Privacy Policy

Last updated: September 16, 2026

KivoClas, S.R.L. ("KIVO", "we", "us"), a company registered in the Dominican Republic (RNC 1-33-67772-5), operates the kivoclas.com platform — an AI-powered classifieds marketplace serving the Bavaro-Punta Cana area. This Privacy Policy explains how we collect, use, and protect your personal information when you use our service.

Data We Collect

We collect only the information necessary to provide and improve our service:

Phone number — for authentication via OTP (one-time password)
Email address — optional; used only for notifications if you add it. Not required to use KIVO.
Profile information — name, photo, bio, skills, and other details you choose to provide
Listing content — text, photos, videos, prices, and categories of your listings
Chat messages — messages exchanged with other users through our platform
Location data — approximate location shared voluntarily in chats or listings
Device information — browser type, OS, push notification subscription data
Usage data — pages visited, features used, error reports via Sentry
Replies to our notification number — if you write back to the WhatsApp number that sends chat notifications, we store the text of that reply for 30 days so that an administrator can act on it.

How We Use Your Data

Authenticate your identity and secure your account
Display your listings and profile to other users
Enable real-time chat and message translation between languages
Send push notifications about new messages, responses, and relevant updates
Use AI (Google Gemini) to generate listing content, translate messages, and analyze photos — on your behalf
Monitor and improve platform stability and performance via error tracking (Sentry)
Understand how the platform is used (Google Analytics) and measure whether our advertising works (Meta Pixel and Conversions API)
Respond to reports, feedback, and support requests
Send you a WhatsApp reminder about an unread chat message, if you turned that on

Third-Party Services

Google Gemini API — processes listing text, chat messages, and photos for AI features (translation, content generation). Data is sent to Google's servers for processing.
WhatsApp Business Platform (Meta) — delivers two different kinds of message from two separate numbers. Our login number sends one-time verification codes (OTP). A separate notification number sends a short alert saying you have an unread message, and only if you switched that on yourself. In both cases Meta Platforms, Inc. (USA) receives your phone number and your language code in order to deliver the message; nothing you or anyone else wrote is sent. If you reply to the notification number, your reply comes back to us — see the section on chat notifications below. Transactional only; never for marketing.
Telnyx Verify API — delivers OTP via SMS as a fallback when WhatsApp is unavailable. Your phone number is processed by Telnyx, Inc. (USA). Authentication only; never for marketing.
Sentry — error monitoring and performance tracking. Collects technical error data, not personal content.
Web Push (VAPID) — delivers push notifications to your browser. Subscription endpoints are stored on our servers.
Gmail SMTP — sends verification and notification emails from admin@kivoclas.com.
Meilisearch — search indexing of listing data (self-hosted, data does not leave our servers).
Google Analytics 4 — usage analytics. Events are tied to a persistent analytics identifier stored in your browser and include what you searched for, which listings and profiles you opened, and which features you used. We use it to understand how the platform is used; we do not sell it. Any standard analytics blocker stops it.
Meta Pixel & Conversions API — measures whether our ads work. In your browser, the Pixel reports page views and key actions (viewing a listing, contacting a seller, saving a favourite) with the listing identifier. From our server, when you register or publish a listing or a "Busco" request, we send Meta a SHA-256 hash of your phone number and — unhashed — your IP address, browser user agent, page address and Meta's own browser identifiers, plus the listing category. Hashes cannot be turned back into your number. Your email address is never sent to Meta, even hashed. This is used only to attribute an action to an ad: we do not sell your data and Meta does not use it to message you.

Verification Messages (WhatsApp & SMS)

To verify your phone number at login or registration, we send a one-time code (OTP). By default it is delivered via WhatsApp; if WhatsApp is unavailable, by SMS. These verification codes are strictly transactional and are sent only at your request. The optional chat notifications described below are a separate, opt-in message type and come from a different number. We never send marketing via WhatsApp or SMS, and we never share or sell your number for marketing.

We will not share or sell your mobile information with third parties for promotional or marketing purposes.

New message notifications on WhatsApp — optional

If you turn this feature on, KivoClas can send you a short WhatsApp notification when you have an unread message on KivoClas.

The feature is off by default. You can turn it off at any time — the change takes effect immediately. This setting does not affect signing in, how chats work, publishing listings, or ordinary push notifications.

Notifications are sent from a separate number used only for notifications. It is not the number that sends your KivoClas login code.

What data Meta receives

To deliver the notification over WhatsApp, Meta receives only:

your phone number;
the code of your chosen language.

This is needed to deliver the notification in the right language. Meta does not receive the text of the unread message, photos, location, price, the listing title, the name of the other person, or any other detail from the conversation.

We use a pre-approved notification template with no personalised content. Its button opens the general KivoClas chat list, not a particular conversation.

The very fact that a notification is delivered may let Meta tell that a KivoClas user has an unread message. This is a technical property of any notification sent through a third-party service. That is why we limit how often they are sent and never include the content of the conversation.

How often notifications are sent

We send at most one notification in any 24 hours across all your chats, and at most four reminders about one unread conversation. Notifications are not sent at night, Dominican Republic time.

If you reply to the notification number

A reply to that number is not delivered to the other person on KivoClas and does not appear in the app conversation. It goes to a private KivoClas support channel that only authorised administrators can access.

This is so that a person, not an automated system, reviews your request. An administrator can, for example, switch the notifications off or help with another problem.

