KAMPSTER PRIVACY POLICY

Last Updated: October 8, 2026

1. INTRODUCTION

The Kampster Service is operated by Kampster DOO (Serbia), which is the data controller responsible for your personal data, together with its affiliated company Kampster Pte. Ltd. (Singapore), which sells and distributes subscriptions to you and acts as an independent (or joint) data controller for sales and billing data. In this Privacy Policy, "Kampster," "we," "us," or "our" refers to Kampster DOO as data controller.

Kampster respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered Learning Management System, including our website at https://kampster.com, our mobile applications distributed through the Apple App Store and Google Play Store, and related applications (collectively, the "Service").

Please read this Privacy Policy carefully. By accessing or using our Service, you acknowledge that you have read, understood, and agree to the practices described in this document. If you do not agree with our policies and practices, please do not use our Service.

Our Anti-Spam Policy prohibits unsolicited messages promoting Kampster and explains how to opt out of promotional contact or report an unwanted message.

2. CONTROLLER, REPRESENTATIVE & CONTACTS

Data Controller:

Kampster DOO
Vladimira Popovića 38–40, 11070 Beograd (Novi Beograd), Serbia
Company registration number (MB): 21312401
Tax ID (PIB): 110181684
Email: legal@kampster.com

Affiliated seller / controller (sales & distribution):

Kampster Pte. Ltd.
68 Circular Road, #02-01, 049422, Singapore
UEN: 202523773R

Kampster Pte. Ltd. is the seller/distributor of subscriptions and acts as an independent (or joint) data controller for the sales and billing data it processes, under an intercompany agreement with Kampster DOO. As Singapore is outside the EEA, transfers are covered by appropriate safeguards (see Section 7.5).

EU Representative (GDPR Article 27):

We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:

European Union (EU)

Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter or make use of your data subject rights, please visit the following website: https://app.prighter.com/portal/19848992175

Data Protection contact / DPO:

Email: legal@kampster.com

3. DATA WE COLLECT

We collect several types of information from and about users of our Service:

3.1 Personal Data

Personal data refers to any information that identifies or can be used to identify you directly or indirectly. We may collect the following personal data:

Account Information: Name, email address, username, profile picture
Contact Information: Phone number (where you choose to provide it), country of residence
Payment Information: Credit card details, billing address, payment history (processed by our payment processor)
Educational Information: Learning history, course progress, completion records, assessment scores
Professional Information: Occupation, employer, professional goals (if provided by you)
Voice Recordings: Audio you record in speaking and pronunciation exercises, and the transcription and pronunciation scores derived from it. We use these to give you feedback and to show your progress. We do not use voice recordings to identify you, and they are not processed as biometric data.

3.2 Proctoring and Test Data (Organisational/B2B feature only)

Proctoring is an optional feature available only to organisational (business) customers and only where that organisation has explicitly enabled it. It is not used in standard or individual (consumer) learning, courses, or assessments. Where an organisation enables proctoring for an assessment, the organisation acts as the data controller and Kampster acts as a data processor on its behalf. The legal basis for the processing, the collection of any consent, and the retention period (including the 30-day period referenced below, which is a default the organisation may vary) are determined by the organisation under its agreement with Kampster, not by this Privacy Policy.

Where proctoring is enabled, and only during an active, clearly-notified test session for which you have given explicit prior consent, the following may be collected to ensure test integrity: photographs/video of you, audio of your environment, behavioural data (mouse, keyboard, keystroke timing), biometric data (e.g. facial recognition, eye-movement patterns — special-category data processed only on the basis of your explicit consent), screen activity, and related device data. Proctoring data is retained for 30 days for audit purposes and then deleted (see Section 8).

If you use Kampster as an individual consumer, proctoring does not apply to you.

3.3 Usage Data

We automatically collect certain information when you access or use our Service:

Interaction Data: Learning activities, content viewed, features used, active platform and lesson time, navigation, completed onboarding steps, paywall interactions, purchases, subscription changes and referrals. Product events may include session identifiers, a website visitor identifier or app device identifier, platform and relevant course or lesson identifiers. They are linked to your account once you sign in.
Website Visit Data: Before and after you sign in, pages viewed, buttons clicked, page sections reached, A/B test variants shown, and how you arrived: the referring website, campaign (UTM) parameters, and the click identifier added to the link when you arrive from a Meta or TikTok ad. We derive device type, operating system, browser and country from your request, and record your browser language.
AI Interaction Data: Queries submitted to AI tutors, responses received, feedback provided
Device and Connection Information: IP address, browser type, operating system, device information
Log Data: Access times, pages viewed, features used, crashes, system activity, and AI provider/model usage, token counts and costs
Communication Engagement: Email opens and link clicks, and push-notification taps
Location Data: General location information derived from IP address

3.4 Authentication Data

We collect data related to account access and security:

Login Data: Email addresses used for OTP (One-Time Password) authentication
Session Data: Login timestamps, device information, session duration
Security Data: Failed login attempts, suspicious activity patterns

3.5 Cookies and Similar Technologies

We use cookies and similar tracking technologies to collect and store information about your interactions with our Service. For more detailed information about our use of cookies, please see our Cookie Policy.

