Legal
Privacy Policy
Last updated: October 17, 2026
This policy explains how Kaweya Group LLC (“Kaweya”, “we”, “us”) handles personal information when you visit kaweya.com or contact us through it. We are the controller (the business responsible) for this information.
Contact: Kaweya Group LLC, 8903 Glades Rd, Ste A8 #2232, Boca Raton, FL 33434, USA. Email: hello@kaweya.com.
1. Notice at collection: what we collect and why
| Information | Where it comes from | Why we use it | Legal basis (EU/UK) | How long we keep it |
|---|---|---|---|---|
| Name, email, inquiry topic, subject and message (identifiers, communications) | You, through the contact form | To read and answer your message and send you a copy confirming we received it | Steps you request before a contract / our legitimate interest in replying | 24 months after our last exchange, unless an ongoing business relationship requires longer |
| Artist application: name, stage name, date of birth, country and city, email, phone (optional), social media links, creative and professional details, goals and notes | You, through the artist application form | To evaluate your application, contact you about it and send you a confirmation | Steps you request before a contract / our legitimate interest in reviewing applications | 24 months after our last exchange, unless an ongoing business relationship requires longer |
| Name, email, request type, region and details | You, through the privacy request form | To verify, handle and record your privacy request | Legal obligation | 24 months after the request is closed |
| IP address and browser/device information (network activity) | Your browser, automatically, when you load pages | To deliver the site, keep it secure and block abuse (Cloudflare) | Legitimate interest in security | Kept by Cloudflare under its own retention; we don't keep our own copies of raw IP addresses |
| A one-way scrambled (salted hash) version of your IP address | Created when you submit a form | To limit how many messages one visitor can send in a short time | Legitimate interest in preventing spam | Up to 2 days |
| Browser and device signals for the bot check | Cloudflare Turnstile, on the form pages | To tell people and bots apart | Legitimate interest in preventing spam | Handled by Cloudflare; not stored by us |
| Cookie choices: date, categories, policy version, country (if available), GPC signal, random ID | Your choices in the cookie banner | To respect and prove your choices | Legal obligation | Up to 24 months |
We don't ask for sensitive personal information (such as health, financial account, government ID or precise location), and we ask you not to send it. We don't have user accounts, newsletters or analytics today, and we don't use artificial intelligence services to process your messages. We don't make automated decisions that have legal or similarly significant effects on you.
2. Cookies
We only use necessary cookies and similar technologies today. Optional categories stay off unless you accept them. See our Cookie Policy or .
3. Who we share information with
We use these service providers to run the site. They process information for us under contract:
- Cloudflare, Inc. (USA, global network): hosting, security, spam protection (Turnstile), domain and DNS.
- Supabase, Inc. (USA): database that stores form submissions and consent records.
- Resend (Plus Five Five, Inc.) (USA): sends the email notifications and confirmations.
- Google LLC (Google Workspace) (USA): our team's email inboxes, where messages are received.
We may also disclose information if required by law, to protect our rights or safety, or as part of a business transfer such as a merger.
4. Sale and sharing of personal information
Based on our review of the site as of the date above, we do not sell personal information and do not share it for cross-context behavioral advertising. We don't use advertising or analytics tools. If this changes, we will update this policy first, ask for consent where required, and honor opt-outs, including the Global Privacy Control signal. You can still submit a Do Not Sell or Share request at any time.
We don't collect sensitive personal information for the purpose of inferring characteristics about you, so a “Limit the Use of My Sensitive Personal Information” option is not needed today.
5. International transfers
We are based in the United States and our service providers store information mainly in the United States. If you are in the European Economic Area, the UK or Switzerland, your information is transferred to the US. We rely on our providers' data processing agreements, which include the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU-U.S. Data Privacy Framework.
6. Your rights
Depending on where you live, you may have the right to:
- access the personal information we hold about you and get a copy (portability);
- correct inaccurate information;
- delete your information;
- restrict or object to how we use it;
- withdraw consent at any time (this doesn't affect earlier processing);
- opt out of marketing, sale or sharing; and
- not be treated differently for using these rights.
To use a right, use our privacy request form or email hello@kaweya.com. We'll confirm your identity, usually by checking you control the email address on file, and respond within 30 days (EU/UK) or 45 days (US states). We may extend this period where the law allows and will tell you if we do. An authorized agent may submit a request for you with proof of permission. If we refuse your request, we'll explain why and how to appeal by replying to our decision.
If you are in the EU/UK, you can also complain to your local data protection authority.
7. California and other US state residents
In the past 12 months we collected the categories in section 1: identifiers (name, email, IP address), internet or network activity (device and browser signals), and the content of your messages. We collected them from you and your browser, for the purposes listed above, and disclosed them only to the service providers in section 3 for business purposes. We have not sold or shared personal information. We keep each category for the periods in section 1.
8. Security
We use encrypted connections (HTTPS), restrict database access to private server-side keys, keep data access rules in our database, and limit who on our team can see messages. No method of transmission or storage is completely secure.
9. Children
This site is not directed to children under 16, and we don't knowingly collect their information.
10. Changes
We'll update this page when our practices change and revise the date at the top.