Kisumbu privacy policy

1. Data controller

The data controller is ONOMBONGO - COMÉRCIO E PRESTAÇÃO DE SERVIÇOS, (SU), LDA, tax ID (NIF) 5003652734, registration no. 47116-26/260929 (Commercial Registry, Guiché Único da Empresa), with registered office at Bairro Sede, Rua Principal, Casa n.º 4, Chibia, Huíla, Angola, the same company behind Onombongo. Kisumbu is not a separate company.

For any question about personal data, write to geral@onombongo.com or use the Contact us page.

2. Your account is the same as your Onombongo account

To use Kisumbu you need an Onombongo account (you can create one in either app). Your identity, financial accounts, categories and subscription plan are managed by Onombongo and accessed by Kisumbu through the Onombongo API — Kisumbu never keeps a copy of that data.

To learn how Onombongo processes that data, read the Onombongo privacy policy.

3. What data Kisumbu processes

Besides the data from your Onombongo account (previous section), Kisumbu processes the following data of its own:

• Shopping lists: list name, optional budget, and the items (product, quantity, unit and price).
• Stores: a personal list of store names created by the user, without location.
• Closed purchases: store, date, currency and total, and whether and when they were sent to Onombongo as an expense.
• Sync queue: changes made offline are stored on the phone and sent to the server once the connection comes back.
• The phone's push notification token, for alerts such as "the linked expense was deleted in Onombongo".
• A record of rewarded ads watched (how many and when), to apply the daily limit.

Kisumbu never asks for or stores payment details.

4. Purposes and legal grounds

• Building shopping lists, shopping in market mode (including offline) and closing the purchase, based on performing the service requested.
• Sending the purchase to Onombongo as an expense, only when you confirm it — never automatically.
• Notifying you by push notification about changes made in Onombongo to a linked expense, based on the legitimate interest of keeping both sides consistent.
• Applying the daily limit on rewarded ads and the resulting temporary unlock, based on performing the requested service.

5. Ads and rewards

The Pro plan never shows ads. On the Free plan, Kisumbu shows Google ads (AdMob) on the lists, history and reports screens — never full-screen and never in market mode.

The products, amounts and stores of your purchases are **never** sent to any advertising network. Personalised ads only happen with your explicit consent, requested through Google's own consent panel (UMP SDK) before any ad is requested.

You may choose to watch an ad to temporarily unlock Kisumbu's Pro features; the reward is validated on Kisumbu's server, never by the app alone.

6. Who receives the data

We do not sell or share your data. We use these service providers, who process the data on our behalf:

• Google (AdMob), to show Free-plan ads, only with the applicable consent. Learn more in Google's privacy policy.
• Expo (Expo Push Service), to send Kisumbu's push notifications.
• Railway, for hosting Kisumbu's server.
• Onombongo (the same company), through the Onombongo API, for your identity, financial accounts, categories and subscription (section 2).

7. International transfers

These providers may process data outside Angola, namely in the United States and the European Union. We choose providers that offer adequate data protection safeguards.

8. How long we keep the data

• Lists, stores and purchases: for as long as the account exists. Older purchases are never deleted on their own — on the Free plan they are only temporarily hidden (history limited to the last 3 months) and reappear when you upgrade to Pro or during a reward unlock.
• Sync queue: only on the phone, until successfully sent to the server.
• Record of rewarded ads watched: only what is needed to apply the daily (24-hour) limit, not kept beyond that.

9. Your rights

Under Law no. 22/11 of 17 June (Angolan Personal Data Protection Law), you have the right to:

• know what data of yours we process and access it;
• ask for inaccurate or incomplete data to be corrected;
• ask for your data to be deleted (deleting your account also deletes Kisumbu's own data);
• object to processing and withdraw consent at any time, without affecting processing already carried out.

To exercise these rights, write to geral@onombongo.com. We reply within the legal deadline. You may also lodge a complaint with Angola's Data Protection Agency (Agência de Protecção de Dados, APD).

10. Security

Communication between the app, Kisumbu's server and the Onombongo API happens only over HTTPS. Every request is always filtered by the authenticated user, so none of your data is visible to another user.

11. Changes to this policy

We may update this policy. The date of the last update is shown at the top of the page.