4. HOW WE COLLECT YOUR DATA

We collect data through various methods:

4.1 Direct Collection

Information you provide when creating an account
Information you provide when subscribing to our Service
Profile information you enter in your account settings
Content you submit when using our AI tutoring features
Consent provided before proctored tests
Responses to surveys or feedback forms
Communications with our customer support team

4.2 Automated Collection

Through cookies and similar tracking technologies
Through server logs and analytics tools
Through AI system interactions and feedback mechanisms
Through proctoring software during tests
When you access our Service through different devices

4.3 Third-Party Sources

Payment processors
Sign-in providers — if you sign in with your Google or LinkedIn account, that provider confirms your identity and shares your email address and name with us

5. HOW WE USE YOUR DATA

We use your personal data for the following purposes:

5.1 Service Provision and Enhancement

To create and manage your Kampster account
To provide and personalize our educational services
To process payments and manage subscriptions
To deliver appropriate educational content based on your learning patterns
To improve and optimize our Service and educational content
To develop new features, products, and services
To send login OTP codes via email

5.2 AI-Specific Processing

To personalize AI responses to your learning needs
To analyze patterns in AI interactions to enhance educational effectiveness
To identify and fix potential issues with AI-generated content

We do not use your personal data, queries, or AI interactions to train AI models, whether our own or those of third parties. Our AI features run on third-party models under terms that prohibit training on your data (see Section 11.4).

5.3 Proctoring and Test Integrity (Organisational/B2B feature only)

Where an organisational customer has enabled proctoring (see Section 3.2), and only during active proctored sessions, data may be used to verify identity, detect cheating or unauthorized assistance, analyse behavioural patterns, and maintain the integrity and validity of test results. For proctoring, Kampster acts as a data processor on behalf of the organisational customer (the controller), and the purposes, legal basis, and retention are governed by that organisation's agreement. This does not apply to individual consumer use of the Service.

5.4 Communications

To send administrative messages about your account or the Service
To provide customer support and respond to inquiries
To send updates about our Service, including feature updates
To send promotional and marketing communications (only where you have given opt-in consent)
To send educational recommendations based on your learning patterns
To send email newsletters and reminders (only where you have given opt-in consent; you may withdraw consent at any time)

5.5 Legal and Security Purposes

To verify your identity and prevent fraud
To enforce our Terms of Service
To protect the security and integrity of our Service
To comply with applicable laws and regulations
To respond to legal requests from public authorities
To establish, exercise, or defend legal claims

6. LEGAL BASES FOR PROCESSING

We process your personal data on the following legal bases:

6.1 Performance of Contract

Processing necessary for the performance of our contract with you to provide the Service.

6.2 Legitimate Interests

Processing necessary for our legitimate interests, provided these interests are not overridden by your rights and freedoms. Our legitimate interests include:

Improving and personalizing our Service
Ensuring the security of our platform
Analyzing aggregated, de-identified usage to improve platform reliability and educational content
Measuring how visitors use our website and which pages, sections and variants work, using our own first-party visit data
Marketing our services to existing customers
Maintaining test integrity and preventing fraud

Processing based on your specific consent, such as:

Sending marketing communications
Measuring our Meta and TikTok advertising by sending them limited conversion data (Section 7.6), where we ask for it in our cookie banner
Collecting proctoring data during tests (organisational/B2B feature only)

Where proctoring is enabled by an organisational customer, any biometric data (such as facial-recognition data) is special-category data processed solely on the basis of your explicit consent (GDPR Article 9(2)(a)). You may refuse, in which case you will not take the proctored assessment.

6.5 Legal Obligation

Processing necessary to comply with our legal obligations under the Serbian Law on Personal Data Protection (ZZPL), the EU General Data Protection Regulation (GDPR), and other applicable laws.

