Privacy Policy

This policy explains what personal information Kivvo collects, why we collect it, how we use it, who we share it with, how long we keep it, and what rights you have in relation to it. It sits alongside our general Terms of Service, which continue to apply.

We've tried to write this in plain English. If anything is unclear, please submit a support ticket via the Support page.

The short version

We collect the information we need to run Kivvo — your account details, your goals and contributions, payment information handled by our payment provider, and technical information about how you use the service.

We use it to operate Kivvo, keep it secure, and improve it. We don't sell your data, and we don't use it for advertising.

We share information with a small number of trusted service providers — mainly Stripe (payments) and Supabase (data storage and authentication).

We keep information for as long as we need it to provide the service and meet our legal obligations.

You have rights under the New Zealand Privacy Act 2020 — including the right to access and correct your personal information.

You can download your account and contribution data from the Data Requests area of your account.

Kivvo is a very small New Zealand company — currently two people. We're honest about that, and it shapes how we handle your information.

Who we are

Kivvo is a small New Zealand company building a savings app for New Zealanders. When this policy says "we", "us", or "Kivvo", it means the Kivvo entity responsible for your information.

Because Kivvo is early-stage and small, our approach to privacy is direct: we collect as little as we can, we use what we collect only for running Kivvo, and we tell you clearly what we do.

What personal information we collect

We collect personal information in the following categories.

1. Information you give us when you sign up

Email address — used to create and identify your account

Display name or username — shown in the app

Password — stored securely (we don't store passwords in plain text; authentication is handled by our authentication provider)

Profile details you choose to add, such as your name, profile picture, and preferences

2. Information about your use of Kivvo

Goals you create — target amounts, target dates, priorities, and progress

Contributions you make — amounts, dates, schedules, goal allocations, and payment status

Kivvo Saver balances — including unallocated balances and any cashback credited to you

Notification preferences — what you want to be told about and how

Watchlist items — items you're tracking for price changes

Support ticket history — including tickets you raise, replies you send, and the resolution of each ticket

3. Payment information

Kivvo does not store your full payment card details. Payments are processed by our third-party payment provider, Stripe.

We do store, and can see:

The last four digits of a card you've saved

The card brand (e.g. Visa, Mastercard)

The expiry month and year of a saved card

The identifier Stripe uses to reference a saved card or bank mandate

Whether a payment method is active, expired, or removed

We do not store, and cannot see:

Your full card number (the long number on the front of the card)

Your CVC (the three-digit security code on the back)

Your bank account number in full

Your bank login credentials

4. Information about your device and how you access Kivvo

When you use Kivvo, our hosting and analytics providers automatically record some technical information, such as:

IP address

Browser type and version

Device type (mobile, tablet, desktop)

Operating system

Pages you visit within Kivvo and when you visit them

Referring URL — where you came from before arriving at Kivvo

Performance data — such as page load times, used to help us improve Kivvo's speed and reliability

5. Communications between you and us

Support tickets — the content of any tickets you raise, including any attachments

Replies from our team

In-app notifications you receive

6. Cookies and similar technologies

We use cookies and similar technologies as described in our Cookie Policy. Some of the information collected by cookies may be personal information.

What we don't collect

To be clear, Kivvo does not collect:

Your full card number or CVC (Stripe handles this)

Your bank account password or login credentials

Bank statements or transaction feeds from your bank account

Government identifiers such as your IRD number, driver's licence, or passport (unless we're ever legally required to)

Biometric data

Health information

Precise location data beyond a rough country-level inference from your IP address

If any of this ever changes, we'll update this policy and tell you.

Why we collect it

We use your personal information for the following purposes:

To provide Kivvo

Creating and managing your account

Setting up and processing contributions

Tracking goal progress

Calculating and crediting cashback (where eligible)

Sending you in-app notifications

Responding to your support tickets

To keep Kivvo secure

Preventing fraudulent activity

Detecting unusual patterns that might indicate account compromise

Maintaining session security

Complying with fraud prevention obligations

To improve Kivvo

Understanding which features are used most

Identifying where users get stuck

Measuring performance and reliability

Prioritising product development

To meet our legal obligations

Complying with New Zealand law where it applies

Responding to lawful requests from authorities

Maintaining records where required (for example, for tax)

To communicate with you

Responding to your support tickets

Sending service notifications (for example, if your payment method fails)

Informing you of material changes to our terms or policies

We do not use your personal information for advertising, and we do not sell your personal information.

Who we share it with

We share personal information with a small number of trusted third-party service providers who help us run Kivvo. We choose these providers carefully, and we only share what's necessary.

Current service providers

Each of these providers has its own privacy policy, and their use of your information is governed by their terms. We recommend reviewing their policies if you'd like more detail.

When we might share information more broadly

We may share personal information in the following situations:

Legal requirements — if we're required to by law, including in response to a court order, warrant, or lawful request from a New Zealand authority

Fraud or safety — if we believe disclosure is necessary to prevent or investigate fraud, a security issue, or harm to any person

Business transfer — if Kivvo is ever sold, merged, or restructured, your information may be transferred as part of the business. If that happens, we'll update this policy and notify you

With your consent — if you ask us to share information with someone else, we'll do so

We do not sell personal information to anyone, ever.

