Kiuwo Privacy Policy

Last updated: 10 September 2026

1) Data controller

The data controller is Mea World S.r.l. — Registered office: Via Niccolò Machiavelli, 24 – 51100 Pistoia (PT), Italy. VAT / Tax Code: 02069030472.

2) Types of data processed

a) Identification and contact data

first and last name (if requested)
email address

b) Authentication data

credentials or access tokens
system-generated access and security logs

c) Payment data (Stripe)

transaction information
payment outcomes (we do not process or store card data — PAN/CVV; Stripe is an independent controller)

d) User-generated content (UCG)

maps, nodes, text, links
attached files
audio and transcripts
any associated comments and metadata

e) Platform usage data

application events
telemetry, errors, performance
page views, clicks, internal navigation

f) Device and network data

IP address
user-agent
device, operating system and browser information

g) Cookies and similar technologies

necessary technical cookies and technologies
statistical tools, usage analytics and session recording tools, subject to prior consent where required
advertising and marketing measurement technologies, activated with the User’s consent

session replay and in-app behavior analysis tools
geolocation
microphone access for voice features

i) Content published in the Public Library (opt-in)

content the User expressly chooses to make public (maps, nodes, text)

j) Organization Plan data

organization name, invited email address, role and membership status
information about licenses, credits and resource consumption
association of Content with the organization under the terms accepted by the User

3) Processing purposes and legal bases

a) Authentication and account management

Purpose: authentication and account management
Legal basis: contract (Art. 6(1)(b))
Data: identification, authentication

b) Use of platform features

Purpose: provision of the service (maps, nodes, content, AI/voice features)
Legal basis: contract (Art. 6(1)(b))
Data: UCG, technical data, identification data

c) Security and abuse prevention

Purpose: security, integrity, abuse prevention, technical logging
Legal basis: legitimate interest (Art. 6(1)(f))
Data: technical, security, device data

d) Service improvement and development of new features

Purpose: technical diagnostics, measurement of operation and consumption, usage analysis, product improvement and development of new features
Legal basis: legitimate interest (Art. 6(1)(f)) — see internal LIA assessment
Data: application events, technical data and usage metrics, which may be associated with the account where necessary; data is aggregated or pseudonymized where possible

e) Analytics and session analysis

Purpose: understanding platform usage through statistical technologies and, where activated, session recordings
Legal basis: consent (Art. 6(1)(a))
Data: usage events, technical or account identifiers, device data and session recordings; these tools are not activated before consent, except for components initialized in a limited mode with storage denied

f) Payments

Purpose: payment management and tax obligations
Legal basis: contract + legal obligation
Data: transaction data (via Stripe)

g) Service communications

Purpose: sending technical and service emails
Legal basis: contract
Data: identification, authentication

Purpose: voice/microphone, geolocation, heatmaps
Legal basis: consent (Art. 6(1)(a))
Data: audio, transcripts, behavior, location, technical data

i) Public Library (opt-in)

Purpose: publication and promotion of content that the User expressly chooses to make public (see Art. 9 of the Terms)
Legal basis: consent (Art. 6(1)(a)); the User may revoke publication of content that can still be associated with them
Data: published content

j) Organization Plan management

Purpose: management of invitations, membership, licenses, consumption and administrative operations provided for in the Terms
Legal basis: contract (Art. 6(1)(b))
Data: identification data, role, membership status, consumption and association of Content with the organization

4) Automated decision-making and profiling

We do not carry out automated decision-making that produces legal effects or similarly significantly affects the User within the meaning of Art. 22 GDPR. We do not carry out profiling for marketing purposes without the User’s explicit consent, in accordance with Art. 2.1 of the Terms.

5) Recipients and providers

To provide the Service, we may disclose data to providers in the following categories:

hosting, databases, authentication and storage;
AI processing, transcription, OCR and document processing;
analytics and session recording, subject to prior consent where required;
sending emails and service communications;
security, abuse prevention and authentication;
payment, subscription and consumption management;
advertising and marketing measurement, exclusively in accordance with the User’s consent preferences.

