Privacy Policy
Last updated: July 30, 2026
KivoClas, S.R.L. ("KIVO", "we", "us"), a company registered in the Dominican Republic (RNC 1-33-67772-5), operates the kivoclas.com platform — an AI-powered classifieds marketplace serving the Bavaro-Punta Cana area. This Privacy Policy explains how we collect, use, and protect your personal information when you use our service.
Data We Collect
We collect only the information necessary to provide and improve our service:
- Phone number — for authentication via OTP (one-time password)
- Email address — optional; used only for notifications if you add it. Not required to use KIVO.
- Profile information — name, photo, bio, skills, and other details you choose to provide
- Listing content — text, photos, prices, and categories of your listings
- Chat messages — messages exchanged with other users through our platform
- Location data — approximate location shared voluntarily in chats or listings
- Device information — browser type, OS, push notification subscription data
- Usage data — pages visited, features used, error reports via Sentry
How We Use Your Data
- Authenticate your identity and secure your account
- Display your listings and profile to other users
- Enable real-time chat and message translation between languages
- Send push notifications about new messages, responses, and relevant updates
- Use AI (Google Gemini) to generate listing content, translate messages, and analyze photos — on your behalf
- Monitor and improve platform stability and performance via error tracking (Sentry)
- Understand how the platform is used (Google Analytics) and measure whether our advertising works (Meta Pixel and Conversions API)
- Respond to reports, feedback, and support requests
Third-Party Services
- Google Gemini API — processes listing text, chat messages, and photos for AI features (translation, content generation). Data is sent to Google's servers for processing.
- WhatsApp Business Platform (Meta) — delivers one-time verification codes (OTP) via WhatsApp, our primary login method. Your phone number is processed by Meta Platforms, Inc. (USA) solely to deliver the code. Transactional only; never for marketing.
- Telnyx Verify API — delivers OTP via SMS as a fallback when WhatsApp is unavailable. Your phone number is processed by Telnyx, Inc. (USA). Authentication only; never for marketing.
- Sentry — error monitoring and performance tracking. Collects technical error data, not personal content.
- Web Push (VAPID) — delivers push notifications to your browser. Subscription endpoints are stored on our servers.
- Gmail SMTP — sends verification and notification emails from admin@kivoclas.com.
- Meilisearch — search indexing of listing data (self-hosted, data does not leave our servers).
- Google Analytics 4 — usage analytics. Events are tied to a persistent analytics identifier stored in your browser and include what you searched for, which listings and profiles you opened, and which features you used. We use it to understand how the platform is used; we do not sell it. Any standard analytics blocker stops it.
- Meta Pixel & Conversions API — measures whether our ads work. In your browser, the Pixel reports page views and key actions (viewing a listing, contacting a seller, saving a favourite) with the listing identifier. From our server, when you register or publish a listing or a "Busco" request, we send Meta a SHA-256 hash of your phone number, a hash of your email if you gave one, and — unhashed — your IP address, browser user agent, page address and Meta's own browser identifiers, plus the listing category. Hashes cannot be turned back into your number. This is used only to attribute an action to an ad: we do not sell your data and Meta does not use it to message you.
Verification Messages (WhatsApp & SMS)
To verify your phone number at login or registration, we send a one-time code (OTP). By default it is delivered via WhatsApp; if WhatsApp is unavailable, by SMS. These messages are strictly transactional and are sent only at your request. We never send marketing via WhatsApp or SMS, and we never share or sell your number for marketing.
We will not share or sell your mobile information with third parties for promotional or marketing purposes.
Data Storage, Location & Security
Your data is stored on secured servers located in Germany (Hetzner Online GmbH, Falkenstein data center), with backups in the same region. An additional daily copy of the database, private media and configuration is kept offsite in Google Drive; it is encrypted before it leaves our server with a key that is not stored on the server, so that copy cannot be read without the owner's key. Some data is processed temporarily by third-party services in the United States (Google Gemini, Gmail, Telnyx, Meta/WhatsApp) and the European Union (Sentry, Web Push). We use JWT-based authentication with token rotation, Redis-backed session management, and encrypted connections (HTTPS). Passwords are never stored — we use phone-based OTP authentication exclusively. While we implement industry-standard security measures, no system is 100% secure, and we cannot guarantee absolute protection.
Data Retention & Deletion
We retain your data only as long as necessary to provide the service:
- Account data — kept while your account is active. When you ask us to delete it, the account stops being available immediately and is erased for good 14 days later. During those 14 days you can cancel by signing in with the same phone number; your listings stay unpublished and have to be published again by hand.
- Listings — deleted together with your account, along with their photos and translations. When you delete a listing yourself it is first archived (other people stop seeing it) and is erased for good when you delete it a second time, or when your account is deleted.
- Your chat messages — the text stays in the other person's chat after your account is gone, but without your name: a conversation belongs to both people, so we cannot erase one side's copy. Photos and locations you shared are deleted.
- Reports about you — kept for 30 days after the account or listing is finally erased (about 44 days from your request), so we can still act on abuse.
- Reports you filed — kept without your name and without a time limit, together with the excerpt of the conversation attached as evidence. That protects the people you reported about from the evidence vanishing.
- Prize draw winners — while your account exists, the public draw page shows your current display name. If the account is deleted, the stored name is kept for up to 12 months from the draw date and then replaced by a generic label ("Ganador del Sorteo #N").
- System logs and error reports — we keep the 10,000 most recent entries (roughly two to three months at current volume); older ones are deleted automatically. Diagnostics held by Sentry follow Sentry's own retention.
- Backups — daily database backups are kept for 7 days, weekly ones for 4 weeks and monthly ones for up to 12 months in encrypted offsite storage. Data deleted from the live database can therefore persist in backups for up to a year; backups are never used to serve the platform and are restored only after an incident.
- Legal records — where required by law (e.g. abuse investigations), we may retain minimal data beyond account deletion.
You can delete listings and profile photos directly in the app, and deleting a single chat message removes it for both participants. "Delete chat" hides a conversation from your list, but the other person still has their copy. To delete your entire account, use Profile → Delete my account in the app, or open kivoclas.com/delete-account in any browser — that page needs neither the app nor an active session; you confirm your phone number with a one-time code. Deletion starts immediately: the account stops being visible, your sessions are closed and your listings are unpublished. It becomes irreversible 14 days later. Promoter and administrator accounts are deleted by writing to admin@kivoclas.com. If your account is blocked, you can still request deletion the same way.
Cookies & Local Storage
KIVO is a Progressive Web App and uses browser local storage for your authentication tokens, language preference and app state. Analytics and advertising identifiers are stored in your browser by Google Analytics (_ga) and the Meta Pixel (_fbp); Sentry may store a minimal error-session identifier. We do not use cross-site advertising cookies of our own.
Your Rights
You have the right to:
- Access and view all personal data we hold about you
- Edit or update your profile information at any time
- Delete your listings, profile photos, and chat conversations directly within the app
- Delete your entire account through the in-app account deletion feature or by contacting us
- Block other users from contacting you through the in-app block feature
- Opt out of push notifications through your browser settings
- Withdraw consent for email communications
- Request a copy of your personal data by contacting us
Children's Privacy
KIVO is not intended for users under 18 years of age. We do not knowingly collect personal information from minors. If we discover that a child under 18 has created an account, we will take steps to delete their data promptly.
Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. Continued use of the platform after changes constitutes acceptance of the updated policy.
Contact Us
If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at admin@kivoclas.com.