We may share your personal data with the following categories of recipients:

We share information with third parties that help us operate, provide, improve, and market our Service:

Kampster Pte. Ltd. (Singapore) — our affiliated company, which sells and distributes subscriptions and acts as an independent (or joint) controller for sales and billing data (transfer covered by safeguards in Section 7.5)
Stripe — payment processing for web-based subscriptions. Stripe collects payment card details, billing address, and transaction data, and acts as a processor and as an independent controller for payment fraud prevention. See https://stripe.com/privacy
RevenueCat — subscription management and in-app purchase processing for our mobile applications. Collects device identifiers, purchase history, subscription status, and approximate location (via IP). Acts as a processor on our behalf. See https://www.revenuecat.com/privacy
Hosting, storage and infrastructure providers — hosting, content delivery, database and cache services. These act as processors and store data primarily in the EU.
AI and speech providers — services that generate and evaluate learning content, produce lesson audio, and transcribe or score the voice recordings you submit in speaking exercises. These act as processors on our behalf and are contractually prohibited from using your data to train their models. Further information is provided in Section 11.4.
Communication and support providers — email delivery, push notifications, and customer support tools.
Sentry — error and crash reporting to help us diagnose reliability problems. Our configuration does not enable session replay or performance tracing. Native error reports can include your user ID and app version; we do not attach your name or email as the Sentry user identity.

Our processor list. We do not name every processor in this Policy; our use of AI services is described in Section 11.4. We maintain a current list of the processors and sub-processors we use and will provide it on request at legal@kampster.com. Business customers receive this list as part of their Data Processing Agreement, along with advance notice of any new sub-processor and the right to object as set out in that agreement.

We may disclose your information where required by law, regulation, or legal process.

If Kampster is involved in a merger, acquisition, or sale of all or a portion of its assets, your personal data may be transferred as part of that transaction.

We may share your information with third parties when you have given us your consent to do so.

Your personal data may be transferred to, and processed in, countries other than your country of residence, including Serbia (where our controller and operations team are located), Singapore (our affiliated seller and independent/joint controller), and the United States (certain sub-processors).

Safeguards. Serbia and Singapore are not the subject of an EU adequacy decision. Where we transfer personal data outside the EEA, we rely on appropriate safeguards under Chapter V of the GDPR — principally the European Commission's Standard Contractual Clauses (SCCs) — and, for US-based providers participating in it, the EU-US Data Privacy Framework (DPF). Each processor handles your personal data under a data processing agreement that incorporates these safeguards. You may request a copy of the relevant safeguards by contacting legal@kampster.com.

AI processing locations. AI requests may be processed outside the European Economic Area, including in the United States, by Vercel AI Gateway and third-party AI service providers (see Section 11.4). We do not promise EU-only AI processing. The international transfer safeguards described above apply to transfers of personal data.

We advertise on Meta (Facebook, Instagram) and TikTok. To measure and improve those ads, our servers send Meta Platforms Ireland Ltd. and TikTok Technology Ltd. a limited set of website events: page views on our website (including course pages), sign-ups, the start of onboarding and completed onboarding steps, lesson starts and completions, checkout starts and subscription purchases. We do not load their advertising tags or pixels in your browser.

For each event we may send: the event name and time, the page address (without its query), your IP address and browser user agent, the ad click identifier from your arrival link (only within 30 days of that click), a hashed (SHA-256) visitor identifier, what the event is about, such as a course or plan (its ID, and where we have them its name, type and category), and for onboarding the name of the completed step. Once you have an account we also send, hashed (SHA-256), your email address, user ID, first name, phone number and country, and your account language, plus the plan price and currency for purchases. We never send the content of your lessons, your AI conversations or your answers.

When we send it. In the European Economic Area, the United Kingdom and Switzerland, and whenever we cannot tell your country, only after you choose Accept in our cookie banner; when you accept, we also send the events from this browser in the previous seven days that we held until your choice. Elsewhere we send them unless you choose Reject. You can change your choice at any time through Cookie settings in our website footer; it applies from that moment on. We never send events from members of an organisation's team, from pages of our organisational products, or from our mobile apps.

Their role. We and the platform may be joint controllers for collecting and transmitting these events; Meta and TikTok then process them as independent controllers under their own terms and privacy policies (https://www.facebook.com/privacy/policy and https://www.tiktok.com/legal/privacy-policy). Transfers outside the EEA rely on the safeguards in Section 7.5.