The text of such a reply is stored for up to 30 days and then deleted. While your request is waiting to be reviewed, WhatsApp notifications to your number are paused. An automatic reply also tells you how to reach our support.

Videos in listings

Depending on your plan and the listing's category, you can add one short video to a listing. It is optional. Once published, the video can be seen by anyone who opens the listing or sees it in the Large photos view on Home, including people who are not signed in.

We convert the video on our own servers into a standard format. During conversion we remove the information your phone or camera writes into the file, including the place where it was recorded. The file you uploaded is deleted when processing ends, whether it succeeded or not; only the converted video is kept. Videos are not sent to AI services or to any other third party for processing.

If the video cannot be shown — for example, while the listing is not published, or if your plan no longer includes video — other people stop seeing it at once, but we keep the file so the video can come back without a new upload. You can delete the video at any time in the listing editor; that removes the file from our servers. The video is also deleted when the listing is permanently deleted or your account is deleted.

To understand whether videos are useful, Google Analytics records when a video is shown, played, watched to a quarter, half or the end, when the sound is turned on and whether an upload succeeded — never the video itself.

Data Storage, Location & Security

Your data is stored on secured servers located in Germany (Hetzner Online GmbH, Falkenstein data center), with backups in the same region. An additional daily copy of the database, private media and configuration is kept offsite in Google Drive; it is encrypted before it leaves our server with a key that is not stored on the server, so that copy cannot be read without the owner's key. Listing photos and videos are copied there as they are, without that encryption, because they are made to be public. Some data is processed temporarily by third-party services in the United States (Google Gemini, Gmail, Telnyx, Meta/WhatsApp) and the European Union (Sentry, Web Push). We use JWT-based authentication with token rotation, Redis-backed session management, and encrypted connections (HTTPS). Passwords are never stored — we use phone-based OTP authentication exclusively. While we implement industry-standard security measures, no system is 100% secure, and we cannot guarantee absolute protection.

Data Retention & Deletion

We retain your data only as long as necessary to provide the service:

Account data — kept while your account is active. When you ask us to delete it, the account stops being available immediately and is erased for good 14 days later. During those 14 days you can cancel by signing in with the same phone number; your listings stay unpublished and have to be published again by hand.
Listings — deleted together with your account, along with their photos, video and translations. When you delete a listing yourself it is first archived (other people stop seeing it) and is erased for good when you delete it a second time, or when your account is deleted.
Your chat messages — the text stays in the other person's chat after your account is gone, but without your name: a conversation belongs to both people, so we cannot erase one side's copy. Photos and locations you shared are deleted.
Reports about you — kept for 30 days after the account or listing is finally erased (about 44 days from your request), so we can still act on abuse.
Reports you filed — kept without your name and without a time limit, together with the excerpt of the conversation attached as evidence. That protects the people you reported about from the evidence vanishing.
Prize draw winners — while your account exists, the public draw page shows your current display name. If the account is deleted, the stored name is kept for up to 12 months from the draw date and then replaced by a generic label ("Ganador del Sorteo #N").
System logs and error reports — we keep the 10,000 most recent entries (roughly two to three months at current volume); older ones are deleted automatically. Diagnostics held by Sentry follow Sentry's own retention.
Backups — daily database backups are kept for 7 days, weekly ones for 4 weeks and monthly ones for up to 12 months in encrypted offsite storage. Data deleted from the live database can therefore persist in backups for up to a year; backups are never used to serve the platform and are restored only after an incident. Photos and videos of deleted listings stay in the offsite copy for about 30 more days.
Legal records — where required by law (e.g. abuse investigations), we may retain minimal data beyond account deletion.
WhatsApp notification records — what we sent and what happened to it (delivered, read, failed) is kept for up to 90 days without any message content. The text of anything you write back to our notification number is deleted after 30 days.

You can delete listings, a listing's video and profile photos directly in the app, and deleting a single chat message removes it for both participants. "Delete chat" hides a conversation from your list, but the other person still has their copy. To delete your entire account, use Profile → Delete my account in the app, or open kivoclas.com/delete-account in any browser — that page needs neither the app nor an active session; you confirm your phone number with a one-time code. Deletion starts immediately: the account stops being visible, your sessions are closed and your listings are unpublished. It becomes irreversible 14 days later. Promoter and administrator accounts are deleted by writing to admin@kivoclas.com. If your account is blocked, you can still request deletion the same way.

Cookies & Local Storage

KIVO is a Progressive Web App and uses browser local storage for your authentication tokens, language preference and app state. Analytics and advertising identifiers are stored in your browser by Google Analytics (_ga) and the Meta Pixel (_fbp); Sentry may store a minimal error-session identifier. We do not use cross-site advertising cookies of our own.

Your Rights

You have the right to:

Access and view all personal data we hold about you
Edit or update your profile information at any time
Delete your listings, profile photos, and chat conversations directly within the app
Delete your entire account through the in-app account deletion feature or by contacting us
Block other users from contacting you through the in-app block feature
Opt out of push notifications through your browser settings
Withdraw consent for email communications
Request a copy of your personal data by contacting us

Children's Privacy

KIVO is not intended for users under 18 years of age. We do not knowingly collect personal information from minors. If we discover that a child under 18 has created an account, we will take steps to delete their data promptly.

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. Continued use of the platform after changes constitutes acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at admin@kivoclas.com.