Privacy Policy
Kivaro is an Australian wedding-planning platform operated by Kivaro Studios, a sole-trader business based in Western Australia, Australia. For privacy questions, contact studioskivaro@gmail.com.
1. Information we handle
Depending on your use of Kivaro, we may handle:
- Account details: email addresses, account identifiers, authentication information and preferences. Password authentication is handled through our authentication provider.
- Wedding plans: names, dates, venues, budgets, tasks, suppliers, notes, seating arrangements, designs and images you enter or upload.
- Guests and RSVPs: guest names, contact details, invitation links, responses and information you choose to collect, potentially including dietary or accessibility requirements.
- Collaboration: invitations, permissions, collaborator details and activity records.
- Communications: support enquiries, service messages, reminder settings and delivery records.
- Technical information: session data, device/browser information and logs needed to deliver, protect and troubleshoot the service, as handled by us or our providers.
2. Where information comes from and why we use it
We receive information when people register, create or edit plans, invite collaborators, share or respond to RSVP links, configure reminders or contact us. We use information to operate Kivaro, authenticate accounts, save and share plans with authorised people, manage invitations and RSVPs, send requested service communications, provide support, maintain security and meet applicable obligations.
3. Information about guests and other people
Wedding organisers may enter information about guests or collaborators. Only provide information reasonably needed for planning, and inform relevant people how their information will be used. Avoid collecting unnecessary sensitive details. People holding a valid RSVP link may be able to access the associated invitation; share links carefully and revoke or regenerate them where the feature permits.
4. Sharing and service providers
Information in a shared wedding may be available to collaborators according to their access permissions. Our service uses Supabase for database and authentication services, Netlify for hosting and application functions, and Resend for transactional email. These providers may process information to deliver their services. We may disclose information when required by law or reasonably necessary to address misuse or security incidents. Private wedding plans and guest lists are not intended for public publication.
5. Storage locations and overseas processing
Our primary Supabase database is configured in the Sydney, Australia region. This does not mean all information remains in Australia: website hosting, email delivery, support, logs, backups and other provider operations may involve processing or access from other countries. You may contact us for further information about how our service providers handle information.
6. Cookies, local storage and security
Kivaro uses authentication sessions and browser storage needed to operate its features. Plans created in local-only mode may remain on the device and may not be recoverable from our cloud backups. Signed-in plans are intended to synchronise with the service. We use access controls and security measures appropriate to the service, but no internet service can guarantee complete security. Keep login credentials and invitation links private and sign out of shared devices.
7. Email communications
Account verification, password reset and other service messages may be necessary for account operation. Optional wedding reminders can be managed through the available reminder preferences. Please contact us if an email appears unexpected or inappropriate.
8. Retention, backups and deletion
We retain information while it is needed to provide Kivaro and, where appropriate, for security, support, dispute resolution or legal requirements. The current operator-managed database backup process is configured to retain the four most recent successful weekly encrypted backups. Separate test restores or provider-managed logs and backups may have different retention periods. Removing information from the live service does not necessarily remove it immediately from historical backups; backups are used for recovery rather than ordinary access. Retention for provider-managed logs, backups and legally required records depends on the relevant service and circumstances. Contact us for information about a particular deletion request.
Account owners can use the account-deletion feature, subject to the collaboration and invitation restrictions described on our Account & Data Deletion page. For access, correction or deletion enquiries, email us. We may need to verify identity and consider information belonging to other users.
9. Privacy questions and complaints
Contact studioskivaro@gmail.com to ask about personal information, request correction or raise a privacy complaint. We will assess the request and explain any applicable limitations. Depending on the circumstances and applicable law, you may also be able to complain to the Office of the Australian Information Commissioner.
10. Updates
We may revise this policy as Kivaro changes. We will update the effective date when we publish changes and provide notice of significant changes where appropriate.