8. DATA RETENTION

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

Account Data: 2 years after account deletion
Learning Progress: 1 year after account deletion
Voice Recordings: 1 year after account deletion, together with the learning progress they belong to
Proctoring Data (organisational/B2B feature only): 30 days from test completion, then deleted
Billing Records: 7 years for tax and audit compliance
Marketing Data: Until you opt-out or 2 years after account deletion
Aggregated/De-identified Analytics: Retained in aggregated, non-identifying form for service improvement (we do not retain AI training data, as we do not train models on user data)
Website Visit and Product Event Records: retained while needed to measure and improve the Service; we periodically review and delete records we no longer need. Your last IP address and user agent are kept only while advertising measurement applies to you and are cleared when you choose Reject

When determining retention periods, we consider:

The amount, nature, and sensitivity of the personal data
The potential risk of harm from unauthorized use or disclosure
The purposes for which we process the data
Whether we can achieve those purposes through other means
Applicable legal, accounting, or reporting requirements

9. COOKIES AND TRACKING TECHNOLOGIES

We use cookies to maintain sign-in, carry a destination or team invitation through onboarding, and remember language and workspace preferences. A first-party visitor cookie (kp_vid) recognises your browser across visits so we can measure our website and keep A/B test variants consistent, and kp_consent remembers your advertising-measurement choice. We also use browser session storage to group product events. Our mobile apps use session and device identifiers for product events and service operation.

Our first-party product events and learning-time records help us understand product journeys, learning activity and subscription outcomes, and are linked to your account once you sign in. We do not load Google Analytics or third-party advertising tags. Limited conversion events are sent to Meta and TikTok from our servers as described in Section 7.6; our cookie banner and the Cookie settings link in our website footer control that.

You can manage cookies and browser storage through your browser settings. Deleting them may sign you out or reset preferences, and does not erase records already stored in our systems. Email preferences and other consent choices remain available in their respective flows. See our Cookie Policy for storage details and Section 12 for your data-protection rights.

10. DATA SECURITY

We have implemented appropriate technical and organizational measures to protect your personal data against unauthorized or unlawful processing, accidental loss, destruction, or damage. These measures include:

Encryption of personal data where appropriate
Regular testing of security systems and processes
Access controls and authentication procedures
Staff training on data protection and security
Regular backups of our systems
Secure data centers with physical security measures
Multi-factor authentication for administrative access

While we strive to protect your personal data, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security of your data.

11. AI-SPECIFIC DATA PRACTICES

As an AI-powered Learning Management System, we have specific data practices related to our AI technology:

11.1 AI Models and Your Data

We use third-party AI models to provide tutoring and generate educational content
These models operate under terms that prohibit training on your data (see Section 11.4)
We do not use your personal data, conversations, or AI interactions to train AI models, whether our own or those of third parties
We may review limited aggregated or de-identified usage metrics to monitor quality and fix issues

11.2 AI Content Generation and Limitations

Our AI systems generate personalized educational content and responses
AI-generated content is based on your interactions and learning patterns
IMPORTANT DISCLAIMER: You acknowledge that AI-generated content may contain inaccuracies, errors, or misleading information
NO WARRANTY: We provide no warranty regarding the accuracy, completeness, or reliability of AI-generated content
USER RESPONSIBILITY: You must independently verify any important information provided by our AI systems

11.3 AI Data Processing

AI processing occurs in real time to generate immediate responses; we do not retain your queries or responses for model training
Our AI systems do not make automated decisions that have legal or similarly significant effects on you
Where enabled by an organisational customer, proctoring AI analyses behaviour and biometric data only during active test sessions (organisational/B2B feature only — see Section 3.2)

11.4 Third-Party AI Services

Our tutoring, lessons and assessments are generated by third-party AI services. To personalise them, we include some of your information in the prompts we send to these providers. Depending on the feature, a prompt may contain:

First name — so your tutor and lessons can address you
Country and preferred language
Age group — only if you chose one; "Prefer not to say" is always available
Career status, job title and experience — only if you provided them
User context — what you have told us about yourself and your goals
Course context — your goals and answers for a particular course, including those you give during onboarding
What your tutor remembers — facts you shared in conversation that the tutor saved to personalise later sessions
Your learning activity — messages to the AI tutor, and your lesson, quiz and assessment answers
Audio recordings — speech you record in speaking, pronunciation and voice-conversation exercises, which speech providers transcribe and score

We do not include your email address, phone number, password or payment details in AI prompts. This data is transmitted securely and used solely to generate your educational content and feedback.

AI services. We use Vercel Inc.'s AI Gateway to access third-party AI models, together with other AI and speech services. Our current processor and sub-processor list is available on request at legal@kampster.com and is provided to business customers with their Data Processing Agreement (see Section 7.1).

