State privacy rights, in one place.

Depending on your state and applicable law, you may request confirmation of processing; access, correction, or deletion of eligible personal information; a portable copy; information about recipients; withdrawal of consent; or an appeal. Kulaya may offer a request method even when a particular law does not apply; doing so does not concede that the law covers Kulaya or a specific request.

Kulaya does not currently sell personal data, share it for cross-context behavioral advertising, use personal data for targeted advertising, or profile people to make decisions producing legal or similarly significant effects. Kulaya does not offer a financial incentive for personal data.

Email support@kulaya.app with the subject “U.S. privacy request.” Include the Kulaya account email, the state of residence, the right requested, and enough detail to locate the information. Do not email health records, passwords, or government identity documents unless we specifically provide a secure verification method.

We verify identity and authority using information reasonably related to the request. An authorized agent may submit a request where state law permits it. We can ask for signed authorization and may verify the request directly with the consumer. A parent or legal guardian may exercise rights for a child as allowed by law.

We respond without charge within the period and from the starting date required by applicable law. We may verify identity and authority before fulfilling the request. Where permitted, we can extend the response and will explain the reason and duration. Manifestly unfounded, excessive, or repetitive requests may be denied or charged only as the applicable law permits.

If we deny or do not act on a request, you may appeal by emailing support@kulaya.app with the subject “Privacy appeal.” Identify the original request and explain why the decision should be reconsidered. We will respond within the period required by the law that applies; those periods are not identical in every state.

If we deny an appeal, we will explain the reason and provide information about contacting the applicable state attorney general or regulator where required.

The categories of personal information collected, sources, purposes, and recipient categories are described in the main Privacy Policy. They can include identifiers, family and relationship information, internet or device activity, location or schedule information, user content, school information, health and nutrition information, inferences, and sensitive personal information a family chooses to provide.

Kulaya does not sell personal information or share it for cross-context behavioral advertising. We do not use sensitive personal information to infer characteristics for advertising. We do not offer a financial incentive or price difference in exchange for personal information.

Kulaya does not track users across unaffiliated websites for advertising. A browser “Do Not Track” signal therefore does not change our current practices. Kulaya does not currently sell, share for cross-context behavioral advertising, or conduct targeted advertising, so a Global Privacy Control or similar opt-out signal does not correspond to any such processing today. If Kulaya begins processing covered by an opt-out preference signal, it must recognize qualifying signals as required before that processing begins.

A registered user under 18 may request removal of content the user posted through the Service and made visible to another user where California law applies. The content need not have been visible to the public. Removal does not guarantee complete erasure where another user copied the content, law requires retention, or a statutory exception applies.

If the California Consumer Privacy Act applies to Kulaya in the future, eligible California residents may exercise its rights to know, access, correct, delete, and obtain information about disclosures, without discriminatory treatment. Kulaya will update this notice before beginning a sale, sharing for cross-context behavioral advertising, or a covered financial-incentive program.

California's Confidentiality of Medical Information Act can apply to certain direct-to-consumer apps designed to maintain medical information. To the extent it applies to a Kulaya health feature, the applicable confidentiality and authorization rules apply in addition to our Consumer Health Data Privacy Policy.

Residents and other people protected by the Washington My Health My Data Act or Nevada's consumer health data law should review the separate Consumer Health Data Privacy Policy. It identifies the categories and sources of consumer health data, purposes, categories shared, recipients, consent and withdrawal process, access and deletion rights, and appeal process.

Kulaya does not sell consumer health data and does not use a geofence around an entity that provides in- person health care services to identify, track, collect data from, or send messages concerning a person.

Connecticut residents may request access, correction, deletion, and portability, and may appeal a denial. The Connecticut Data Privacy Act can require affirmative consent before sensitive-data processing. Sensitive data can include consumer health data and personal data of a person Kulaya knows or willfully disregards is a child. General acceptance of the Terms or Privacy Policy is not that consent. Kulaya does not yet provide a complete state-specific sensitive-data consent ledger, so affected Connecticut processing is a launch blocker until the required choice can be obtained and recorded.

Kulaya does not sell a minor's data or process it for targeted advertising. Kulaya does not use design features intended to significantly increase or prolong a minor's use. Kulaya does not currently collect device-derived precise geolocation. A future feature must not collect it from a minor unless it is strictly necessary to a requested feature and the required indicator, consent, and controls are provided.

