KINSONA PRIVACY POLICY

Last Updated: October 14, 2026

Kinsona ("Kinsona," "we," "us," or "our"), a company organized and operating under the laws of the State of Michigan, is committed to protecting your privacy. This Privacy Policy explains how we collect, use, process, share, and safeguard personal information when you access or use the Kinsona website, mobile experiences, and intermediary booking platform (collectively, the "Service").

Please read this policy thoroughly. By establishing an account, authenticating your identity, or executing a travel transaction via our platform, you acknowledge and consent to the data practice mechanics outlined herein.

1. DATA COLLECTION ARCHITECTURE

We collect personal information through several vectors depending on how you interact with our technology stack:

• ◆A. Information Provided Voluntarily: Kinsona collects essential information provided directly during platform deployment, account onboarding, and checkout funnels. This includes full user legal names, validated email contact strings, active telephone numbers, traveler names, and explicit payment confirmation credentials necessary to authorize the booking transaction.
• ◆B. Automated Log Metric Profiles: Every time a client reads, navigates, or scales the interface, the platform systematically captures standard operational log telemetry. This includes anonymized IP addresses, localized device profiling strings (operating systems, browser application engines, language profiles), cookies, and exact internal navigation interactions captured via our client-side analytics tools.
• ◆C. Third-Party Identity Federation (OAuth / SSO): If a member chooses to create an account or authenticate using single-sign-on (SSO) credentials through Google, Apple, or Microsoft, Kinsona requests and collects the minimal public access tokens authorized by that authentication provider (typically your primary email address and verified profile name string) to safely initialize your session.

2. HOW WE USE YOUR INFORMATION

Kinsona leverages your data strictly for legitimate business and operational functions, including:

• ◆Provisioning, operating, maintaining, and scaling the membership interface.
• ◆Executing and processing automated booking requests with travel and inventory providers.
• ◆Distributing itinerary confirmations, platform updates, and customer support communications.
• ◆Detecting, investigating, and preventing fraud, security breaches, system abuse, or the manipulation of promotional Vault credits.
• ◆Compiling anonymized, aggregated statistical telemetry to improve platform design and layout.

3. STRATEGIC DATA SHARING & STRUCTURAL SOVEREIGNTY

We do not sell your personal information to third parties for commercial or marketing purposes. We share data only through secure structural channels necessary to execute our core Service:

• ◆A. Operational Supplier Logistics Sharing: To properly lock down, clear, and authorize a physical reservation room, Kinsona transmits your necessary traveler information directly down to our global travel distribution and clearing partners and the target hotel property. These third-party entities handle data management according to their respective independent privacy terms.
• ◆B. Payment Processing Tokenization: Kinsona never records, processes, or archives raw credit card numbers or sensitive CVV security strings on its local project infrastructure or database wrappers. All transactions are securely offloaded onto independent payment standard processors (such as Stripe). Credit card transaction handling and refund mechanics are managed by our third-party billing infrastructure, acting as the Merchant of Record. Data communication is protected using encrypted token endpoints.
• ◆C. Public Social Asset Isolation: When a user engages the social sharing engine to publish their "Transparent Receipt" card, the application securely isolates the export function so that it targets only the specific cost-breakdown text blocks. Personal traveler data rows are completely blocked from entering the exported image matrix, preserving full privacy on the public web.
• ◆D. Legal and Corporate Requirements: We may disclose data if required by valid legal processes (subpoenas, court orders, or state auditing), or in connection with a corporate merger, asset acquisition, or structural sale of business operations.

4. DATA RETENTION SAFEGUARDS

Kinsona preserves active user transaction parameters and metadata tables only for the absolute minimal timeline window required to satisfy booking verification, accounting auditing records, fraud prevention tracking, and platform tax compliance procedures.

Upon receiving a valid account deletion request, Kinsona implements a 30-day operational grace period during which account records are isolated. Once this window expires and all pending itinerary processing is cleared, data elements are permanently wiped or securely anonymized from our live storage tables, unless an overriding legal transaction compliance mandate requires a longer holding window.

5. COMPLIANCE DECLARATIONS: EUROPEAN AND CALIFORNIA DATA RIGHTS

Under global and domestic privacy mandates, including the California Consumer Privacy Act/California Privacy Rights Act (CCPA/CPRA) and the General Data Protection Regulation (GDPR), users possess explicit individual data rights regardless of localized geographic constraints:

• ◆The Right of Access / To Know: The right to request a complete digital transcript of all personal information currently recorded inside our database layers, including the specific categories of data processed.
• ◆The Right to Erasure / Deletion: The right to request the absolute structural purging of all active personal data profiles and user records from our live storage tables, provided no overriding legal transaction compliance mandates block deletion.
• ◆The Right to Rectification: The right to instantly correct or update inaccurate information profiles via your personal account settings dashboard.
• ◆The Right to Opt-Out / Restrict Processing: The right to opt-out of marketing streams or restrict certain automation parameters (though this may impact booking functionality).

To exercise any of these individual structural data rights, users may issue a formalized request to our designated privacy desk at: privacy@kinsona.com.

6. DATA SECURITY AND TRANSFERS

We use commercially reasonable technical, physical, and organizational security measures to protect personal information, including end-to-end encrypted data transmission (SSL/TLS) and strict, role-based access controls to sensitive backend data. However, because no method of digital transmission or storage is 100% secure, we cannot guarantee absolute transactional invulnerability.

Your data is hosted and processed on secure cloud infrastructure located primarily within the United States. If you are accessing the service from the EU or other international jurisdictions, your data will be transferred to and processed within the US under appropriate standard contractual compliance frameworks.

7. CHILDREN'S PRIVACY

The Service is strictly restricted to individuals 18 years of age or older. Kinsona does not knowingly collect, harvest, or solicit personal information from children or minors under the age of 18. If we learn that a minor has bypassed access limits and submitted information, we will purge the account immediately.

8. CHANGES TO THIS POLICY

We may update this Privacy Policy dynamically as technical protocols or legal mandates shift. Material changes will be communicated transparently via prominent placement inside the platform interface or sent directly via the email address tied to your account. The "Last Updated" timestamp at the top of this document will reflect the latest structural revision.

9. CONTACT US

If you have questions, feedback, or compliance inquiries regarding this policy or our data architecture, you may contact us directly at: privacy@kinsona.com.