Kivora Privacy Policy

This Privacy Policy explains how Kivora ("Kivora," "we," "us," or "our") collects, uses, shares, and protects information when you use the Kivora mobile application and related services (the "App" or "Service"). Kivora is operated by Mohammad Khairullahi, an individual, not a registered company.

By using Kivora, you agree to the collection and use of information as described in this Privacy Policy. If you do not agree, please do not use the App.

1. Information We Collect

1.1 Information You Provide Directly

• Account information: name, email address, and profile details you choose to add (bio, city, profile photo).
• Authentication information: if you sign up with Apple or Google, we receive basic profile information (such as your name and email) from that provider as authorized by you. If you sign up with email and password, we store your email address and an encrypted password.
• Content you create: photos, captions, mood/vibe selections, saved places, trip plans, and messages you send within "Talk to Kivora" or to other features of the App ("User Content").
• Communications: if you contact us at contact@kivora.social, we retain that correspondence to respond to you and improve our support.
• When you report content or block another user, we store the report (who reported, what was reported, the reason and the date) and your block list, to keep Kivora safe and enforce our Terms.
• Voice notes: if you send a voice note in a message, we store the audio so the other person can play it.
• Plans and responses: places and events you mark as "I'm interested" (with an optional "When?" such as Today or This weekend), and going-invites you send or answer.
• Business owner photos and answers: verified owners can add photos, a short sentence and answers about their place. These are public on the place page and card. Photos are re-saved without location or camera data and checked by an automated image system (Lovable AI) before they show; text is checked automatically. Anyone can report them, and we can remove them.

1.2 Information Collected Automatically

• Precise location data (GPS): with your permission, Kivora collects your device's approximate or precise geographic coordinates to match you with nearby places and experiences. Kivora works best with location turned on; without it, some features — like nearby places and distances — are limited. You can withdraw location access at any time in your device settings.
• Usage data: how you interact with the App (places viewed, moods selected, features used, session activity) to improve recommendations and app performance.
• Device information: device type, operating system, and unique device identifiers, as necessary for the App to function and for security purposes.
• Push notification tokens: if you allow notifications, we store your device's push token, platform, device name and app version so we can deliver notifications to your device.
• Usage limits: we keep weekly counters of how many AI replies you use in Talk to Kivora, solely to apply the weekly limit.
• Impression counts: how many times a place or post card was shown to you, so we don't keep showing you the same thing.
• Moderation records: a log of moderation actions taken on your account or content (for example, content removal or suspension), kept for safety and accountability.
• Server and login logs: our hosting provider keeps standard technical logs (such as IP address and timestamps) for security and operations.

1.3 Information from Third Parties

• If you sign in with Apple or Google, we receive limited profile information from those providers as permitted by your settings with them.

1.4 Business claims

If you ask to be recognised as the owner or legal representative of a place ("Claim your place"), we collect:

• your name, and your role (owner or legal representative);
• your email address and your phone number;
• a website, if you give one;
• the proof of connection you provide: an email address on the place's own website domain, a link to an official page, or a social media page link;
• a business tax or registration number: the CNPJ for places in Brazil, or an optional business registration number for places in other countries.

We use this only to review your claim and to contact you about it. We do not sell it and we do not use it for advertising. We never ask for or store your CPF, ID documents or uploaded documents. A claim is approved either after we review it, or automatically when you verify with a code sent to an email on the place's own website domain (and, for places in Brazil, the CNPJ check passes), as described in section 1.5. Claim details are deleted when you delete your account. For rejected or withdrawn requests, we keep contact details and proof for up to 90 days, then delete them, keeping only the status, place ID and dates. Approved claims are kept while you are the owner or legal representative of the place.

1.5 Automatic claim verification (updated October 14, 2026)

To confirm a claim faster, we may send a one-time verification code to an email address on the place's own public website domain, as listed on Google. You type only the part before the "@"; we never send codes to the email or phone number you typed on the claim form. For places in Brazil, we also check the CNPJ you provide against public Receita Federal company data, using the BrasilAPI service, to confirm the company is active and matches the place's name or address and city. Codes are stored only in a scrambled (hashed) form and expire after 10 minutes. We keep how and when a claim was verified (domain email or review by our team). When the code and these checks pass, a claim may be approved automatically; otherwise our team reviews it as described in section 1.4.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the App, including mood-based place recommendations;
• Personalize your experience based on your location, preferences, and activity;
• Power "Talk to Kivora," our conversational recommendation feature, which uses an AI language model to interpret your requests and generate responses (see Section 4);
• Enable social features you choose to use, such as public profiles, "Picks" (photos/posts), referrals, and trip planning;
• Communicate with you, including responding to support requests sent to contact@kivora.social;
• Use the problem reports and ideas you send through "Help and feedback" (your message, optional screenshot, the screen you were on, app version, device platform and browser details) only to fix problems and improve Kivora;
• Maintain the security and integrity of the App;
• Comply with legal obligations.

