Kamu legal

Cookie and Similar Technologies Policy

How Kamu uses cookies, browser and application storage, SDKs, device identifiers, and related technologies.

Effective: August 9, 2026
Version: 2.0
Document: KA-CP-001

1. PURPOSE AND SCOPE

This Cookie and Similar Technologies Policy explains how Kamu Administration Ltd. ("Kamu," "we," "us," or "our"), a wholly owned subsidiary of Razif Holdings Ltd., uses cookies, browser storage, application storage, software development kits, device identifiers, and related technologies in the Kamu websites, mobile applications, web applications, administrative interfaces, and related products and services that link to this Policy (collectively, the "Services"). Kamu may publicly identify itself as "Kamu, a Razif company."

This Policy should be read with the Kamu Privacy Policy, which explains how we collect, use, disclose, retain, and protect Personal Information and how you may exercise privacy rights.

This Policy distinguishes among:

actual browser cookies set by Kamu;
browser localStorage, sessionStorage, cache, and related web storage;
protected storage and preferences used by native mobile applications;
mobile SDKs, push-notification tokens, permissions, and device services; and
cookies or technologies controlled independently by Google, Apple, Microsoft, Stripe, or another third party when you visit or authorize that third party's service.

These technologies do not all operate in the same way and are not all legally treated as cookies. We describe them together so that users can understand what may be stored on or accessed from their browser, application, or device.

2. SUMMARY OF CURRENT USE

As of the Effective Date:

Kamu's customer-facing website and applications do not intentionally use third-party advertising cookies, behavioural-advertising pixels, or audience-analytics cookies.
Kamu has not intentionally enabled an advertising SDK or a third-party audience-analytics SDK in its mobile application.
The only first-party browser cookies currently implemented by Kamu are the strictly necessary security cookies used by the restricted operator console and public account-deletion form and listed in Section 5.
Customer web authentication and preferences may use browser storage rather than the restricted-console cookies.
Native iOS and Android applications use operating-system protected storage for designated credentials and ordinary application preferences for non-secret settings.
The public website may request presentation fonts from Google Fonts. That request is not a Kamu cookie, but it transmits ordinary network-request information to Google as described in Section 9.4.
Google, Apple, Microsoft, Stripe, and other third parties may use their own cookies or technologies on pages that they control, such as sign-in, authorization, checkout, or provider-onboarding pages.

Because the current Kamu-controlled public configuration uses necessary storage and does not intentionally use optional advertising or audience-analytics cookies, Kamu does not currently display a general cookie-consent banner. Device permissions, Connected Account permissions, marketing choices, and permissions for third-party AI processing are requested separately and are not implied by the absence of a cookie banner.

If Kamu introduces an optional technology that requires consent, it will not be activated until the notice and controls described in Section 10 are available.

3. WHAT THESE TECHNOLOGIES ARE

3.1 Cookies

A cookie is a small text record placed in a web browser. A website can ask the browser to return the cookie with later requests. Cookies may support authentication, security, preferences, measurements, or advertising.

A first-party cookie is associated with the website or service you are visiting.
A third-party cookie is associated with another organization whose service is present on or opened from the website.
A session cookie is ordinarily removed when the browser session ends.
A persistent cookie remains until its stated expiry or until it is deleted.

Cookie attributes can reduce risk. For example, Secure limits transmission to HTTPS, HttpOnly prevents page scripts from reading the value, and SameSite controls when a browser includes the cookie in cross-site requests.

3.2 Browser local storage

Browser localStorage allows an application to store data under a website origin. It commonly remains after a tab or browser is closed and may remain until the application removes it or the user clears site data. Unlike an HttpOnly cookie, local-storage data can be read by scripts executing within the same browser origin. Kamu therefore does not describe browser local storage as equivalent to the iOS Keychain, Android Keystore, or an HttpOnly cookie.

