Privacy Policy

1. Who we are

Milla & Vida is operated by K.I.N.D Technologies Ltd, registered in England and Wales (company number 17260532), registered office 33 Townsend Road, Stratford-upon-Avon, CV37 7DE, United Kingdom.

Under UK GDPR and the Data Protection Act 2018, K.I.N.D Technologies Ltd is the data controller for personal data collected through our website and platform. Where we process personal data on behalf of our clients — for example prospect data inside a programme — we act as a data processor under the client’s instructions, as governed by our Data Processing Agreement.

For South African data subjects we are a responsible party under POPIA. For California residents we honour CCPA rights as set out in section 6.

2. Data we collect

Account data

Name, email address, company name, country and billing details. Collected at onboarding. Used to deliver the service and process payments.

Prospect data

B2B prospect names, work email addresses, job titles, company names, LinkedIn URLs and country — sourced on clients’ behalf from Apollo.io, a licensed B2B data provider. Processed only under client instruction and our Data Processing Agreement.

Usage data

Platform activity, API call logs and feature usage patterns. Used to deliver and improve the service and for billing accuracy.

Communication data

Email content sent through a programme, replies received and opt-out requests. Stored for programme performance tracking and POPIA audit trails.

Technical data

IP address, browser type, device type and referring URL. Collected automatically via server logs. Retained for 90 days.

3. How we use your data

• Deliver and operate the Milla client experience and the Vida execution environment
• Process payments via Stripe
• Send service communications — programme alerts, reports and billing receipts. Not marketing without consent
• Generate AI-assisted features using Anthropic’s Claude API. We send Anthropic only what each task needs, such as a prospect’s name, role, company and the text of their reply when drafting an answer
• Comply with legal obligations under UK GDPR, POPIA and applicable data laws
• Detect and prevent fraud, abuse and security incidents
• Improve the platform using anonymised, aggregated usage data

Lawful basis (UK GDPR): contract performance (delivering the service you signed up for); legitimate interests (security, fraud prevention, platform improvement); legal obligation (compliance, tax records); consent (marketing communications, if applicable).

4. Data hosting and transfers

Database

All client account data and prospect data is stored on Supabase in the eu-west-1 region (Dublin, Ireland). Our database provider is SOC 2 Type II audited.

Application hosting

The platform runs on Railway in its US West region, which operates on SOC 2-audited infrastructure. No personal data is stored in environment variables — only configuration keys.

International clients

Client data is stored in the European Union (Dublin, eu-west-1) and processed by application servers in the United States (Railway, US West). Where data crosses borders we apply appropriate safeguards.

Email delivery

Programme emails are sent from the business mailboxes that carry each programme (Google Workspace for our own sending mailboxes). Resend delivers our service emails and receives replies.

AI processing

Natural language generation for outreach sequences, scoring and reply drafting uses Anthropic’s Claude API (US-based). To do this we send Anthropic the business-contact details each task needs — such as a prospect’s name, job title, company and the text of their reply — and nothing beyond that. Anthropic processes this data as our sub-processor.

Payments

Payment card data is processed by Stripe (PCI DSS Level 1 certified). We never store card numbers.

5. Data retention

• Account data — held for the duration of your account and for 90 days after it closes
• Prospect personal data — held for the duration of your account and for 90 days after it closes, then permanently deleted (or sooner on request)
• Programme email content — held for the duration of your account and for 90 days after it closes, then permanently deleted (or sooner on request)
• Billing records — 7 years (UK tax law requirement)
• Server logs — 90 days automatic rotation
• Opt-out records — permanently retained, in order to honour the opt-out

You can request deletion of your account and all associated personal data at any time by emailing privacy@get-kind.com. We action deletion within 30 days.

6. Your rights

Under UK GDPR (UK and EU residents)

• Right of access — request a copy of your personal data
• Right to rectification — correct inaccurate data
• Right to erasure — request deletion
• Right to portability — receive your data in a machine-readable format
• Right to restriction — limit how we process your data
• Right to object — object to processing based on legitimate interests
• Right to lodge a complaint with the ICO at ico.org.uk/make-a-complaint

Under POPIA (South African residents)

• Right to access, correct and delete your personal information
• Right to object to processing
• Right to lodge a complaint with the Information Regulator at inforegulator.org.za

Under CCPA (California residents)

• Right to know what personal information is collected and how it is used
• Right to delete personal information
• Right to opt out of the sale of personal information — we do not sell personal information

To exercise any right, email privacy@get-kind.com. We respond within 30 days.

7. Prospect data and opt-outs

Prospect data used in a programme is sourced from Apollo.io, a licensed B2B data provider. We process this data on behalf of clients as a data processor under our Data Processing Agreement.

Every programme email includes a clear unsubscribe mechanism. Vida campaigns carry it on every send. An unsubscribe is written to our suppression list at the moment it arrives, and the suppression is logged with an audit trail.

If you have received an email from one of our programmes and wish to be removed from all future outreach, email privacy@get-kind.com with "Unsubscribe" in the subject line.

8. Third-party sub-processors

We use the following sub-processors to deliver the service. Each has been assessed for GDPR and POPIA purposes and a Data Processing Agreement is in place where required.

• Supabase — database hosting, Dublin, eu-west-1, European Union. SOC 2 Type II
• Railway — application hosting, US West, United States. SOC 2-audited infrastructure
• Stripe — payment processing, United States. PCI DSS Level 1 certified
• Resend — service emails and receiving replies, United States
• Google Workspace — business mailboxes programme emails are sent from, United States
• Apollo.io — B2B contact data, United States. Our only source of prospect data
• Anthropic — AI language model, United States. Receives the business-contact details each task needs (see section 4)

The full sub-processor list is also documented in our Data Processing Agreement.

9. Cookies

This website uses minimal cookies. Session cookies are required for login and expire when you close your browser or after 30 days of inactivity. Preference cookies remember settings such as theme and expire after 12 months.

We run no website analytics. There is no Google Analytics, no Facebook Pixel, no advertising cookie and no visitor-tracking script of any kind on this site. Google Analytics was present on this website until 20 August 2026 and has been removed.

Embedded third parties, in full. No page on this site carries an embed from another company. Our product videos are served from our own website and set no cookie. Supabase — our own platform backend, not a third-party tracker.

Our emails do not track you. We do not place an invisible tracking pixel in outreach email, so we do not record whether you opened a message. This changed on 20 August 2026; before that date our sequence emails did contain an open-tracking pixel.

You can disable cookies in your browser settings — this may affect platform functionality. See our Cookie Policy for the same detail in one place.

10. Children

This is a B2B service intended for business use only. We do not knowingly collect personal data from anyone under the age of 18. If you believe a minor has submitted data to us, contact privacy@get-kind.com and we will delete it promptly.

11. Changes to this policy

We may update this Privacy Policy when our practices change, new services are added, or applicable law requires it. We notify active clients of material changes by email at least 14 days before they take effect. The date at the top of this page always reflects the current version.

12. Contact and complaints

For privacy requests, data subject rights or any question about this policy:

K.I.N.D Technologies Ltd, registered in England and Wales (company number 17260532), registered office 33 Townsend Road, Stratford-upon-Avon, CV37 7DE, United Kingdom
privacy@get-kind.com

We aim to respond to all privacy requests within 5 business days and resolve them within 30 days as required by UK GDPR.