Retention. No model training does not mean zero data retention. Depending on the service and applicable provider terms, providers may retain submitted content and outputs for service operation, safety, abuse prevention or legal obligations. We do not make a service-wide zero-data-retention commitment. Kampster's own retention periods are described in Section 8.

No training. We use third-party AI model services under terms that prohibit using submitted customer content for model training. We do not use your AI interactions to train our own models. For supported AI Gateway requests, we apply routing restrictions that exclude providers permitting prompt training. Other AI and speech services are subject to their applicable no-training terms.

Your control. You can view, change or remove every item listed above in your settings at any time, including your audio recordings and what your tutor remembers about you. If you would rather not share something, you can remove it or replace it with anonymous information, and the change applies to every prompt from that point on.

All third-party AI service providers are contractually bound to process data only as instructed by Kampster and in accordance with applicable data protection laws.

12. YOUR DATA PROTECTION RIGHTS

Depending on your location, you may have the following rights regarding your personal data:

12.1 Access

You have the right to request copies of your personal data.

12.2 Rectification

You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete.

12.3 Erasure

You have the right to request that we erase your personal data, under certain conditions.

12.4 Restriction of Processing

You have the right to request that we restrict the processing of your personal data, under certain conditions.

12.5 Data Portability

You have the right to request that we transfer the data we have collected to another organization, or directly to you, under certain conditions.

12.6 Objection

You have the right to object to our processing of your personal data, under certain conditions.

12.7 Automated Decision Making and Profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

If we rely on your consent to process your personal data, you have the right to withdraw that consent at any time.

12.9 How to Exercise Your Rights

To exercise any of these rights, please contact us at legal@kampster.com. We will respond to your request within 30 days. We may need to verify your identity before responding to your request.

12.10 California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

Right to Know: You have the right to request information about the categories and specific pieces of personal data we have collected about you, the categories of sources from which we collect personal data, the business purposes for collecting personal data, and the categories of third parties with whom we share personal data.
Right to Delete: You have the right to request deletion of your personal data, subject to certain exceptions.
Right to Opt-Out of Sale or Sharing: Kampster does not sell your personal data for money. The limited conversion data we send to Meta and TikTok to measure our ads (Section 7.6) may be "sharing" for cross-context behavioral advertising under California law. You can opt out at any time by choosing Reject under Cookie settings in our website footer.
Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

To exercise your California privacy rights, contact us at legal@kampster.com. We will verify your identity before processing your request and respond within 45 days.

13. CHILDREN'S PRIVACY

Our Service is intended for users aged 16 and above, and we do not knowingly collect personal data from anyone under 16. Setting our minimum age at 16 also meets the highest age of digital consent applied across the EU/EEA, so consent-based processing does not rely on the personal data of children below that age.

If you are a parent or guardian and believe that a child under 16 has provided us with personal data, please contact us at legal@kampster.com and we will take steps to delete such information.

14. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. The updated policy will be posted on this page with a revised "Last Updated" date.

For material changes to this Privacy Policy, we will notify you through:

A notice on our website
An email to the address associated with your account
A notification when you access our Service

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

15. DATA PROTECTION OFFICER

For any questions or concerns about this Privacy Policy or our data practices, you can contact our data protection function:

Email: legal@kampster.com
Controller postal address: Kampster DOO, Vladimira Popovića 38–40, 11070 Beograd (Novi Beograd), Serbia
EU representative: Prighter — https://app.prighter.com/portal/19848992175

16. COMPLAINTS

If you have a complaint about our use of your personal data or our response to your requests, you have the right to lodge a complaint with a supervisory authority.

Our lead supervisory authority is the Serbian data protection authority:

Commissioner for Information of Public Importance and Personal Data Protection (Poverenik) Bulevar kralja Aleksandra 15, 11000 Beograd, Serbia Website: https://www.poverenik.rs/

EU/EEA residents may also lodge a complaint with their local data protection authority, and may contact our EU representative (Prighter — https://app.prighter.com/portal/19848992175).

To the extent our affiliated company in Singapore (an independent/joint controller for sales and billing) is involved, the Singapore supervisory authority is the Personal Data Protection Commission (https://www.pdpc.gov.sg/).

17. CONTACT US

For any questions about this Privacy Policy or our data practices, please contact us at:

General Inquiries: help@kampster.com
Legal Matters: legal@kampster.com
Postal Address: 68 Circular Road, #02-01, 049422, Singapore

By using Kampster, you acknowledge that you have read and understood this Privacy Policy.