1. Overview
This Privacy Policy explains how Kiiwis (operated by Zaldana Services LLC) collects, uses, discloses, and protects information when you use our platform — whether you are a Business Owner (a merchant who subscribes to Kiiwis) or an End Customer (a consumer who joins a loyalty program through a Kiiwis QR code or link). By using Kiiwis, you agree to this Privacy Policy.
2. Who We Are
Kiiwis is owned and operated by Zaldana Services LLC. References to "Kiiwis", "we", "us", or "our" refer to the Kiiwis platform at Kiiwis.com. For data privacy purposes, Kiiwis acts as:
- Data Controller for information Business Owners provide directly to us (account data, billing, usage)
- Data Processor for End-Customer loyalty data, which is collected and owned by the Business Owner
3. Data We Collect
3.1 Business Owner Account Data
When you register as a Business Owner: full name, email, password, business name, type, address, phone, country, billing information (via Stripe — we do not store raw card data), profile settings, dashboard activity, campaigns, automations, and communications with our support team.
3.2 Automatically Collected Technical Data
IP address, browser type, OS, device identifiers, pages visited, session tokens (via Supabase Auth), error logs and performance data.
3.3 Payment Data
All payments are processed by Stripe, Inc. We retain only your Stripe customer ID, subscription status, and billing history. We never store card numbers, CVV, or bank details.
4. End-Customer Data
End Customers join loyalty programs by scanning a QR code or using a share link at a business using Kiiwis. The following data is collected on behalf of the Business Owner: phone number, first name (optional), visit history, receipt uploads, spending data, loyalty status, reward progress, redemption history, and opt-in/opt-out timestamps.
4.1 Consent for Messaging
End Customers provide explicit consent to receive loyalty-related messages at the time of enrollment. Consent is recorded with a timestamp and channel. End Customers can opt out at any time by replying STOP to any message.
5. How We Use Your Data
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Provide and operate the platform | Account data, usage data | Contract performance |
| Process loyalty transactions and messaging | End-Customer data | Contract / Legitimate interest |
| Process subscription payments | Billing data (via Stripe) | Contract performance |
| Product updates and service communications | Email address | Legitimate interest (opt-out available) |
| Customer support and troubleshooting | Account and usage data | Legitimate interest |
| Security and fraud prevention | Technical data, IP address | Legitimate interest |
| Platform analytics and improvement | Aggregated usage data | Legitimate interest |
| Legal compliance | All data as required | Legal obligation |
6. How Kiiwis Uses Platform Data to Improve the Service
6.1 What We Do
We use aggregated and anonymized data to generate benchmarks, improve the platform, and detect fraud. No individual business or customer is identifiable in these processes.
6.2 AI Features and Third-Party Processing
Kiiwis uses artificial intelligence to power the AI campaign message writer and analytics suggestions. Message content you create may be processed by Anthropic, Inc. (our AI provider) solely to generate suggested text. This processing is subject to Anthropic's data processing agreements. Campaign content is never used to train AI models without explicit consent, and no identifiable End-Customer data is shared with Anthropic.
6.3 What We Never Do
- Sell individual data — Business Owner or End Customer — to any third party
- Share a Business Owner's customer list with any other business
- Use End-Customer data for Kiiwis's own marketing campaigns
- Share identifiable data with advertisers or ad networks
7. SMS & Messaging (A2P 10DLC)
Your mobile number and SMS opt-in information will not be shared with third parties or affiliates for marketing or promotional purposes. All categories of data exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.
7.1 Message Types
- Transactional: Welcome messages, reward confirmations, redemption receipts
- Automated loyalty: Win-back messages, birthday messages, spend milestone notifications
- Campaigns: Promotional messages sent by Business Owners to opted-in customers
7.2 Consent & Opt-Out
End Customers provide explicit opt-in consent at enrollment. Reply STOP to any SMS to opt out immediately. Reply HELP for assistance. Message and data rates may apply.
7.3 Direct Messaging (LATAM)
For customers in Latin American markets, Kiiwis delivers messages via WhatsApp and direct messaging channels. The same opt-in, opt-out, and data protection rules apply.
8. Data Sharing & Third Parties
We do not sell, rent, or trade personal data. We share data only with service providers required to operate the platform:
| Provider | Purpose | Data Shared |
|---|---|---|
| Supabase | Database hosting and authentication | Account data, End-Customer data |
| Stripe, Inc. | Payment processing | Billing information |
| Twilio, Inc. | SMS delivery (US) | Phone numbers, message content |
| Anthropic, Inc. | AI campaign message generation | Campaign content (anonymized, no End-Customer PII) |
| Hosting provider | Platform hosting and CDN | Technical request data |
All providers are contractually bound to process data only as instructed and maintain appropriate security measures.
Legal Disclosure
We may disclose data if required by law, court order, or to protect the rights and safety of our users.
Business Transfer
In a merger or acquisition, user data may be transferred. We will notify affected users and provide an opportunity to export or delete data before any transfer.
9. Data Retention
- Business Owner account data: retained for subscription duration plus 90 days, then deleted
- End-Customer loyalty data: retained while Business Owner account is active; deleted within 30 days of account closure
- Payment records: 7 years as required by financial regulations
- SMS consent records: minimum 4 years per carrier compliance requirements
- Technical logs: up to 90 days
- Support communications: 2 years
10. Security
- All data in transit encrypted using TLS 1.2 or higher
- Database encryption at rest via Supabase's managed infrastructure
- Authentication via Supabase Auth with OAuth 2.0 support
- Role-based access controls limiting internal data access
- Passwords hashed using bcrypt — plaintext passwords are never stored
11. Your Rights
Depending on your location, you may have the right to access, correct, delete, port, restrict, or object to processing of your personal data. To exercise any right, email info@kiiwis.com. We respond within 30 days.
12. California Privacy Rights (CCPA / CPRA)
California residents may request disclosure of data collected, deletion of personal information, and have the right to non-discrimination for exercising CCPA rights. We do not sell personal information. Submit requests to info@kiiwis.com with subject "CCPA Request".
13. GDPR & International Transfers
For EEA, UK, and Switzerland users: legal bases include contract performance, legitimate interests, legal obligation, and consent. Data may be processed in the United States via Standard Contractual Clauses (SCCs). For GDPR inquiries contact info@kiiwis.com.
14. Cookies & Tracking
| Type | Purpose | Duration |
|---|---|---|
| Essential | Authentication, session management, security | Session / 30 days |
| Functional | Language and preference settings | 1 year |
| Analytics | Aggregate usage statistics to improve the platform | Up to 2 years |
We do not use cookies for advertising or third-party behavioral tracking. See our full Cookie Policy.
15. Children's Privacy
Kiiwis is not directed at children under 13 (or 16 in the EEA). We do not knowingly collect data from children. Contact info@kiiwis.com if you believe a child has provided personal data.
16. Changes to This Policy
When we make material changes, we will update the "Last Updated" date and notify Business Owners by email at least 14 days before changes take effect.
17. Contact
General & Privacy: info@kiiwis.com
Security: security@kiiwis.com
Legal: legal@kiiwis.com