3.3 Browser session storage

Browser sessionStorage holds data for a browser tab or session and is ordinarily removed when that tab or session closes. The browser or application may remove it sooner. Server-side revocation or expiry may make a stored token unusable before the browser removes its local copy.

3.4 Native protected storage and application preferences

On supported native devices, designated credentials are stored using operating-system protected storage, such as the iOS Keychain or Android Keystore-backed encrypted storage. Non-secret application settings may be stored in the application's preferences area. These are not browser cookies.

3.5 SDKs, tokens, and device identifiers

A software development kit ("SDK") is a software component included in an application. An SDK or operating-system service may issue an installation identifier, push-notification token, fraud-prevention signal, or diagnostic event. Some SDK processing may be subject to privacy or consent rules even though no browser cookie is used.

3.6 Device permissions

Mobile operating systems require permission before an application can access certain device functions, such as the microphone, speech recognition, camera, photographs, notifications, or precise location. A device permission is not a cookie and does not authorize Kamu to use information for an unrelated purpose.

3.7 Cache and similar storage

Browsers and applications may cache images, fonts, code, stylesheets, and other resources to improve performance or make limited functionality available offline. A browser or operating system controls much of this cache. Clearing application or browser data generally removes it.

4. PURPOSE CATEGORIES

4.1 Strictly necessary

These technologies are required to authenticate an authorized user, protect against request forgery, maintain security, prevent fraud, route network traffic, remember an express request, preserve a transaction, or provide another function specifically requested by the user. Disabling them may prevent the relevant feature or Service from operating safely.

4.2 Preferences and functionality

These technologies remember choices such as language, accessibility, active account, workspace, interface state, notification preference, voice preference, or an unfinished form. Some are necessary to remember an express request. If a preference technology is optional and applicable law requires consent, Kamu will request that consent before using it.

4.3 Analytics and performance

These technologies measure audience, traffic, errors, reliability, or use of features. Kamu has not intentionally enabled third-party audience-analytics cookies or an audience-analytics SDK in the current Services covered by this Policy. If optional analytics are introduced, they will be classified and controlled in accordance with Section 10.

Operational server logs, security events, and aggregate reliability measurements that do not store or access information on a user's device are not cookies, although related Personal Information is governed by the Privacy Policy.

These technologies may personalize advertising, measure campaigns, build profiles, connect activity across services, or enable social-media advertising functions. Kamu does not currently use third-party behavioural-advertising cookies, advertising pixels, or a mobile advertising SDK in the Services covered by this Policy, and does not currently sell Personal Information or share it for cross-context behavioural advertising.

The following strictly necessary cookies are implemented for Kamu's restricted operator console and public account-deletion form. They do not perform audience analytics or advertising. The console cookies are not the ordinary customer web-authentication mechanism.

Cookie	Party and category	Purpose and safeguards	Duration
`kamu_console_session`	Kamu; first party; strictly necessary	Contains an opaque credential that authenticates an authorized operator-console session. It is set with `Secure`, `HttpOnly`, `SameSite=Strict`, and `Path=/`. Page scripts cannot read the credential.	Up to 12 hours; removed on operator sign-out or expiry
`kamu_console_csrf`	Kamu; first party; strictly necessary	Contains a random anti-forgery value. The authorized console script reads it and returns the same value in a protected request header for state-changing requests. It is set with `Secure`, `SameSite=Strict`, and `Path=/`, and is intentionally not `HttpOnly` because the double-submit protection requires the console script to read it.	Up to 12 hours; rotated when a new console session is issued and removed on sign-out
`kamu_privacy_request`	Kamu; first party; strictly necessary	Identifies a temporary server-side session used to protect the public account-deletion form against request forgery and automated abuse. It is scoped to `/account-deletion/` and set with `Secure` on HTTPS, `HttpOnly`, and `SameSite=Strict`. It is not used for advertising or audience analytics.	Session cookie; ordinarily removed when the browser session ends

No other Kamu first-party browser cookie is intentionally active in the current Services configuration covered by this Policy. This register is reviewed when the Services or hosting configuration changes.