We do not use your information for third-party advertising, and we do not sell your personal information to third parties.

3. Public vs. Private Accounts

Kivora lets you choose an account visibility setting:

• Public accounts: your profile, "Picks" (photos and posts), and related activity may be visible to other Kivora users.
• Private accounts: your profile and content are restricted from users who are not your confirmed friends/connections within the App.
• Open to meet (optional, off by default, set per place): you choose it separately for each place you mark as "I'm interested", and Settings holds your default for new places. Where it is on, people interested in that place can see your name, photo and an "Open to meet" tag on your card and send you one "Say hi" message request, which you can accept or ignore. Where it is off, others only see an anonymous "Someone is interested" placeholder with your optional "When?" choice — never your name, photo or account. Private accounts are not shown in "Who's interested" lists.

You can change this setting at any time in Settings → Account privacy. Note that content shared publicly before switching to a private account (for example, a direct link to a photo) may remain accessible via that specific link even after you switch to private, because such links point directly to the stored file. Deleting the content itself removes it entirely (see Section 8).

4. Third-Party Services We Use

Kivora relies on the following third-party service providers to operate:

We do not currently use third-party analytics, advertising, or tracking tools (such as Google Analytics or advertising pixels).

Each of these providers processes data under their own privacy terms and appropriate data protection agreements; we choose providers that maintain industry-standard security practices.

5. How We Share Your Information

We do not sell your personal information. We may share information:

• With other users, according to your account visibility settings (Section 3) and features you actively use (e.g., referrals, friend connections, public Picks);
• With service providers listed in Section 4, solely to operate the App;
• For legal reasons, if required by law, legal process, or to protect the rights, property, or safety of Kivora, our users, or the public;
• In connection with a business transfer, such as a merger, acquisition, or sale of assets, subject to this Policy or a successor policy with equivalent protections.

6. Data Retention

We keep your information for as long as your account is active or as needed to provide the App. When you delete your account, your personal data is deleted immediately, except for the items listed in Section 8 under "What stays", which we keep for safety, legal and security reasons.

7. Your Privacy Rights

Depending on where you live, you may have rights under applicable law — including the EU/UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and Brazil's Lei Geral de Proteção de Dados (LGPD) — to:

• Access the personal information we hold about you;
• Correct inaccurate information;
• Delete your personal information (see Section 8);
• Port your data to another service, where technically feasible;
• Object to or restrict certain processing of your information;
• Withdraw consent at any time, where processing is based on consent (such as location access, which you can revoke in your device settings).

To exercise any of these rights, contact us at contact@kivora.social. We will respond within a reasonable time and in accordance with applicable law.

8. Deleting Your Account and Data

You can delete your Kivora account at any time from Settings → Account → Delete my account. Deletion in the app is immediate and permanent. You may also request deletion by emailing contact@kivora.social from the email address used for your account.

What gets deleted: your profile and photo, your picks and their photos, saved places, preferences, trips, friendships and invites, reviews, "I'm interested" choices (including When and Open to meet settings), blocks, notification settings, Help reports and their screenshots, your credits and credits history, and usage counters.

What stays and why: messages you already sent, including "Say hi" requests, stay in the other person's chat, shown as "Deleted user"; photos and voice notes inside those messages are deleted. Reports about content and moderation records are kept for safety and legal reasons. Our hosting provider keeps standard server logs (such as IP address and time) for a limited time for security.

Business owners: if you have published events or offers, remove them before deleting the account. Any claimed business listing is released automatically.

Learn more about deleting your account and data

9. Children's Privacy

Kivora is not intended for anyone under the age of 18. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected such information, we will delete it promptly. If you believe someone under 18 has provided us with personal information, please contact us at contact@kivora.social.

10. International Data Transfers

Kivora is operated from Brazil, and our service providers may process data in other countries, including the United States. Where your information is transferred internationally, we take reasonable steps to ensure it receives an adequate level of protection consistent with this Privacy Policy and applicable law.

11. Data Security

We use reasonable administrative, technical, and organizational measures — including encrypted authentication and access-controlled databases — to protect your information. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the App or by other reasonable means before the changes take effect. Your continued use of Kivora after changes take effect constitutes acceptance of the revised Policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact:

Mohammad Khairullahi
Kivora
Email: contact@kivora.social