Privacy Policy

KinMol is a platform that businesses (our customers) use to sell, keep their books and run their premises. Through them it is also used by their staff, and by their own customers when a business offers customer accounts, membership or ordering from a table.

A business that uses KinMol is the data controller for the records it enters about its staff and its customers; KinMol processes that data on the business’s behalf. Our Data Processing Agreement sets out the terms of that relationship. For your own KinMol account, and for the sign-in itself, KinMol is the data controller.

What is collected depends on your role and on which modules a business has switched on.

• To provide KinMol: selling, invoicing, books and VAT, bookings, ordering, staff, customers, websites and email, as each business has switched them on
• To sign you in and enforce roles, so each person sees only what their role allows
• To check a business's identity before it can publish a public website, take online payments or send email from its own domain
• To send the messages you or a business have asked for, such as receipts, invitations and reminders
• To power NEX, our AI assistant, within the data your role can already see (see section 7)
• To measure usage that is charged for, such as AI messages and generated images
• To keep KinMol reliable and secure, and to comply with the law

We do not sell personal information, and we do not use it for advertising.

KinMol uses Supabase Authentication for sign-in. Passwords are stored only as hashes, and sessions use secure, time-limited tokens. KinMol shares its sign-in system with Firfirey, the travel site from the same company: the same email and password work on both. Deleting your KinMol account does not delete your sign-in unless you ask for that too (see Account Deletion).

• Records are stored in a managed PostgreSQL database provided by Supabase, protected by row-level security that enforces the same roles used throughout KinMol. One business can never read another's records
• Files, such as photos, documents and generated PDFs, are stored in access-controlled storage and delivered only through short-lived signed links
• Hosted mailboxes are stored on a mail server operated by Nepfex Innovations Pvt. Ltd.
• Backups are automated and encrypted

When a business takes an online payment, the money goes through the business’s own gateway account (such as eSewa, Khalti or Fonepay) to the business. KinMol records the payment in the business’s books only after confirming it directly with the gateway. KinMol does not hold the business’s or its customers’ money.

NEX drafts replies, reads bills and answers questions about a business. It works only within the data your role can already see. To produce an answer, the relevant text, and any image you choose to send, is sent to our AI provider, Anthropic, which processes it on our behalf under its commercial terms. Your data is not used to train or fine-tune any AI model. When you ask NEX to make a menu photo, the dish name and description are sent to NVIDIA for that purpose only. Enhancing a photo you took happens on KinMol’s own servers and is not sent to anyone. Anything NEX proposes that would change records or send a message needs a person’s confirmation first.

We share personal data only with providers that help us run KinMol, and only as much as each needs:

• Supabase: database and sign-in
• Google: application hosting (Google Cloud), and Google sign-in where you choose it
• Amazon Web Services: email delivery (Amazon SES) and file storage (Amazon S3)
• Anthropic: the AI models behind NEX
• NVIDIA: making a menu photo when you ask NEX to; only the dish name and description are sent
• eSewa, Khalti and Fonepay: payment gateways, using each business's own merchant account; we receive the payment reference and status only
• Couriers a business chooses to send a parcel with (such as Nepal Can Move or Pathao), using the business's own courier account: the recipient's name, phone, delivery address and any amount to collect, for that delivery only
• A provider added for a new feature, such as connecting custom domains, will be listed here before that feature is switched on

• Encryption in transit: all traffic uses TLS
• Encryption at rest: databases and file storage are encrypted by our infrastructure providers
• Access control: row-level security and role-based permissions limit every query to what that account may see
• Least-privilege administration: our own access to production data is limited to what is needed, and recorded in an audit log that cannot be edited

We keep data while a business uses KinMol, plus a limited period afterwards for account recovery and to meet legal obligations. Tax invoices, the books and payment records are kept for as long as Nepal’s tax and accounting law requires a business to keep them, even if a person connected to them deletes their account. In that case they are kept in a form that no longer identifies the person, except to those entitled to it.

Subject to applicable law, you have the right to:

• Access the personal data we hold about you
• Have inaccurate or incomplete data corrected
• Have your data deleted, subject to section 10
• Object to or restrict certain processing
• Receive a copy of your data in a portable format

Because a business controls the records it keeps about its staff and customers, those requests go to the business first. If you cannot reach the business, write to us at hello@kinmol.com and we will help or pass your request on.

A business account must be opened by someone aged 18 or over. A business may give staff accounts only to people it lawfully employs. Someone under 18 may become a member of a business, or order from a table, only with a parent’s or guardian’s permission.

KinMol is built for businesses in Nepal. Where data is processed by infrastructure outside Nepal, we rely on our providers’ security and compliance safeguards and take reasonable steps to keep the same level of protection.

We may update this policy. We will change the date above, and where a change is material we will tell business owners directly before it takes effect.

For any privacy question or request, write to hello@kinmol.com, or to Nepfex Innovations Pvt. Ltd., Nepal.