Privacy Policy

Kylova Limited (“Kylova”, “we”, “us”, “our”) is committed to protecting your personal information in accordance with the New Zealand Privacy Act 2020.

1. What information we collect

When you use Kylova we collect the following categories of information:

• Account information: your name and email address provided at registration.
• Business details: business name, GST number, trading address, logo, invoice defaults, and branding preferences stored in your settings.
• Financial data: invoices, expenses, income figures, and budgets you enter into the platform.
• Employee records: employee names, salaries, KiwiSaver rates, tax codes, student loan details, and payroll calculations you create.
• Client and contact data: names, email addresses, phone numbers, and postal addresses of your clients.
• Usage data: pages visited, features used, and timestamps, collected to maintain and improve the service.

2. Why we collect your information

We collect and use your information solely to provide and improve the Kylova service. Specifically:

• To create and maintain your account and authenticate your sessions.
• To store, display, and process the business data you enter.
• To generate invoices, payroll calculations, GST summaries, and financial reports on your behalf.
• To provide AI-generated business insights where you opt in to that feature.
• To communicate with you about your account, including security notices and service updates.

3. Third parties we share data with

To operate Kylova we use the following trusted third-party services:

• Supabase (database and authentication, Sydney Australia)
• Vercel (hosting and infrastructure, USA)
• Google Gemini (AI features only, USA)
• Groq (AI fallback only, USA)

Your data is stored in Sydney, Australia. By using Kylova you consent to this as permitted under the NZ Privacy Act 2020. We do not sell your data to any third party.

4. Security and encryption

We take reasonable steps to protect your information from loss, misuse, unauthorised access, disclosure, alteration, and destruction. Specifically:

• All data in transit is encrypted using TLS 1.2 or higher.
• IRD numbers and bank account details are encrypted at rest using AES-256 encryption.
• Access to production systems is restricted to authorised personnel only.
• We conduct regular reviews of our security practices.

5. Your rights under the Privacy Act 2020

As an individual whose information we hold, you have the following rights under the New Zealand Privacy Act 2020:

• Access: you may request a copy of the personal information we hold about you.
• Correction: you may request correction of inaccurate or incomplete personal information.
• Deletion: you may request deletion of your account and associated data. We will action deletion requests within 30 days.
• Portability: you may request an export of your data in a machine-readable format (JSON or CSV).

To exercise any of these rights, contact us at hello@kylova.co.nz. We will respond within 20 working days as required by the Act.

6. Data breach notification

In the event of a notifiable privacy breach (as defined by the Privacy Act 2020), we will:

• Notify affected users within 72 hours of becoming aware of the breach.
• Notify the New Zealand Privacy Commissioner as required by law.
• Provide details of what information was affected, the likely consequences, and the steps taken to address the breach.

7. Data retention

We retain your personal information for as long as your account is active. If you close your account we will delete your personal information within 30 days, except where we are required to retain it by law (for example, financial records required under the Tax Administration Act 1994). Backups may retain data for up to 90 days after deletion.

8. Cookies

We use essential cookies only, required for authentication. For full details see our Cookie Policy.

9. Governing law

This Privacy Policy is governed by the New Zealand Privacy Act 2020. Any disputes will be resolved in New Zealand courts.

10. Contact us

For any privacy-related queries or to exercise your rights, contact our Privacy Officer at hello@kylova.co.nz.