Providers acting on our behalf are appointed as data processors under Art. 28 GDPR, where applicable. Payment providers may act as independent controllers for obligations within their remit; Kiuwo does not store complete card details.

Some providers may process data outside the European Economic Area. In these cases, transfers are based on an adequacy decision, Standard Contractual Clauses (SCCs) or another safeguard provided for by the GDPR. The User may request an up-to-date list of recipients and information on the safeguards applied.

We do not transfer data to third parties for their own commercial purposes.

6) Data retention periods

We retain personal data for as long as necessary for the stated purposes, taking into account the duration of the account, operational and security needs, the exercise or defense of rights and legal obligations. Technical copies and backups are deleted according to the cycles of the systems and providers used.

a) Account data and content (maps, nodes, files, audio and transcripts)

Retained for as long as the User maintains the account or until the individual content is deleted
Upon account deletion, deleted or made no longer directly attributable to the User, subject to legal obligations, abuse prevention and temporary technical copies
Database backups follow a standard technical cycle of 7 days

b) Technical and security logs

Standard security and access logs are retained for a maximum of 90 days
In the event of incidents, legal obligations or defense needs, relevant data may be retained longer for as long as necessary; it is subsequently deleted, aggregated or made no longer directly attributable to the User

c) Usage and analytics data

First-party events associated with the account for diagnostics and improvement are retained in identifiable form for a maximum of 12 months; they are subsequently deleted, aggregated or made no longer directly attributable to the User
Events from consent-based analytics tools may be retained for up to 7 years according to the configuration of the service used
Session Replay recordings are retained for 30 days
Tools subject to consent are used according to the preferences expressed by the User

d) Original audio

Audio saved as User content is retained until it is deleted or the account is deleted
Temporary and incomplete audio uploads are deleted after 24 hours of inactivity
Transcripts follow the retention periods for account content

e) Payment data

Data required for tax and accounting obligations is retained for 10 years

f) Technical emails and service communications

Email delivery service logs may be retained for 30 days
Contact data and attributes necessary for communications are retained for as long as the account is active or for a different period required by the purpose, legal obligations or the exercise of rights

7) Data subject rights

You have the right to:

access
rectification
erasure
restriction
object to processing based on legitimate interest
portability
withdraw consent, including for analytics, Session Replay and marketing tools
lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it)

How to exercise your rights: Email: kiuwo@meaworld.com — Response within 30 days (extendable to 60 in complex cases).

8) Cookies and similar technologies

Necessary technical technologies

These are used automatically for:

platform operation;
session management;
authentication and security;
storage of consent preferences.

Analytics and Session Replay

With prior consent, Kiuwo may use technologies to measure platform usage and record interactions during a session. These tools may process navigation events, technical or account identifiers and device information. Recordings are retained for 30 days.

Advertising and marketing technologies

With prior consent, Kiuwo may use technologies to measure advertising campaigns and marketing activities. Some components may be initialized before the User’s choice in a limited mode, with advertising and analytics storage set to denied until consent is given.

Managing preferences

The User may:

accept all tools;
reject non-essential tools;
choose categories through the consent panel;
change or withdraw preferences at any time.

The up-to-date list of technologies used and their respective preferences is available in the consent management panel.

9) Security measures

We adopt appropriate and proportionate technical and organizational measures, including:

encryption of communications through HTTPS/TLS;
encryption of data stored on the systems used;
restriction of administrative access to authorized personnel;
measures aimed at ensuring data confidentiality, integrity and availability.

10) Changes to this policy

We may update this policy for legal, technical or organizational reasons, including material changes relating to providers, transfers, retention periods or security measures. In the event of material changes, we will inform users through the platform or direct communication. The updated policy is always available on this page.

11) Contact details

For information or requests relating to your personal data: Mea World S.r.l. — Email: kiuwo@meaworld.com