Privacy policy

Who we are (data controller)

Kawni is run by [Company legal name], a company registered in the Kingdom of Bahrain (CR [number]), at [address]. We are the data controller for account and billing data.

For what a studio puts into Kawni (its clients', crew's and projects' data), the studio is the data controller. We process that data only on the studio's behalf and on its instructions.

What we collect

• Account data: name, email, password (hashed) and studio name.
• Billing data: plan and payment history. Card details are held by the payment provider, not by us.
• Studio content: quotes, projects, shot lists, call sheets, boards, crew, money and files.
• Usage and security data: sign-ins, IP address, browser type and the change history.
• AI copilot messages: what you send it and its answers, only when you use it.

Why we use it, and the legal basis

• To run the service and your account: performing our contract with you.
• Billing and receipts: performing the contract, and our legal duty to keep records.
• Security, fraud prevention and fixing faults: our legitimate interest in a safe, working service.
• Service and support messages: performing the contract.
• Marketing emails: only with your consent, which you can withdraw at any time.
• Complying with the law and lawful requests: legal obligation.

Sensitive data

We do not ask for sensitive data (such as health, religion or ethnic origin). Studios should only add it when needed and with their own legal basis.

Who processes data for us, and transfers outside Bahrain

We use processors that act on our instructions under contracts that require them to protect the data. Some are outside Bahrain, so data is transferred under the PDPL's rules for transfers outside the Kingdom: to countries with adequate protection, with contractual safeguards, or with the Personal Data Protection Authority's authorization where required.

• Vercel Inc.: Hosting: runs the app and serves its pages. Servers in Mumbai, India; global network; company in the USA.
• Turso (ChiselStrike Inc.): Databases: one database for each studio. Mumbai, India (AWS ap-south-1).
• Cloudflare, Inc. (R2): File storage: uploads, board files, logos and receipts. Cloudflare's storage regions [region to confirm].
• MyFatoorah: Payments: card details and subscription charges. We never see full card numbers. Kuwait and GCC.
• Google LLC (Gemini API): The AI copilot: only what a user sends it while using it. USA and Google's global data centers.

How long we keep it

• Studio data: for as long as the subscription runs.
• After a studio is deleted: 30 days in which it can be restored by contacting support, then its database is deleted for good.
• Backups: up to [number] days after that.
• Billing records: as long as Bahraini law requires [period to confirm].
• Security logs: up to [number] days.

Your rights

You have the right to access, correct and delete your data, to object to its processing, and to withdraw consent at any time. A studio owner can do this in Settings, Account: download the studio's data, or delete the studio. For anything else, write to us at the address below. We answer within [number] days.

You can also complain to the Personal Data Protection Authority of the Kingdom of Bahrain.

Security

Passwords are hashed, connections are encrypted, each studio has its own database, and database keys are stored encrypted.

Children

Kawni is for businesses and not for anyone under 18.

Changes

We tell studio owners about any material change a reasonable time before it applies.

Contact

Privacy: [privacy email]. Post: [postal address].