Legal

Privacy policy

What Kiwiback collects about the people who run a venue on it and about visitors to this website, why, who else handles it, and how to have it deleted.

Effective 17 October 2026.

Scanned a QR code at a restaurant? This page isn't about you. The privacy notice for guests explains what happens to your answers and your coupon.

1. Who we are

Kiwiback is a service for restaurants, cafés and other venues. Guests scan a QR code at the table, answer a short survey and get a coupon for their next visit. The venue's team runs it from the Kiwiback app.

For the data described on this page, Kiwiback Oy (Finland) is the data controller. You can reach us at hello@kiwiback.com.

2. Who this covers

• The venue's team: owners, managers and till staff who use the Kiwiback app.
• Customers: the business that pays for a plan.
• Visitors to kiwiback.com.

Guests are different. When a guest answers a venue's survey, the venue decides what is asked and what happens to the answers, so the venue is the data controller and Kiwiback processes the answers on its behalf. That is described in the privacy notice for guests, and our duties to the venue are in the terms.

3. What we collect and why

Your account

• Name and email address when you create an account, and a phone number if you add one. We use them to sign you in and to send you messages about your account.
• Till staff have no email or phone with us. A manager types in their name and pairs their phone by scanning a code.
• Sign-in. We email you a six-digit code. We store only a scrambled form of it (a hash), and delete it once it's used or after five minutes. The app keeps your sign-in token in your phone's secure storage. We record when each team member last signed in.

Legal basis: performing our contract with the venue you work for, or with you (GDPR Article 6(1)(b)).

Your venue

• What you set up: the venue's name and type, logo, colours, WhatsApp number, Google review link, survey, coupon and QR posters. A logo is converted to PNG when you upload it, which removes any photo metadata.
• Finding your venue on Google. During setup, your search is sent to Google Maps by our server, not by your phone, so Google doesn't receive your IP address. We keep only the listing's ID and its review link. The listing's photos and rating aren't stored.
• Reading your website. If you give your venue's website during setup, your phone reads it to suggest your logo, colours, WhatsApp number and privacy link. Our servers never fetch it, and nothing is saved until you confirm.
• Which team member made each change to the survey, and who redeemed each coupon.

Legal basis: performing the contract (Article 6(1)(b)).

Billing

When you choose a plan, Stripe handles payment. Your card details go to Stripe and never reach us. We send Stripe your email address and the organisation's name. From Stripe we store the legal name, tax ID and billing address you give at checkout, your Stripe customer ID, and your plan, status and dates.

Legal basis: performing the contract (Article 6(1)(b)), and keeping accounting records as the law requires (Article 6(1)(c)).

Emails we send

Sign-in codes, confirmations when your email or phone changes, and reminders before an account is deleted after its plan ends. We don't send marketing email.

Crash reports and server logs

• Crash reports. When the app or our server hits an error, a report goes to Sentry so we can fix it. It includes the error, where in the code it happened, the app version and the device model and system version. We don't attach your name or email to it, and there is no screen recording. A server-side report can contain values the server was handling when the error happened, which may include personal data. We also send timing data for a sample of requests, to find slow screens.
• Server logs record requests to our servers, including IP addresses. They are kept in a fixed amount of space, and the oldest are overwritten as new ones arrive.

Legal basis: our legitimate interest in keeping the service working and secure (Article 6(1)(f)).

When you write to us

We keep what you send and our replies, to answer you and to help with the same problem later. Legal basis: legitimate interest (Article 6(1)(f)).

This website

kiwiback.com sets no cookies and runs no analytics or advertising. Cloudflare serves the pages, and the fonts are loaded from Google Fonts, which receives your IP address when your browser fetches them. The pricing page uses your browser's language to choose a currency, without sending it anywhere.

What we don't do

We don't sell personal data. We don't show ads or track you across other apps and websites. We don't make automated decisions about you that have legal or similarly significant effects.

4. Who else handles it

These providers run parts of Kiwiback for us. Each receives only what its task needs.

Before we start sending sign-in codes by SMS or WhatsApp, we'll add Twilio to this list.

When data leaves the European Economic Area, it is protected by the EU–US Data Privacy Framework where the provider is certified under it, and by the European Commission's Standard Contractual Clauses otherwise.

We disclose personal data to authorities only when the law requires it.

5. How long we keep it

• While your account exists, for as long as you use Kiwiback.
• Sign-in and pairing codes are deleted when used, or after five minutes.
• When a trial or plan ends without a new plan, the account stays for 30 days. We email reminders 7, 3 and 1 days before deleting it. Choose a plan in that time and nothing is lost.
• When an account is deleted, by you or after those 30 days, its contents are deleted straight away: surveys, guests' answers, coupons, QR codes, the logo and the team's access. Deletion is final.
• What remains after deletion is a minimal record: the organisation's name and dates, its billing records, and for each person a masked trace of their name, email and phone, such as A•• G••, an•••@tr•••.com and +34 ••• ••• •37. The full email and phone are erased, so the email can be used for a new account at once. The trace lets us recognise a former customer who writes to us, without keeping anything that identifies them on its own.
• A team member a manager removes gets the same treatment: their sign-in details are erased and a masked trace is kept. A till staff member's name stays on the venue while it exists, so past redemptions still show who made them.
• Billing records stay with us and with Stripe for as long as accounting and tax law requires.
• Crash reports are deleted after Sentry's retention period. Server logs are overwritten as described above.

6. Deleting your account

You can delete your account in the app, or ask us to delete it.

• In the app: deleting your account's last location deletes the whole account. Only a manager can do it, and only while no paid plan is running. If you're on a paid plan, cancel it in Settings → Billing first. You can delete the account once the paid period ends.
• One team member: a manager can remove any other team member in the app.
• By email: write to hello@kiwiback.com from the address on the account, and we'll delete it within 30 days. That includes a team member who wants to be removed and can't ask a manager to do it.

Section 5 describes what deletion removes and the little that remains.

7. Your rights

Under the GDPR you can ask us to:

• send you a copy of your personal data (access and portability);
• correct it;
• delete it;
• restrict how we use it, or object to a use based on legitimate interest.

Write to hello@kiwiback.com. We'll answer within a month, and may ask you to confirm you own the account first. You can also complain to a data protection authority. In Finland that is the Data Protection Ombudsman; you can also complain to the authority where you live or work.

8. Security

Our servers and database are in the EU. Everything between your device and our servers is encrypted in transit. Sign-in and pairing codes are stored only as hashes, and the app keeps your session in your phone's secure storage. Only the people who build Kiwiback can reach the production systems, and each signs in with their own credentials.

Kiwiback is a service for businesses and isn't meant for anyone under 16.

9. Changes to this policy

When this policy changes, we'll update the date at the top. If a change affects how we use your data, we'll tell you in the app or by email before it applies.