Privacy Policy

This policy explains how Kermo ("we", "us") handles your personal data. Kermo is a product of aimdev, a product studio. aimdev is the data controller. For any privacy question, or to exercise your rights, contact [email protected] (this address routes directly to the studio owner).

Kermo helps people study for the New Zealand driving theory test. This policy is a plain-language description of our actual practices, written to meet the New Zealand Privacy Act 2020's Information Privacy Principles and, for users outside New Zealand, the equivalent requirements of GDPR Articles 13–14 and comparable regimes.

Who we are

Controller: aimdev
Privacy contact / data-subject requests: [email protected]

What we collect

When you use Kermo we process:

Your account identity — your sign-in identity via our shared sign-in system, which we host ourselves.
Your practice progress — which questions you've answered, whether you got them right, and your mastery level per chapter. This is stored locally on your device and, if you're signed in, synced to our servers so your progress follows you across devices.
Language preference — whether you view helper translations in Ukrainian or Russian, stored locally on your device only.
Purchase status — if you unlock Pro, we store a Stripe reference and your entitlement status. Card details are handled entirely by Stripe and never touch our servers.
Consent choices and GDPR requests — your analytics/personalization consent toggles, and any data export or deletion request you make, so we can honour and audit them.
Logs — operational logs that reference your account by ID only; we do not put your answers or personal identifiers into log messages.

Lawful basis (why we process)

Providing the service (tracking your progress, unlocking Pro access): performance of our contract with you.
Product analytics (see below): only with your explicit consent, which you can withdraw at any time in Privacy Settings.
Security and abuse prevention: legitimate interest.

Sub-processors and international transfers

We share the minimum data needed with service providers who process it on our behalf under contract:

Stripe — payment details and billing metadata for your Pro purchase. US/EU — Standard Contractual Clauses.
Cloudflare — request traffic and IP addresses (CDN, WAF, tunnel; email routing). Global edge — Standard Contractual Clauses.

Everything else — your account, progress data, and product analytics — runs on infrastructure aimdev operates itself; it is not handed to any other company. We do not sell or rent your personal data, and we do not share it with advertisers or data brokers.

Analytics

Kermo uses self-hosted product analytics — there is no third-party analytics service or ad-tech SDK. Events are only recorded if you've explicitly opted in via the Privacy Settings or the cookie banner, and carry only counts, enums, booleans, and durations — never your answers, email, or name.

Cookies & local storage

Kermo uses local storage to keep you signed in, remember your session progress, and remember your language preference — there are no advertising or cross-site tracking cookies. You control analytics-related storage via the cookie banner and Privacy Settings.

Retention

Account and progress data: kept while your account is active.
Deletion requests: processed with a 30-day grace period — your account is deactivated immediately, then permanently erased after 30 days unless you cancel the request. Request deletion any time from Privacy Settings.
Logs: retained up to 365 days.

Your rights

Under the NZ Privacy Act 2020 you have the right to access and request correction of your personal information — use the export tool in Privacy Settings, or email us. If GDPR or an equivalent regime applies to you, you additionally have rights to erasure, a portable copy, restriction of processing, and to object to processing based on legitimate interest.

To exercise any of these, use Privacy Settings (if signed in) or email [email protected]. We respond within 20 working days (the NZ Privacy Act timeframe), or 30 calendar days where GDPR applies. If you are in the EEA or UK you may also lodge a complaint with your local data protection supervisory authority; in New Zealand, with the Office of the Privacy Commissioner.

Children

Kermo is intended for learner drivers preparing for the NZ theory test, which in practice includes users as young as 16 (the minimum age for a learner licence). We do not knowingly collect more data from a younger user than described above, and do not use behavioural advertising.

Changes

We will update this page and its "last updated" date when our practices change.