6. BROWSER AND APPLICATION STORAGE REGISTER

The information stored depends on the platform, account type, features used, and choices made. A user may therefore encounter only a subset of this register.

Storage or technology	Platform	Purpose and information	Typical retention and control
Native credential vault	Native iOS and Android applications	Stores designated session credentials and account-switching credentials using the iOS Keychain or Android protected encrypted storage where supported	Until sign-out, account removal from the device, account deletion, application reset, or credential invalidation; the server may revoke access sooner
Web credential storage	Kamu web application	Stores designated bearer-session material through the web application's browser-storage fallback. Browser storage is script-accessible and is not represented as hardware-backed or equivalent to an `HttpOnly` cookie	Until sign-out, account removal, application cleanup, site-data deletion, or browser-profile deletion; server expiry or revocation may make it unusable sooner
Account registry and active-account selection	Native and web applications	Stores non-secret display information and state used for account switching, including account or user identifier, name, email address, last-used time, and last workspace	Until the account is removed from the device, application data is reset, or browser site data is cleared
Application and server preferences	Native and web applications	Stores server selection for authorized development settings, language, interface, active workspace, and similar application choices	Until changed, reset, or storage is cleared
Voice, wake, notification, and accessibility preferences	Native and web applications	Remembers whether a user-enabled feature or interface choice is on; does not itself grant microphone, notification, or other operating-system permission	Until changed, permission is withdrawn, application data is reset, or site data is cleared
Onboarding or form drafts	Native and web applications	Preserves fields entered in a partially completed onboarding or application flow so the user can resume	Until submitted, discarded, reset, or cleared from application or browser storage
Conversation and guest continuity state	Native and web applications	Stores identifiers or state needed to resume a conversation or recognize the same guest browser, subject to server-side authorization and expiry	Until sign-out, conversation cleanup, application reset, or site-data clearing; server authorization may expire sooner
Operator console session storage	Restricted web console	Stores temporary interface state and, in some authorized console flows, a bearer-session value for the browser tab or session	Until the browser tab or session ends, explicit sign-out, cleanup, or site-data clearing; server expiry or revocation may occur sooner
Authorized recruiting or operations interface storage	Restricted internal web interface	May store reviewer display settings, review state, notes, ranking preferences, interview dates, comparisons, and message drafts in the authorized reviewer's browser	Until the authorized reviewer deletes the data or clears site storage
Browser or application cache	Websites and applications	Caches scripts, styles, fonts, images, and other application resources for performance, reliability, or limited offline use	Controlled by the browser, operating system, Service Worker, application version, cache headers, or user clearing controls

6.1 Shared devices

Browser local storage, browser profiles, native application preferences, and cached content may persist on a shared device. Sign out of Kamu and remove the account or clear Kamu site or application data before another person uses the same browser profile or device. Deleting a local browser value does not necessarily delete the associated Kamu account or server-side record; use the account-deletion process described in the Privacy Policy for account deletion.

Kamu stores accounts, messages, marketplace records, transactions, files, permissions, and other Service data on its servers or those of its vendors. Server-side records are not cookies merely because a browser or application uses an identifier to retrieve them. Their processing and retention are described in the Privacy Policy.

7. MOBILE SDKS, TOKENS, AND DEVICE FUNCTIONS

7.1 Push notifications

If you enable notifications and grant device permission, Firebase Cloud Messaging and the applicable platform push service, including Apple Push Notification service, may issue and process a device token, platform information, account association, and enabled status so that Kamu can route a notification to the correct installation.

Push-notification permission is not consent to promotional messaging. Transactional, security, and service notifications are separate from marketing choices. Kamu designs push payloads to use generic notice text and an opaque identifier where practicable, with protected details loaded after authentication.