International transfers

Some of our service providers (like Stripe, Supabase, and Vercel) may store or process your information outside New Zealand, including in the United States, the European Union, or other jurisdictions.

When information is transferred internationally, we take steps to ensure it's protected in a way that's consistent with the New Zealand Privacy Act 2020. Our providers maintain industry-standard security and privacy practices, including compliance with frameworks such as SOC 2 and GDPR where applicable.

By using Kivvo, you understand that your information may be processed outside New Zealand in this way.

How long we keep your information

We keep personal information for as long as we need it to provide the service and to meet our legal obligations. Specifically:

When we no longer need your information, we delete it or anonymise it. Where we can't delete it entirely (for example, from encrypted backups), we'll isolate it and take steps to prevent further use.

If you close your account, we'll delete or anonymise your personal information in accordance with the periods above. Some information may be retained for longer where we're legally required to, or where it's necessary for legal claims.

Your rights

Under the New Zealand Privacy Act 2020, you have the right to:

Access your personal information

You can request a copy of the personal information we hold about you. We'll provide it within a reasonable time, usually within 20 working days.

Correct your personal information

If any information we hold about you is wrong, incomplete, or out of date, you can ask us to correct it.

Request deletion

You can ask us to delete your personal information. We'll do so where we're not required by law to keep it and where retention isn't necessary for legal claims. Some information (such as tax records) we're required to retain for a period even after account closure.

Withdraw consent

Where we rely on your consent to process information, you can withdraw that consent at any time. Withdrawing consent may mean we can no longer provide some parts of the service.

Complain

You can complain to us about how we've handled your personal information. If you're not satisfied with our response, you can complain to the Office of the Privacy Commissioner.

How to exercise your rights

Self-service downloads

You can download your account and contribution data from the Data Requests area of your account:

Account data — profile, goals, linked bank and card details, watchlist, and notifications, in CSV or PDF

Contribution history — contribution dates, amounts, schedules, goals, and payment status, in CSV or PDF

These downloads are features we provide to make it easy for you to access your information.

Requests we can't handle via self-service

For some requests — such as correction of information, deletion requests, or copies of information not included in the downloads — you'll need to submit a support ticket via the Support page.

We'll respond to your request within a reasonable time, typically within 20 working days. If we can't fulfil a request (for example, because we're legally required to retain the information), we'll tell you why.

Statutory rights

The New Zealand Privacy Act 2020 gives you the right to request access to and correction of personal information. The self-service downloads on Kivvo are features we provide as part of the service — they don't replace or limit your statutory rights. You can always make a formal access or correction request by submitting a support ticket.

Cost

We don't charge for access or correction requests, other than in exceptional circumstances where meeting a request would be unusually complex or costly.

Security

We take the security of your information seriously. Steps we take include:

Using industry-standard encryption for data in transit and at rest

Storing passwords securely through our authentication provider (we don't store plain-text passwords)

Not storing full payment card details on our systems

Restricting internal access to personal information to those who need it

Monitoring for unusual activity

Keeping our dependencies and infrastructure up to date

No system is perfect. While we work hard to protect your information, we can't guarantee absolute security. If you become aware of a security concern, please report it through our Vulnerability Disclosure page or via a support ticket.

If there's ever a privacy breach that affects you, we'll notify you and the Office of the Privacy Commissioner where we're required to.

Children

Kivvo is not intended for children. We don't knowingly collect information from anyone under 16. If you believe a child has provided us with personal information, please contact us so we can remove it.

Automated decision-making

We use automated processes to:

Allocate contributions across your goals according to the rules you've set

Determine cashback eligibility according to our Payouts Policy

Detect potentially fraudulent activity for security purposes

We don't use automated processes to make decisions that would have a legal or similarly significant effect on you without human review, except where necessary for fraud prevention or security.

You can see how your contributions are allocated in your contribution history. If you believe an automated decision was incorrect, you can raise it via a support ticket.

Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes:

We'll update this page and the "last reviewed" date.

We'll notify you where the change materially affects how we handle your information.

Where a change requires your consent, we'll ask for it before the change applies.

How to contact us

For privacy questions, access requests, correction requests, deletion requests, or complaints:

Submit a support ticket via the Support page.

We don't use email for support. All privacy-related correspondence goes through the same support process.

If you're not satisfied with how we've handled a privacy matter, you can complain to the Office of the Privacy Commissioner (privacy.org.nz).

Where to find more detail

For more information, see:

Cookie Policy — what cookies we use and how to control them

Terms of Service — the general agreement between you and Kivvo

Data Requests — how to access or correct your data

Financial Services Disclosures — Kivvo's regulatory position

Complaints Policy — how to raise a concern

Vulnerability Disclosure — how to report a security issue

This page was last reviewed in October 2026.