Privacy policy

KiwiDrive is run by a New Zealand sole trader ("we"). This policy explains what personal information we collect, why, where it goes and how long we keep it, as the Privacy Act 2020 requires. For any privacy question or request, email support@kiwico.online.

What we collect and why

• Your email address. It is your account. We use it to send your sign-in links and codes, to match your payment to your account and to reply when you contact us.
• Purchase details. When you pay, Stripe tells us the email address you entered at checkout, the amount, the currency, the date and Stripe's reference numbers, and later whether the payment was refunded or disputed. That is all we keep: Stripe's messages also carry the name and billing details you entered, and we discard those before storing anything. We never see or store your card number: the payment happens on Stripe's own pages, under Stripe's privacy policy.
• Your practice data. Which tests you started, the questions you were shown, your answers, your scores and how long each test took. This runs your dashboard, brings back the questions you got wrong and shows how consistent your recent results are.
• Sign-in records. Each time a sign-in link or code is requested or used, and each sign-out or session refresh, we record the time, your IP address and your browser and device (the "user agent"). We use these to limit sign-in attempts, to spot misuse and to show you your own recent sign-ins (with the IP address partly hidden). After 7 days the IP address is cut down to its network part and the browser details are replaced by a short label such as "Chrome on Android"; after 30 days the record is deleted. All of this is automatic.
• Your emails to us. Whatever you send to our support address, and our replies.
• Web server logs. Like most websites, our server logs each request: the IP address, the page, the time and the browser. We use them for security and to fix problems, and they are deleted after about a week.
• Changes we make to your account. If we add tests, move a purchase to a corrected email address or revoke access, we keep a record of who did it and when.

That's all. We don't ask for your name, age, address, phone number or licence details, and we don't build a profile of you beyond your own practice statistics.

No trackers, no cookies

We don't use advertising or analytics trackers, and we don't set cookies. The app keeps your sign-in session in your browser's local storage so you stay signed in, and it stores a copy of its own files so it loads quickly and can be added to your home screen. The free sample test stores nothing. Stripe's checkout page uses its own cookies, which Stripe controls.

Where your information goes

We are a New Zealand business, but the services we run on are overseas. Information privacy principle 12 of the Privacy Act 2020 covers sending personal information outside New Zealand, so here is exactly who receives what:

• Oracle Cloud (Oracle Corporation, United States) hosts our server, our database and our encrypted backups, in San Jose, California. Oracle stores the information on our behalf.
• Stripe (United States) takes payments and handles refunds. Stripe receives your email address, your card details and whatever else you enter at checkout, and handles them under its own privacy policy.
• Resend (United States) sends our sign-in emails. It receives your email address and the content of each sign-in email, and our account sends from its servers in Tokyo, Japan.
• ImprovMX forwards email sent to our KiwiDrive addresses to our mailbox, so an email you send us passes through its servers.
• Google (Gmail) provides our mailbox, where your emails to us and our replies are stored.

These providers are outside New Zealand and may not be required to protect your information in a way that is comparable to New Zealand law. We choose providers with strong security, we send each one only what it needs, and we protect the information with encrypted connections, access controls and encrypted backups. By buying from us or using the app, you agree to your information being held and processed overseas as described here.

Nobody else gets your information. Our code is kept and deployed through GitHub and our domain is registered with GoDaddy, but neither holds customer information. We don't sell or rent personal information, and we only disclose it beyond this list if the law requires it.

How long we keep it

• Your account and practice data: while you have an account. You can ask us to delete it at any time. An account that still has unused tests is kept until you use them or ask us to delete it, because tests never expire. An account with no tests left and no sign-in for a year is deleted automatically.
• Purchase records (date, amount, currency, pack, Stripe's reference numbers and the email address): 7 years after the purchase, which is how long New Zealand tax law requires business records to be kept. When your account is deleted, the email address is removed from them.
• Sign-in records: full details for 7 days, cut down after that, deleted after 30 days.
• Web server logs: about a week.
• Your emails to us: a year after the last message in the conversation, or sooner if you ask.
• Backups: each nightly backup is deleted after 14 days, so deleted information is gone from backups within two weeks.

How we protect it

Every connection is encrypted (HTTPS). The database can only be reached by our own server software, never directly from the internet. Backups are encrypted before they leave the server. Sign-in uses one-time codes emailed to you, so there is no password to steal. Only the owner can see customer records, and every change made in the admin area is logged.

If a privacy breach ever happens and it is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and the people affected, as the Privacy Act requires.

Your rights

You can ask us for a copy of the information we hold about you, ask us to correct it, or ask us to delete your account. Email support@kiwico.online from the address on your account: that is how we confirm it's you, and we only reply to that address. We answer within 20 working days, and usually much sooner.

When you ask us to delete your account:

• we delete your account, your practice data and your sign-in records, and any unused tests are gone with them;
• we keep the purchase records for the 7 years tax law requires, with your email address removed from them; Stripe keeps its own record of the payment;
• copies in our backups disappear within 14 days.

You can also clear your own practice progress at any time with "Reset my progress" on your dashboard. If you're not happy with how we've handled your information, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

Emails we send

We only send emails you need: sign-in codes and links, and messages about your purchase or a request you've made. Stripe emails your receipt. We don't send marketing email. If we ever want to, we will only send it to people who have opted in, and every message will have an unsubscribe link, as the Unsolicited Electronic Messages Act 2007 requires.

Young learners

KiwiDrive is for people preparing for the New Zealand learner licence theory test, who are normally 16 or older. We don't ask for your age or any other details about you. If you're under 16, please have a parent or guardian make the purchase and help you with this policy.

Changes to this policy

If we change this policy, we update the date at the top. If a change affects how we use information we already hold about you, we will tell you by email first.