You can disable notifications in Kamu settings or device settings. A token may remain until Kamu unregisters it, the push service invalidates it, the application is removed, the account is removed, or the device is reset.

7.2 Microphone and speech

When you choose voice input, transcription, a voice conversation, or an audio feature, the application may request microphone and speech-recognition permission. Audio may be processed on the device, through a Kamu endpoint, or through an external speech or AI service identified in the feature disclosure. Permission status and the feature preference may be retained by the operating system and application.

7.3 Camera, photographs, and media

The application may request camera, photograph, or media-library permission when you choose to add a profile image, capture a document, attach service evidence, analyze an image, or use a video function. The operating system controls the permission and may allow access to selected media only.

7.4 Location

If you choose a feature that needs location, the application may request approximate or precise location permission. An enabled customer or Marketplace Provider workflow may transmit location, accuracy, and time while the location-dependent feature is active for matching, service coordination, routing, or safety. Kamu does not treat device permission alone as authorization for an unrelated location use.

You can stop future location access through the feature control or device settings. Disabling location may prevent matching, routing, or task-coordination functions from working.

7.5 Advertising identifiers and Apple App Tracking Transparency

Kamu does not intentionally use a mobile advertising SDK, collect an advertising identifier for targeted advertising, or track users across apps or websites owned by other companies for advertising in the current application configuration.

Apple's App Tracking Transparency permission is distinct from cookie consent, sign-in permission, notification permission, and location permission. If Kamu introduces processing that Apple defines as tracking, Kamu will update its disclosures and obtain App Tracking Transparency authorization before tracking. A refusal will be honoured without treating unrelated permissions as a substitute.

7.6 Application-store disclosures

Kamu maintains Google Play Data safety and Apple App Privacy disclosures for released applications based on the data and SDKs in the applicable production build. Those disclosures, this Policy, and the Privacy Policy address different requirements and should be read together. An operating-system or application-store privacy label does not itself grant permission for a device function or optional processing.

8. GOOGLE, APPLE, MICROSOFT, AND CONNECTED ACCOUNTS

When you choose Sign in with Google, your browser or operating system opens a Google-controlled sign-in or account-selection interface. Google may use cookies, account state, security signals, or application technologies under Google's own policies. Kamu receives only the account information and authorization result described in the Privacy Policy and permissions shown during sign-in. Kamu cannot read Google's unrelated cookies.

Standard Sign in with Google is separate from optional access to Gmail or Google Drive. Kamu requests additional Google Workspace permissions only when you choose the corresponding Connected Account feature.

When you choose Sign in with Apple, Apple may use Apple Account state, device authentication, security signals, and provider-controlled cookies or application technologies. Kamu receives the authentication result and account information described in the Privacy Policy, including an Apple-provided identifier and, depending on your choices, name, email address, or a Hide My Email relay address. Kamu does not receive access to Apple's unrelated cookies or Apple Account data.

8.3 Microsoft and other Connected Accounts

Microsoft or another Connected Account provider may use its own cookies and security technologies on its sign-in and authorization pages. The provider's notice governs those technologies. Returning to Kamu does not allow Kamu to read unrelated cookies set for the provider's domain.

8.4 OAuth security state

During a sign-in or Connected Account authorization, Kamu or the provider may use short-lived state, nonce, code-verifier, callback, or redirect information to bind the response to the request, prevent forgery, and complete the authorization securely. Depending on the platform, this information may be held in memory, browser session storage, secure application storage, or a necessary first-party record and is removed or expires after the flow is completed or abandoned.

8.5 Managing a connection

You can disconnect an optional Connected Account through Kamu settings or revoke Kamu's access in the provider's account settings. This prevents new access after revocation takes effect. It does not by itself delete your Kamu account or server-side data already retained for a user-requested feature, transaction, security matter, or legal obligation. Account deletion and Connected Account retention are described in the Privacy Policy.

