Privacy Policy | Kumbengo

Kumbengo Inc.

Last Updated: August 3, 2026

1. WHO WE ARE

Kumbengo Inc. ("Kumbengo," "we," "our," "us") designs and sells audio plugins and related services through kumbengo.com. This Policy explains how we handle personal information across all of our products and services (collectively, the "Services"), which include two kinds of product:

- Local Plugins — plugin software you download and run locally on your device (for example, Afro-Percussion). These do not send your audio to our servers.
- Cloud/AI Services — plugins and features that connect to our servers to generate or process audio using AI (for example, Shaman). These send audio you submit to our servers for processing.

We are a Delaware, U.S. company and offer the Services to users worldwide. We are the controller of your personal information.

Contact: info@kumbengo.com · Kumbengo Inc., 16192 Coastal Highway, Lewes, DE 19958, USA

2. HOW WE COLLECT INFORMATION

We collect personal information when you:
- submit a form on the Site (contact, subscription, checkout, or support);
- complete a purchase;
- create or manage an account, or buy or use Credits;
- activate or update a Local Plugin (our license server receives device and activation data);
- use a Cloud/AI Service (you submit audio and prompts that are processed on our servers);
- interact with our emails; or
- browse the Site (cookies and similar technologies run as described in Section 8).

3. INFORMATION WE COLLECT AND WHY

Device & Site Usage — IP address, browser type, OS, referring pages, time zone, cookies, click-stream. Purpose: load and secure the Site, analytics. Lawful basis: legitimate interests. Retention: 24 months.

Account — username, email, hashed password, and account settings, held in our user-management system. Purpose: create and manage your account and access to the Services. Lawful basis: contract performance.

Retention: while your account is active, then deleted or anonymized (see Section 10).

Order & Billing — name, contact details, DAW, payment token (via our payment processor), Credit balance and purchase history, VAT/tax ID. Purpose: fulfill purchases, manage Credits, fraud screening, tax. Lawful basis: contract performance, legal obligation. Retention: 7 years for tax records.

Support — messages, attachments, session files, crash reports. Purpose: customer support and bug resolution. Lawful basis: legitimate interests; consent for any extra data you volunteer. Retention: 4 years.

License Telemetry (Local Plugins) — plugin ID, hashed machine ID, DAW and OS version, activation and crash logs. Purpose: enforce the EULA, prevent piracy, fix bugs. Lawful basis: legitimate interests, contract. Retention: duration of license + 3 years.

Cloud/AI Input & Output (e.g., Shaman) — the audio and prompts you submit, and the audio the Service generates. This content may contain personal information if you choose to include it (for example, a voice recording). Purpose: to process your request and return Output to you — and for no other purpose. Lawful basis: contract performance. Retention: deleted from our processing systems on completion of your request (see Sections 5 and 10). We do not use this content to train any AI model or to improve the Service.

Marketing Preferences — opt-in status and, where used, ad-tracking IDs. Purpose: send marketing (only with opt-in in the EEA/UK). Lawful basis: consent, legitimate interests. Retention: until consent is withdrawn or 2 years of inactivity.

We do not knowingly collect special-category data. Audio you submit to a Cloud/AI Service is processed only to deliver the Service to you and is deleted on completion; please do not submit audio containing sensitive personal information about others without their consent.

4. HOW YOUR AUDIO IS PROCESSED (CLOUD/AI SERVICES)

Because this matters, here is plainly how audio you submit to Shaman and other Cloud/AI Services is handled:

- When you generate, transform, inpaint, regenerate, or continue audio, your Input is sent from the plugin to our servers, which run on Modal (Modal Labs). Depending on capacity and routing, this processing may take place in the United States or in other countries where Modal operates.
- Our servers run the AI models (including models licensed from Stability AI and a text-encoder component from Google (Gemma)) within our own infrastructure and produce the Output, which is returned to you.
- Your Input and Output are not sent to Stability AI, to Google, or to any other third-party model provider.
- We do not use your Input or Output to train any model or to improve the Service.
- Your Input and Output are deleted from our processing systems once your request is completed and the Output is delivered to you. We do not retain a library of your generated audio on our servers.
- Once Output is delivered to and downloaded by you, we have no access to or control over the copies you keep on your own device.

Note that your account and Credit records (Section 3) are separate from this audio and are retained while your account is active, as described in Section 10.

