered by IdeaSolutions. A later subscription does not restore them.

Disabling automatic renewal alone does not reduce the current paid allowance before the paid period ends.

Deleting the Technical Profile permanently removes the related local data, cloud content and service metadata. Deleting the Technical Profile or the App does not automatically cancel an active Apple subscription.

KYMS+ does not retain a separate backup from which deleted cloud content can be recovered.

Analytics and diagnostic information is retained by the relevant providers for the period necessary to provide the applicable measurement, security and diagnostic services, subject to the provider configuration and applicable legal requirements.

14. Security

KYMS+ applies technical and organizational measures designed to protect the confidentiality and integrity of information, including:

• end-to-end encryption of cloud file contents;
• encrypted communications;
• pseudonymous technical identifiers;
• passcode protection;
• optional biometric access;
• separation between technical metadata and directly identifying information;
• irreversible deletion mechanisms.

No system can guarantee absolute security. Users remain responsible for securing their device, passcode and Recovery Card.

15. User Rights

Where the GDPR or equivalent laws apply, users may have the right to:

• obtain information about the processing of their personal data;
• request access, rectification or deletion;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive portable data where applicable;
• withdraw consent where processing is based on consent;
• lodge a complaint with a competent data-protection authority.

In Italy, complaints may be submitted to the Garante per la protezione dei dati personali.

Because KYMS+ does not collect names or email addresses and uses pseudonymous identifiers, IdeaSolutions may require the Technical Profile identifier or other appropriate information to locate the relevant data and verify the request.

Where IdeaSolutions cannot identify the user or associate provider-generated analytics information with a specific identifiable person, certain rights may not be technically exercisable unless the user supplies additional information enabling identification.

Requests may be sent to contacts@ideasolutions.it or dpo@ideasolutions.it.

Users may also delete local and cloud data directly through the functions available within the App.

16. Automated Decision-Making

KYMS+ does not use personal data to make decisions producing legal or similarly significant effects through solely automated processing.

17. Changes to This Privacy Policy

This Privacy Policy may be updated to reflect changes to KYMS+, its service providers or applicable law.

The current version will be made available within the App or through the official KYMS+ publication channel. Where required by law, additional notice or consent will be provided.

18. Contact Information

For questions about this Privacy Policy or the processing of personal data, contact: