Draft
Privacy policy
Version of 2026-09-17. Applies to the KMeta mobile app and kmeta.kz.
1. Who processes your data
The data controller is KOMETA Ltd., BIN 260740900420, 55/23 Mangilik El Ave., block 4.4, office 334, Yesil district, Astana 010017, Republic of Kazakhstan ("we", "the Company"). The Company is registered in the Astana International Financial Centre and processes personal data under the Law of the Republic of Kazakhstan "On Personal Data and Its Protection" and the AIFC Data Protection Regulations.
Data questions: privacy@kmeta.kz.
2. What we collect and why
| Data | Purpose | Basis |
|---|---|---|
| Phone number | Sign-in with a one-time SMS code, account identification, notifications | Performance of our agreement |
| First and last name (optional) | Shown in the profile | Consent |
| Location (with permission) | Show venues and offers nearby, compute distance | Consent; can be switched off in device settings |
| Camera (with permission) | Scanning QR codes for payment; identity verification when opening an account in the bank's module | Consent; performance of the agreement |
| Bank client identifier and transaction events (amount, venue, date) | Cashback, partner rewards, offer history | Performance of the agreement; legitimate interest |
| Favourites, reviews, ratings, offer activations | Operation of those features | Performance of the agreement |
| Device token for push notifications | Delivery of notifications about rewards and offers | Consent; can be switched off |
| Technical data: device model, OS and app version, crash reports | App stability | Legitimate interest |
| For creators: name, profile links, collaboration and income data | Creator cabinet and partner programmes | Performance of the agreement |
We do not collect special categories of data. Crash reports contain no personal data or request bodies.
3. Banking data
Account opening, card issuance, identity verification (KYC), payments and transfers run in the secure module of the partner bank, Halyk Bank of Kazakhstan JSC, inside the app. ID documents, biometrics, account and card details are processed by the bank under its own agreement and policy and are not passed to the Company. The Company receives from the bank a client identifier and transaction events needed to credit cashback and partner rewards.
4. Who we share data with
- The partner bank, to perform the agreement (over a secured channel).
- Partner venues: anonymised statistics only and, for creators, public profile data.
- Infrastructure providers: cloud hosting in Kazakhstan (Yandex Cloud), the map service (Yandex Maps, which receives coordinates to render the map), push delivery services (Apple, Google).
- Public authorities where the law requires.
We do not sell personal data and do not use it for third-party advertising.
5. Where and for how long
Data is stored on servers in the Republic of Kazakhstan. The account is kept while you use the app and deleted within 30 days of a request. Transaction and support records are kept for the statutory period, then deleted or anonymised.
6. Security
Data in transit is encrypted (TLS; the bank channel is protected by IPsec), staff access is role-based, secrets and keys are kept in dedicated vaults, administrator actions are logged. The Company has an approved information security policy.
7. Your rights
You may request information about processing, correct or delete data, withdraw consent (location, camera, notifications: in device settings) and delete the account: how to delete. Send requests to privacy@kmeta.kz; we reply within 15 business days. You may also complain to the personal data authority of the Republic of Kazakhstan or the AIFC Commissioner of Data Protection.
8. Children
The app is intended for adults (18+); we do not knowingly collect children's data.
9. Changes
New versions are published on this page with a date; material changes are announced in the app.