Your ride belongs to you.

1. Scope and data controller

This policy applies to kukirin.app, the KuKirin Dash web application, its purchase and license-delivery services, and related support features. KuKirin Dash is operated by Kelixo from Malta. For privacy questions or requests, contact dash@kukirin.app.

In this policy, “we”, “us”, and “KuKirin Dash” refer to the operator of KuKirin Dash. “You” refers to a visitor, buyer, license holder, or rider using the service.

2. Data we handle

We do not intentionally collect payment-card details. MoneyMotion processes payment credentials on its hosted checkout. We do not request special-category personal data.

3. Why we use data

Contract and steps requested before purchase

We process the buyer email, order, payment status, license assignment, activation information, and delivery records to sell and provide KuKirin Dash, deliver lifetime access, verify licenses, provide updates, and respond to purchase support.

Legitimate interests

We process limited security and service information to prevent fraud and duplicate license allocation, secure the application, diagnose failed purchases, count aggregate usage, maintain records of supporter status, and defend legal claims. We use the least data reasonably needed and do not use these records for behavioural advertising.

Consent

Where required, your permission is used for precise geolocation, motion, and orientation sensors. Optional Smart Range community sharing is off by default. You may withdraw optional permission in Settings or your browser/device settings. Withdrawal does not affect earlier lawful processing.

Legal obligations

We may retain or disclose transaction information when necessary to comply with tax, accounting, consumer-protection, law-enforcement, or other applicable legal obligations.

KuKirin Dash does not make decisions producing legal or similarly significant effects about you solely through automated processing. Automated checks may reject an invalid license, suspicious request, or incomplete payment, but support can review genuine access or delivery problems.

4. What stays on your device

Detailed trips are stored locally in the browser database named kukirin-dashboard. This can include route coordinates, timestamps, sensor readings, weather snapshots, scooter telemetry, detected ride events, launch timing, trip names, and notes.

• There is no mandatory KuKirin Dash cloud account for ride history.
• Deleting a trip removes it from the app's local database on that browser.
• Clearing site data can delete trips, settings, the local installation identifier, and browser access.
• Exports are created locally and become files under your control.
• Bluetooth commands and normal controller telemetry are handled locally between the browser, Bluetooth layer, and scooter.

If you enable anonymous Smart Range sharing, the app describes the proposed summary before sharing. It excludes route coordinates, route shape, exact location, trip name, exact timestamp, email, license key, and persistent device identifier. At the date of this policy, detailed ride uploads are not part of normal operation.

5. Providers and data transfers

We use specialist providers only where needed to operate the service:

• Vercel hosts the website and server functions and may process standard request logs such as IP address, time, path, and browser information.
• MoneyMotion hosts checkout and processes payment information. KuKirin Dash receives payment status and transaction identifiers, not full card credentials.
• KeyAuth verifies license keys during activation. The raw key is sent server-to-server for verification and is not saved in browser-readable storage by KuKirin Dash.
• Upstash provides server-side storage for orders, license assignments, supporter profiles, aggregate metrics, and administrative records.
• Resend delivers license and purchase emails and processes recipient address, message contents, and delivery metadata.
• Open-Meteo receives current latitude and longitude when weather is requested while GPS is active. Weather results are cached in the app for about 12 minutes.
• Waze receives map parameters, including location when its embedded live map is used.
• OpenStreetMap tile servers receive normal web requests, including IP address and requested map tiles, when a saved trip route map is displayed.
• Beacio, where used on iPhone, provides the Safari Bluetooth bridge under its own terms and privacy practices.

Some providers may process data outside Malta or the European Economic Area. Where GDPR applies, transfers must rely on an adequacy decision, contractual safeguards such as Standard Contractual Clauses, or another lawful transfer mechanism. Provider privacy terms may also apply directly to your use of their service.

We do not sell or rent personal data. We may disclose information where required by law, to protect users or the service, or in connection with a lawful business transfer with appropriate safeguards.

6. How long data is kept

• Pending checkout records: normally up to 2 days.
• Completed operational order records: normally up to 30 days in active order storage. Necessary supporter, license-assignment, email, and transaction evidence may be retained longer for lifetime access, support, fraud prevention, accounting, or legal obligations.
• Supporter profile and license fingerprint: retained while lifetime access and supporter status remain active, or until a valid deletion request where retention is not legally or operationally required.
• Purchase IP and browser information: retained with the supporter/support record only as long as reasonably necessary for payment support, abuse prevention, and claims, then deleted or anonymised where feasible.
• Active-user measurement: the server-side active-session entry expires from the active count after approximately 10 minutes; only aggregate counters may remain.
• Aggregate page and checkout counts: may be retained without a fixed expiry because they do not contain route data, email, or raw license keys.
• Entitlement cookie: expires after approximately 400 days unless renewed, cleared, or you sign out.
• Local trips and preferences: remain until you delete them or clear browser/site data.
• Support communications and legal records: retained only as long as needed for the request, contractual history, applicable limitation periods, or legal duties.

When a fixed period is not possible, we use necessity, the lifetime-access relationship, security risk, legal obligations, and limitation periods to determine retention.

7. Cookies and browser storage

KuKirin Dash uses a strictly necessary HttpOnly entitlement cookie to remember that a browser has valid access. It is Secure in production and SameSite=Lax. JavaScript cannot read the raw cookie, and the cookie does not contain the raw license key.

LocalStorage is used for settings such as theme, unit, dashboard visibility, rider profile inputs, sensor choices, remembered mode locks, optional sharing preference, random installation ID, and anonymous session value. IndexedDB stores trips and samples. SessionStorage prevents duplicate page-view counting in one browsing session.

We do not use third-party advertising cookies or cross-site advertising trackers. Browser storage is necessary for core app operation and local-first features; blocking it may prevent access persistence, settings, or trip history from working.

8. Your privacy rights

Depending on your location, including under the GDPR, you may have rights to:

• access personal data held about you and receive a copy;
• correct inaccurate or incomplete information;
• request deletion where no lawful reason requires continued retention;
• restrict processing in certain circumstances;
• object to processing based on legitimate interests;
• receive certain data in a portable format where applicable;
• withdraw consent for optional processing at any time; and
• lodge a complaint with a supervisory authority.

To exercise a right, email dash@kukirin.app from the purchase/contact address where possible. We may ask for limited information to verify that the request concerns your record. We normally respond within one month, subject to lawful extensions.

You may complain to Malta's Information and Data Protection Commissioner (IDPC), or to the supervisory authority where you live or work. Exercising privacy rights is free unless a request is manifestly unfounded or excessive.

9. Security

We use HTTPS, restricted server-side secrets, signed HttpOnly entitlements, same-site request checks, license fingerprints, idempotent payment fulfillment, access controls, and rate limiting where configured. Detailed trips remain local by design, reducing the amount of route data held centrally.

No internet service or storage system is completely secure. Keep your license key private, secure access to your email and device, and contact us promptly if you believe your access or personal data has been compromised.

10. Children's privacy

KuKirin Dash is not directed to children under 16 and is intended for riders legally permitted to use the relevant scooter and payment method. We do not knowingly collect children's personal data. A parent or guardian who believes a child provided personal data should contact us so the record can be reviewed and deleted where appropriate.

11. Changes to this policy

We may update this policy when features, providers, law, or data practices change. The current version will remain available at kukirin.app/privacy with a revised effective date. Material changes may also be highlighted in the app or purchase flow.

12. Contact

For privacy questions, data requests, or concerns:

KuKirin Dash / Kelixo
Malta
dash@kukirin.app