5. HOW WE COMMUNICATE WITH YOU

We may contact you by email (and rarely by post) to confirm purchases and deliver license keys or Credits, respond to support, send critical service updates, and send marketing offers (only if you opted in). Marketing emails include an unsubscribe link.

6. HOW WE SHARE INFORMATION

We share personal information only with trusted providers who process it on our behalf, and only as needed to run the Services:

- Wix.com Ltd. — Site hosting, database, email, license server, and infrastructure.
- Wix Payments — secure payment processing.
- Wix email marketing — sending marketing and service emails.
- Modal (Modal Labs) — GPU compute that runs our Cloud/AI audio processing, in the United States or other countries where Modal operates.
- Supabase — user authentication and account/database management, hosted in the United States or other countries where Supabase operates.
- Google Analytics — website usage analytics. We also use Wix's built-in analytics.
- Google Ads and Meta Ads — we use, or may use, these for advertising; advertising cookies and data sharing for advertising occur only with your consent.
- Authorities or acquirers — where required by law or in connection with a business transfer.

We do not sell your personal information for monetary consideration, and we do not use your Cloud/AI Input or Output for advertising or model training. We only "share" data for advertising with your consent.

7. INTERNATIONAL TRANSFERS

We are based in the United States, and we and our service providers (including Wix, Modal, and Supabase) may process your personal information in the United States and in other countries where those providers operate. Because we do not restrict our providers to a single region, the specific country of processing may vary. Wherever your information is processed, the safeguards described below apply to it. If you use the Services from the EEA, the UK, or Switzerland, your information may be transferred to countries that do not provide the same level of protection as your home country. For such transfers we rely on appropriate safeguards, which may include our providers' certifications under the EU–U.S. Data Privacy Framework (and its UK Extension and Swiss–U.S. framework) and the European Commission's Standard Contractual Clauses (with the UK Addendum), together with any supplementary measures required. These safeguards are designed to apply to your information regardless of the specific country in which it is processed.

8. COOKIES & SIMILAR TECHNOLOGIES

We use:
- Essential cookies — core functionality, security, and login sessions.
- Analytics cookies — to understand and improve Site performance (Google Analytics and Wix analytics).
- Advertising cookies — set only with your consent, to support marketing (Google Ads, Meta Ads).

You can manage cookies through the Site's cookie controls and your browser settings. Third-party tools may set their own cookies governed by their privacy policies. We currently do not respond to Do Not Track signals.

9. AUTOMATED DECISION-MAKING

We use automated tools (such as fraud and abuse screening for purchases, Credits, and accounts) to protect the Services. If such a process produces a legal or similarly significant effect on you, you may request a manual review by contacting us.

10. RETENTION & DELETION

We keep personal information only as long as necessary for the purposes described, then delete or anonymize it. In particular: Cloud/AI Input and Output are deleted from our processing systems on completion of each request; account and Credit records are kept while your account is active and for a reasonable period afterward; tax records are kept for 7 years; and other categories follow the retention periods in Section 3. Backups are overwritten on a rolling cycle.

11. YOUR RIGHTS

Depending on your jurisdiction, you may have rights to access, correct, delete, or port your data; to object to or restrict certain processing; to withdraw consent; and to opt out of profiling or targeted advertising. These rights apply under the EU and UK GDPR, the Swiss nFADP, the California CPRA and other U.S. state privacy laws (such as Colorado, Virginia, Texas, and Oregon), and PIPEDA and Québec Law 25 in Canada. We honor core access, correction, and deletion requests from users regardless of thresholds, and we do not sell or share personal information for advertising without consent, or use it for targeted advertising without consent.

To exercise your rights, email info@kumbengo.com. We may need to verify your identity and will respond within the time required by law. You may also complain to your local data-protection authority; U.S. residents may contact the FTC at https://www.ftc.gov.

12. WITHDRAWING CONSENT OR DELETING DATA

You can withdraw consent at any time by using the unsubscribe link in emails, adjusting the cookie controls, or emailing info@kumbengo.com. We will verify your identity and respond within 30 days.

13. MINORS

The Services are intended for users who are at least 18 years old. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.

14. CHANGES TO THIS POLICY

We may update this Policy from time to time and will post the updated version with a new "Last Updated" date. For material changes, we will provide additional notice (for example, by email) where required.

15. ACCESSIBILITY

This Policy is available in accessible formats. Alternate formats are available on request.

16. CONTACT

Kumbengo Inc.
16192 Coastal Highway
Lewes, DE 19958, USA
info@kumbengo.com