9. THIRD-PARTY PAGES, RESOURCES, AND HOSTED SERVICES

9.1 Hosted payments and Marketplace Provider onboarding

When you open a Stripe-hosted checkout, payment, identity, or Marketplace Provider onboarding page, Stripe may use cookies, device identifiers, fraud-prevention signals, and similar technologies under Stripe's own notices. These technologies operate on a Stripe-controlled page or service and are not listed as Kamu first-party cookies.

9.2 Identity and verification services

An identity, credential, or background-screening provider may use its own cookies, camera permissions, device signals, or fraud-prevention technologies on a provider-controlled page or SDK. The provider's notice and the in-product Kamu disclosure identify the applicable processing.

9.3 External links and media

A link to another website is governed by that website's policies. If Kamu embeds or loads a third-party video, map, media player, or social component in the future, the component will be assessed and, where required, blocked until the user makes the applicable choice.

9.4 Google Fonts

The Kamu public website may load the Sora and Inter font families from fonts.googleapis.com and fonts.gstatic.com. When the browser requests a stylesheet or font file, Google receives ordinary network-request information such as the IP address, browser or device headers, requested resource, date, and time. The browser may cache the downloaded stylesheet or font file. Kamu does not use the font request to set a Kamu advertising cookie or build a Kamu advertising profile. Google's independent processing is governed by Google's privacy information.

9.5 Service providers acting for Kamu

Some infrastructure, security, communications, AI, and performance services process server-side information without placing or reading information on your device. Those services are described in the Privacy Policy rather than this register unless their deployed configuration uses a device technology covered by this Policy.

10.1 Current necessary-only configuration

Kamu does not infer consent from silence, inactivity, account creation, continued browsing, a device notification permission, or a pre-selected box. The absence of a general cookie banner reflects the current necessary-only Kamu cookie configuration and the absence of intentionally enabled optional advertising or audience-analytics technologies; it is not consent to any future optional technology.

10.2 Before optional activation

Before activating a cookie, SDK, pixel, identifier, or similar technology that requires consent, Kamu will provide controls appropriate to the technology and applicable law. These will include, where required:

blocking the optional technology before consent;
clear information about the provider, purpose, information, and duration;
an affirmative choice rather than silence or a pre-selected option;
accept and reject choices presented with equivalent ease;
granular controls for materially different purposes;
a persistent way to change or withdraw the choice;
a record of the notice and choice; and
renewed consent when a material change requires it.

Kamu will introduce a cookie or privacy-preference panel if optional web technologies make one necessary. Kamu does not represent that a consent-management platform is currently implemented.

10.3 Device- and browser-specific choices

A cookie or storage choice ordinarily applies only to the browser profile, device, or application installation where it was made. Clearing site or application data may remove the recorded choice. Another browser or device may require a separate choice.

Where an optional technology is enabled on the basis of consent, withdrawal will be available as easily as consent was given. Withdrawal stops future optional storage or access after it takes effect but does not make prior lawful processing unlawful. Additional privacy choices are described at https://kamu.ca/privacy/choices/.

11. GLOBAL PRIVACY CONTROL AND BROWSER SIGNALS

11.1 Global Privacy Control

Global Privacy Control ("GPC") is a browser or device signal used to communicate certain statutory opt-out requests. Kamu does not currently sell Personal Information or share it for cross-context behavioural advertising, and no such advertising practice is currently active for GPC to suppress.

The current Services do not use a GPC detector to change necessary cookie or storage behaviour because GPC does not require a necessary security function to be disabled. If Kamu introduces processing for which applicable law gives GPC operative effect, Kamu will recognize a legally valid GPC signal for the relevant browser or device and apply the required opt-out without requiring the user to create an account.

You may also contact privacy@razif.ca to exercise an applicable privacy right.