Kulaya knows the age or age band of a person when an authorized family member provides it. We carry that knowledge across the same account and family service rather than treating the person as an adult on a different screen.

For a New York user under 13, verifiable parental consent is required before collecting personal information online from the child unless COPPA permits the collection without prior parental consent. For a New York user age 13 through 17, informed consent is required for processing that is not strictly necessary for a purpose enumerated by the Act. Kulaya does not use minor data for targeted advertising or sale. Limited first-party product-interaction records can be used for security, reliability, and to determine whether important flows work, as described in the main Privacy Policy and as permitted by law.

Colorado law requires reasonable care to avoid heightened risks of harm to minors and can require consent, data minimization, limits on secondary use and retention, and a child-focused data protection assessment. The assessment and any required controls are product launch requirements for a feature presenting those risks to a Colorado minor. Kulaya does not use minor data for targeted advertising, sale, or covered high-impact profiling.

The Arkansas Children and Teens' Online Privacy Protection Act took effect July 1, 2026. It applies to covered services directed to children or teens, or when an operator has actual knowledge that it collects their personal information. The Act defines a child as age 12 or younger and a teen as age 13 through 16.

The Act requires clear notice; consent for covered collection, use, or disclosure, including verifiable parental consent for a child and the teen-consent process specified by the Act; access, correction, and deletion opportunities, reasonable security, collection consistent with the requested service or another permitted purpose, retention no longer than reasonably necessary, and no targeted advertising using a child's or teen's personal information. Kulaya does not yet provide the complete age, consent, rights, and retention controls needed for direct Arkansas child or teen use, so that use is a launch blocker until those controls are implemented and verified.

Montana's protections for known minors can apply without the ordinary consumer-count thresholds. They require reasonable care and can require consent, limits on undisclosed secondary purposes, unnecessary retention, targeted advertising, sale, certain profiling, design choices that create a substantial risk of harm, and unnecessary precise geolocation. A child-focused assessment is required for covered processing that presents a heightened risk of harm. The required assessment and controls are product launch requirements for that feature.

Vermont's Age-Appropriate Design Code is scheduled to take effect January 1, 2027 and, when Kulaya is a covered business, requires high-privacy defaults, feature-level transparency, data minimization, age-assurance protections, and safeguards against specified harms for covered minors. Vermont's broader Data Privacy and Online Surveillance Act is scheduled to take effect January 1, 2028; its consumer-health provisions can apply to consumer health data controllers without ordinary processing thresholds.

If the New Jersey Data Privacy Act applies, New Jersey residents may request confirmation, access, correction, deletion, and portability and may appeal a refusal. Kulaya does not sell personal data, use it for targeted advertising, or perform covered profiling. Kulaya will recognize an applicable universal opt-out signal if those practices change.

Sensitive information, including health information and information about a known child, requires the consent or other authority specified by applicable law. General acceptance of this addendum does not replace a separate consent where New Jersey law requires one.

Delaware's Online Privacy and Protection Act requires a conspicuous policy describing the categories collected, the categories of recipients, the process for reviewing or changing information if offered, how material changes are announced, the effective date, and how Kulaya responds to browser tracking signals. Those disclosures appear in this notice set and the main Privacy Policy.

For Rhode Island website-notice purposes, Kulaya is the controller identified in this notice and can be contacted through the Contact section. Kulaya does not sell personally identifiable information.

Depending on coverage thresholds and exemptions, residents of Colorado, Delaware, Iowa, Indiana, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and other states may have rights to confirm processing, access, correct, delete, obtain a portable copy, opt out of certain sale, targeted advertising, or profiling, withdraw consent, and appeal.

Maryland and other states can impose stricter data minimization for sensitive data. A covered feature must be reviewed against the minimization standard that applies before launch; a broad disclosure in this addendum does not authorize unnecessary collection. State-specific exceptions, response periods, verification requirements, and coverage thresholds still apply.

Kulaya does not create or use a faceprint, voiceprint, or other biometric identifier from an ordinary family photo or voice transcript for identification or authentication. If a future feature creates or uses a biometric identifier, Kulaya must provide the notice, consent, retention schedule, security, and deletion required by applicable state biometric laws before that feature launches.

Kulaya is currently offered directly to families. If a school or district later supplies student records or uses Kulaya under a school agreement, a separate school privacy notice and contract will be required before that institutional use begins.