Kiwio POS — Privacy Policy
Version 1.0 · Effective 14 October 2026
This policy explains what personal information the Kiwio POS app ("Kiwio", "we", "us") collects, why, who it is shared with, how long it is kept, and how you can access, correct or delete it. Kiwio is a point-of-sale system for takeaway food businesses. We handle personal information in line with the New Zealand Privacy Act 2020.
1. Who is responsible
Kiwio is responsible for the personal information processed through the Kiwio POS app.
Contact: [email protected]
2. Who uses Kiwio
Kiwio is used by businesses (merchants) and their staff. The merchant creates an account, registers its devices and invites staff. End customers of the merchant do not create accounts in Kiwio.
3. Information we collect
| Category | What | Why |
|---|---|---|
| Account | Name, email address, phone number (optional), recovery email (optional), role | Sign-in by one-time email code, account management, contacting you about your account |
| Business profile | Business name, GST number, support email and phone, location name and city | Showing the business on receipts and orders, tax information on receipts |
| Menu | Product names, descriptions, prices, modifiers, product photos you upload | Running the menu and the shop screen |
| Orders | Items, quantities, totals, the customer label typed at the counter (for example a first name for pickup), time of order, device that took it | Taking, preparing and reporting orders |
| Payments | Payment amount, status, method type and the reference returned by the payment processor | Recording that an order was paid and reconciling the cash-up |
| Devices | Device name, platform, app version, a one-way hash that identifies the device, last activity time | Registering tills and kiosks, keeping sessions secure |
| Diagnostics | Crash reports and basic usage events (Firebase Crashlytics and Firebase Analytics), including app instance identifiers and the device advertising ID | Fixing crashes and improving stability. The advertising ID is read by the Firebase SDK for analytics only; Kiwio shows no ads and does not use it for advertising |
Card data. Kiwio never sees or stores full card numbers, PINs or security codes. Card payments are read by the certified card reader and processed directly by the payment processor (Stripe Terminal or Windcave).
What we do not collect. We do not collect contacts, messages, call logs, health data or precise location history, and we do not sell personal information or use it for advertising.
4. Device permissions
| Permission | Why |
|---|---|
| Bluetooth | Connecting to the card reader and to receipt or kitchen printers |
| Location | Required by the card reader SDK to discover Bluetooth readers and for payment fraud prevention. Kiwio does not store your location |
| Photos (when you choose a picture) | Adding a product photo to the menu |
| NFC | Tap to Pay card payments on supported devices, through the payment processor SDK |
| Phone state | Required by the card reader SDK to identify the device for payment security. Kiwio does not read your phone number or calls |
| Internet and network state | Syncing orders and menu with the Kiwio server, working offline when there is no connection |
You can refuse a permission in the system settings; the feature that needs it will stop working, the rest of the app keeps working.
5. Who we share information with
We share information only with service providers that process it on our behalf:
- Payment processors (Stripe, Windcave) — to take card payments and onboard the merchant for payouts.
- Google Firebase — crash reporting and app diagnostics.
- Hosting providers — the servers that run the Kiwio API and database.
We disclose information to authorities only when the law requires it.
6. Security
All traffic between the app and our servers uses HTTPS (TLS). Sign-in uses one-time codes sent by email, sessions expire, payment provider credentials are stored encrypted, and access to production data is restricted.
7. Retention
We keep account, business, menu and device information while the account is active. Order and payment records are kept for 7 years after the transaction, because New Zealand tax law (Tax Administration Act 1994) requires businesses to keep business records for that long. Crash reports are kept for up to 90 days.
8. Your rights
You can ask us to access or correct your personal information at any time by writing to [email protected]. We will answer within 20 working days. If you are not satisfied, you can complain to the Office of the Privacy Commissioner (privacy.org.nz).
9. Delete your account and data
You can ask us to delete your Kiwio account and its data:
- In the app, open Profile → Delete my account, or go straight to step 2.
- Send an email to [email protected] from the email address of your Kiwio account, with the subject "Delete my account". If you are the business owner, say whether you want to delete only your user or the whole business.
- We confirm the request by email and delete the account within 30 days.
What is deleted: your user account, sign-in sessions and registered devices; for a whole business, also its profile, menu, staff accounts and payment provider connections.
What is kept: order and payment records that the law requires us to keep (section 7). They are kept only for that purpose and deleted when the retention period ends.
10. Children
Kiwio is a business tool and is not directed to children under 16.
11. Changes to this policy
We will publish any change on this page with a new version number and effective date.