11.2 Do Not Track

There is no uniform legal or technical standard requiring one response to every generic browser "Do Not Track" signal. Kamu does not currently interpret a generic DNT signal as a universal request. This does not limit any right communicated through GPC or another signal that applicable law requires Kamu to honour.

12. YOUR CONTROLS

12.1 Browser controls

Most browsers allow you to view, block, or delete cookies and site data. Browser help pages explain how to:

delete cookies for a particular website;
block all or selected cookies;
clear local storage, session storage, cache, and site permissions;
restrict third-party cookies; or
use a private or guest browsing profile.

Blocking or deleting strictly necessary cookies or authentication storage may sign you out or prevent security, account switching, onboarding, transaction, or other requested functions from working.

12.2 Application and device controls

You can:

sign out or remove a saved account from the Kamu application;
clear Kamu's application data or uninstall the application;
change microphone, speech, camera, photograph, location, and notification permissions in device settings;
disable push notifications in Kamu or device settings;
disconnect Google, Apple, Microsoft, or another optional Connected Account;
change privacy and AI choices through Kamu settings; and
request account deletion as described in the Privacy Policy and at https://kamu.ca/account-deletion/.

Uninstalling the application or clearing local storage does not necessarily delete the Kamu account or server-side records.

12.3 Google and Apple controls

Google Account settings allow you to review or revoke Kamu's Google access. Apple Account settings allow you to manage Sign in with Apple authorization and Hide My Email. Revoking a provider authorization stops new access after revocation but does not itself delete the Kamu account. Use Kamu's account-deletion process to delete the Kamu account.

13. RETENTION AND SECURITY

13.1 Retention

Each register in this Policy states the ordinary lifetime or user control for the technology. In general:

the restricted-console cookies expire within 12 hours and are cleared on sign-out;
browser sessionStorage ordinarily ends with the browser tab or session;
browser localStorage may remain until the application removes it or the user clears site data;
native credentials remain until sign-out, account removal, account deletion, application reset, or invalidation;
preferences remain until changed, reset, or cleared;
push tokens remain until unregistered, invalidated, or removed with the account or application; and
browser or application caches follow the browser, operating-system, application-version, or cache-control lifecycle.

A server may revoke a credential before its local copy is removed. Conversely, deleting a local identifier does not necessarily delete the server-side account. Server-side retention is governed by the Privacy Policy.

13.2 Security

Kamu uses safeguards appropriate to the technology and risk. The restricted-console session cookie is HttpOnly, Secure, and SameSite=Strict; its companion anti-forgery cookie is Secure and SameSite=Strict and must match a protected request header. Designated native credentials use operating-system protected storage where supported.

Browser local storage is accessible to scripts that execute under the website origin. We minimize its use for secrets, protect the relevant origin, and treat local-storage authentication differently from an HttpOnly cookie or native protected store. No device-storage method can eliminate all risk.

14. CHILDREN

The general Services are not directed to children and are intended for people who are at least 18 years old and have the legal capacity required where they live. We do not intentionally use advertising technologies to profile children. If a separately authorized organization-managed program is offered to a younger participant, it will use age-appropriate notices, permissions, and controls required by law.

15. CHANGES TO THIS POLICY

We may amend this Policy to reflect changes in technology, the Services, vendors, law, or our practices. We will post the current version at https://kamu.ca/cookies/ and update the "Last Updated" date.

If a change introduces optional storage or access that requires consent, the revised text alone will not activate that technology. Kamu will first provide the applicable notice and choice described in Section 10.

16. CONTACT

Questions, privacy requests, or complaints concerning cookies or similar technologies may be directed to:

Privacy Officer
Kamu Administration Ltd.
Kamu, a Razif company
1322 Avenue G N
Saskatoon, Saskatchewan S7L 2A7
Canada
Email: privacy@razif.ca
Privacy choices: https://kamu.ca/privacy/choices/

Security concerns may be reported to security@razif.ca. Customer-support matters may be sent to support@kamu.ca.