This Privacy Policy explains how KIVI Global ("KIVI", "we", "us" or "our") collects, uses, shares and protects personal information when you use the KIVI mobile applications, the web app at app.kivicard.com, the website at www.kivicard.com and related services (the "Services"). KIVI is the controller of the personal information described in this policy.
KIVI is built to collect as little as possible. Your recovery phrase, private keys and biometric data never leave your device in readable form.
1. Information you give us
- Account information: your email address and, if you choose, a display name.
- Payment PIN: we store only a salted cryptographic hash of your PIN, never the PIN itself.
- P2P information: the payment methods and account details you add as a seller, order details, payment receipts you upload and messages you send in order chat.
- Chat: messages, images and contacts you send or add in chat.
- Identity verification: when you apply for the KIVI Card, your name, date of birth, nationality, address, government-issued ID, selfie or liveness data, and any other information required by the card issuer or by law.
- Support: information you provide when you contact us.
2. Information we collect automatically
- Wallet addresses: the public addresses of your KIVI wallet, linked to your account so we can show balances and support features such as P2P and card top-ups.
- Session and device information: session tokens (stored as hashes), the browser or device type (user agent), and the time sessions are created and expire.
- Passkey information: if you turn on Face ID, the passkey's credential ID, public key, signature counter and creation and last-used times.
- Encrypted wallet backup: an encrypted copy of your recovery phrase that we cannot decrypt (see Section 3).
- Security information: failed verification code and PIN attempts and lockout times.
- Log data: IP addresses, request times and error information recorded by our servers for security and troubleshooting.
We do not use advertising cookies, third-party analytics or cross-site tracking.
3. What we do not collect
- Your recovery phrase and private keys. They are generated and encrypted on your device. If you use the Face ID backup, the phrase is encrypted on your device with a key derived from your passkey before upload, and we hold only ciphertext we cannot read.
- Your biometric data. Face ID and fingerprint matching is performed by your device's operating system. We receive only a signed confirmation and a public key.
- Your fiat payment credentials. P2P fiat payments are made directly between users outside KIVI.
4. Information stored on your device
The app stores data on your device to work, including your encrypted wallet, a device encryption key (in the iOS Keychain, Android Keystore or a non-extractable browser key), your session token, language and display preferences, and locally cached balances and activity. This data stays on your device unless described otherwise in this policy, and is removed when you delete the app or clear your browser data.
5. Public blockchain data
Blockchain transactions, including the sending and receiving addresses and amounts, are recorded on public blockchains. This information is public, permanent and outside KIVI's control, and cannot be changed or deleted by us. Anyone who can link your identity to a wallet address may be able to see your transaction history.
6. How we use information
- To create and manage your account and sign you in, including sending verification codes by email.
- To provide the Services, such as showing balances, building transactions for you to sign, operating P2P orders and chat, and providing the KIVI Card with our partners.
- To keep the Services and your account secure, including enforcing PIN and code limits and detecting fraud and abuse.
- To meet legal obligations, including identity verification, anti-money laundering, sanctions screening and responding to lawful requests.
- To communicate with you about your account, transactions, security and changes to our terms.
- To maintain, troubleshoot and improve the Services.
- To resolve disputes, including P2P disputes, and to enforce our Terms.
We do not sell your personal information or use it for targeted advertising.
7. Legal bases
Where data protection laws such as the GDPR apply, we process personal information because it is necessary to perform our contract with you, to comply with legal obligations, for our legitimate interests in operating a secure and reliable service (balanced against your rights), or, where required, with your consent, which you may withdraw at any time.
8. How we share information
We share personal information only as described below:
- Service providers who process data for us under contract, such as hosting, email delivery and customer support providers.
- Identity verification providers and the KIVI Card issuer, program manager and card network, to verify your identity, issue and operate your card and meet their legal obligations. They may also act as independent controllers under their own privacy policies.
- Blockchain infrastructure and data providers. To show balances, prices and quotes and to broadcast your transactions, the app sends your public wallet addresses and transaction data to node providers, market data providers and swap aggregators. These requests come from your device, so those providers may also see your IP address.
- Other users: in P2P trading, your counterparty sees your display name, order details and, if you are the seller, the payment details you choose to show. Chat recipients see the messages you send them.
- Arbitrators and dispute reviewers, who may review order details, chat messages and receipts to resolve a P2P dispute.
- Authorities and others where required by law, regulation, legal process or a government request, or where necessary to protect the rights, property or safety of KIVI, our users or others.
- A buyer or successor in connection with a merger, acquisition, financing or sale of assets, subject to this policy.
9. International transfers
We and our providers may process information in countries other than the one where you live, which may have different data protection laws. Where required, we use appropriate safeguards such as standard contractual clauses for these transfers.
10. Retention
- Account information is kept while your account is active and deleted or anonymized after you delete your account, unless we must keep it longer.
- Email verification codes expire after 10 minutes and are deleted periodically.
- Sessions are kept until they expire or you sign out.
- Passkeys and the encrypted wallet backup are deleted when you turn off Face ID or delete your account.
- Identity verification, transaction and P2P dispute records are kept for as long as required by anti-money laundering and other laws, typically five years after our relationship ends.
- Server logs are kept for a limited period for security purposes.
11. Security
We use technical and organizational measures to protect personal information, including encryption in transit, hashed PINs and session tokens, rate limits and lockouts, and a design in which your keys are never held by us. No system is completely secure, and you are responsible for protecting your devices, email account, PIN and recovery phrase.
12. Your rights
Depending on where you live, you may have the right to:
- access the personal information we hold about you and receive a copy;
- correct inaccurate information;
- delete your information;
- restrict or object to certain processing;
- receive your information in a portable format;
- withdraw consent where processing is based on consent; and
- lodge a complaint with your local data protection authority.
To exercise these rights, email official@kivicard.com from the address linked to your account. We may need to verify your identity and will respond within the time required by law. Some information, such as identity verification records, may need to be kept to meet legal obligations, and public blockchain data cannot be deleted.
13. Children
The Services are not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.
14. Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you in the app or by email before they take effect. The effective date at the top shows when it was last updated.
15. Contact
If you have questions about this policy or our privacy practices, contact:
KIVI Global
Email: official@kivicard.com
Website: www.kivicard.com
This policy may be provided in several languages. If there is any inconsistency, the English version prevails.