Privacy policy

Kivvi is a loyalty app and service run by K2 Labs, based in Sharjah, United Arab Emirates ("we", "us"). Customers collect and spend points at shops and other businesses ("vendors") that use Kivvi. This policy explains what we collect, why, who sees it and the choices you have. If you have a question, write to support@k2labs.io.

What we collect

For customers using the app:

• Your email address, which you use to sign in. We email you a 6-digit code each time. There is no password.
• Your name and mobile number, which you give once when you create your account. Your mobile number must be unique.
• Your points: the vendors you collect points from, your balances, and a record of every earn, spend, transfer, return and expiry.
• Codes you enter or scan to receive or spend points, and the time you did so.
• Your approximate location, only if you allow it, to show which vendors are closest to you. Your location is used on your phone to sort the list. We do not store it.
• Nearby offers, only if you switch them on in Account and allow location "Always". Your phone watches a 100 metre circle around shops where you hold points and shows that shop's offer when you come near, at most once a day per shop. This happens on your phone. Your location is not sent to us or to the shop, and we do not know when you pass a shop.
• Announcements, only if you switch them on in the app (when asked, or later in Account) and allow notifications on your phone. We then store a push token, a code Apple gives your phone so we can send it a message, together with the type of phone, the app version and the date. Announcements are occasional short messages from Kivvi about news and updates. We do not use the token for anything else, and it is not shared with vendors.
• Your camera, only if you allow it, to scan a Kivvi code. We do not keep the camera image.

For vendors and their staff using the website or the manager part of the app: the vendor details they enter (business name, logo, contact details, address, opening details), staff usernames and display names, and the points they give and spend. Staff sign in with a username and password. Sign-in attempts are logged with an IP address to stop password guessing.

We do not use advertising, we do not track you across other apps or websites, and we do not sell your data.

How we use it

• To run your account, show your points and let you earn, spend and transfer them.
• To send you the sign-in code by email.
• To send you announcements from Kivvi, if you switched them on. Some announcements may be sent only to customers who hold points with a particular vendor, for example news about that vendor's programme.
• To let a vendor see who their customers are (your name, mobile number and email) and the points activity at their own business, so they can serve you and keep their accounts right.
• To keep the service safe: limiting repeated sign-in attempts, blocking misuse and fixing faults.
• To answer your support questions.

Who sees your data

A vendor sees the customers who hold or have used points with that vendor: your name, mobile number and email address, and the points you earned, spent, transferred or lost to expiry there, with the details of each transaction. This lets the vendor serve you, run their loyalty programme and keep their accounts right. A vendor does not see your points at other vendors, and only the vendor's own managers and owners can see this. Vendors must use your details only for their Kivvi loyalty programme.

We use these service providers to run Kivvi. They handle data only for us, to provide their service:

• Supabase, for the database and sign-in.
• Vercel, for hosting the website and the service that the app talks to.
• Resend, for sending the sign-in code emails.
• Apple, to deliver announcements to your iPhone through the Apple Push Notification service, if you switched them on. Apple receives the push token and the message.
• Cloudflare, for a bot check on the staff sign-in page.
• Google, to show a vendor's public Google rating in the directory. Only the vendor's public listing is requested, not anything about you.

We may also share information if the law requires it.

How long we keep it

We keep your account while you use Kivvi. Points expire according to each vendor's rules. Sign-in attempt logs are kept for about 30 days.

Deleting your account

You can delete your account at any time in the app: Account, then Delete account. We then remove your profile (name, mobile number, email), your sign-in and your push token. A record of points activity may stay at the vendor without your name or contact details attached, so that the vendor's accounts remain correct. You can also email support@k2labs.io and we will delete it for you.

Your choices

• You can change your name and mobile number in the app (Account, then Edit profile).
• You can switch announcements off at any time in the app (Account, then News from Kivvi), or turn off notifications for Kivvi in your phone's Settings. Signing out also stops announcements on that phone.
• You can turn off location or camera access for Kivvi in your phone's Settings. The app still works, with fewer features.
• You can ask us for a copy of the personal data we hold about you, or ask us to correct it.

Security

Data travels over encrypted connections. Sign-in uses one-time codes for customers, and staff accounts are protected by limits on repeated attempts and, for the platform administrator, a second sign-in step. No system is perfectly secure, but we take care to protect your data.

Children

Kivvi is not meant for children under 13, and we do not knowingly collect their data. If you think a child has given us data, tell us and we will delete it.

Changes to this policy

If we change this policy in a way that matters, we will update the date above and, where it makes sense, tell you in the app.

Contact

K2 Labs, Sharjah, United Arab Emirates. Email support@k2labs.io.