Privacy policy

Information we handle

To provide property condition reports and maintenance records, we handle account names and email addresses; tenancy parties' names, contact details and identity information; property addresses, tenancy dates and financial terms; photos, narrated video, audio, notes, annotations, inventory entries, meter readings and serial numbers; signatures and signing IP addresses; and maintenance descriptions, evidence, visits and comments; and optional tenancy agreements and other supporting documents, with their submitter and submission time, and maintenance clauses and terms confirmed from an agreement. Optional push notifications use a device token and notification history.

When something goes wrong in the app, we record an error report: the error message and where in our code it happened, the page, the app version, your browser or device type, and which account was signed in. We do not record your IP address in it.

The mobile app saves unsent captures, pending edits, error reports not yet sent and previously viewed inspection data on your device so you can work without a connection. It also stores your sign-in session there.

We record which screens signed-in web users open, when, and which account is signed in, to understand use and improve Kivilo. These records use screen categories, without property addresses, report links, page queries, photos, free text or IP addresses. Unsent screen events wait on your device until a connection is available.

How we use it

We use this information to sign users in, preserve and organize evidence, record and review inspections, record signatures, provide private report links, compare check-out with check-in, manage maintenance, send account and service messages, understand use, find and fix faults in Kivilo, and handle support and deletion requests.

Kivilo can read text from an uploaded tenancy agreement to help locate maintenance clauses. An agent or landlord reviews and confirms the terms before they become a repair-proposal default. This uses PDF text extraction, not an AI service. Scanned pages can be entered manually.

Service providers and sharing

Supabase provides authentication, database and private media storage. Its primary database, authentication service and media for our project are hosted in Singapore. Database backups, where available on our plan, follow the selected project region. Support access, service logs and media delivery can occur elsewhere. Vercel hosts the web service in a Singapore function region, while its platform operations and backups may process data in other countries. Resend carries sign-in and service emails and stores their content and delivery logs in the United States. Firebase Cloud Messaging and Apple Push Notification service route optional mobile notifications; Firebase may process data globally. Stripe processes payment for Pro plans bought on our website and keeps the card details; we never see or store a card number.

We keep report media in a private bucket. Anyone who holds a private report link can view that report until the inspector revokes the link; report photos use expiring signed URLs.

Supporting documents are separate from condition reports and their PDFs. Only the tenancy's landlord, tenant and agents with current tenancy access can open them after signing in. They are not included in a shared report link. Files waiting to upload stay on the device for the signed-in account until the upload is confirmed.

Retention

We keep signed condition reports, their evidence, signatures, published assessments and related tenancy records while needed to provide the parties with a reliable handover record, resolve a tenancy claim or dispute, or meet another legal or business obligation. We keep unsigned inspections involving another party while needed to complete or review their shared handover or resolve a related claim. We keep maintenance history and evidence while needed to coordinate or verify work or resolve a related claim. Supporting documents follow the same retention purposes as their related tenancy records.

We review those purposes when a tenancy ends, when we handle a deletion request, and in regular record reviews. When none applies, we delete the information or remove its link to an identifiable person. We keep a limited record of a deletion request while needed to demonstrate fulfillment or resolve a complaint, then remove or de-identify it. We delete error reports and screen usage events 90 days after they are recorded.

Some service-provider copies can remain after deletion from Kivilo's active records. Resend retains email and delivery logs for 30 days on its standard plans, with seven-day backups; Supabase's database backup period depends on its plan. Firebase can keep a device installation ID until a separate deletion request is made to it, then remove it from live and backup systems within 180 days. Kivilo does not currently request that separate deletion when an account is closed.

Account and device deletion

Request account deletion in the app's Settings or on our account deletion page. If you cannot sign in, email us from your account address. We acknowledge requests and aim to complete them within 30 days. When we fulfill a request, we remove the sign-in account, contact and identity fields, our push-device registration, account-specific notification history, error reports and screen usage events recorded while you were signed in. We remove unsigned drafts that belong solely to the requesting account and verify that their stored media is removed after outstanding upload links expire. We cancel a Pro plan you pay for; Stripe keeps its payment records as the law requires.

Signed reports and unsigned work involving another party may retain your name and contributions while the purposes above still apply. Our completion email notes that shared records may remain; contact us to ask which of your records remain.

Signing out or requesting account deletion does not currently erase unsent captures, pending edits, unsent error reports or previously viewed inspection data from your phone. Those files are kept in app storage separately for each account. Clear Kivilo's app storage or uninstall it to remove them from that device; doing so permanently discards any evidence that has not uploaded.