KymaFlow ("we", "our", or "us") operates the KymaFlow mobile application and web platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.
1. Information We Collect
1.1 Personal Information You Provide
- Account Information: Name, email address, phone number, and password when you create an account.
- Identity Verification Documents: Driver's licence (front and back images) for drivers/haulers; government-issued photo ID for senders/shippers.
- Payment Information: Payment card details and bank account information processed securely through Stripe. We do not store your full card numbers or bank account numbers on our servers.
- Payout Verification Information (drivers): To enable payouts we collect your legal name or registered business name, NZBN, date of birth, residential or business address, and — only if our payment processor requires it — an identity document. This information is shared with Stripe to verify your payout account, as required by anti-money-laundering law.
- Profile Information: Company name, profile photo, and vehicle details (if applicable).
1.2 Information Collected Automatically
- Location Data: GPS coordinates when you use the app to facilitate pickup and delivery services, route tracking, and distance calculations.
- Device Information: Device type, operating system version, unique device identifiers, and push notification tokens.
- Usage Data: App interaction data, feature usage patterns, and session duration.
1.3 Information from Third Parties
- Google Sign-In: If you sign in with Google, we receive your name, email address, and profile picture.
- Apple Sign-In: If you sign in with Apple, we receive your name and email address (or a relay email if you choose to hide your email).
- Stripe: Payment processing status and transaction confirmations.
2. How We Use Your Information
We use the information we collect to:
- Provide, operate, and maintain our logistics marketplace platform.
- Process delivery jobs, bids, and payments between shippers and haulers.
- Verify the identity of drivers and senders for safety and compliance.
- Calculate delivery routes, distances, and estimated pricing using Google Maps.
- Send push notifications about job updates, bid statuses, and delivery progress.
- Process payments, escrow transactions, and payouts through Stripe.
- Communicate with you about your account, transactions, and customer support inquiries.
- Detect and prevent fraud, abuse, and security incidents.
- Comply with legal obligations and enforce our Terms of Service.
3. How We Share Your Information
We share your information only in the following circumstances:
- Between Users: When a shipper accepts a hauler's bid, limited profile information (name, rating) is shared between parties to facilitate the delivery.
- Payment Processors: Stripe processes all payments. Your payment data is subject to Stripe's Privacy Policy.
- Cloud Services: We use Google Firebase for authentication, data storage, file storage, and push notifications. Data is subject to Google's Privacy Policy.
- Maps Services: Google Maps processes location data for routing.
- Legal Requirements: We may disclose information if required by law, regulation, legal process, or governmental request.
- Business Transfers: In the event of a merger, acquisition, or asset sale, user data may be transferred.
We do not sell your personal information to third parties.
4. Data Storage and Security
- All data is stored on Google Firebase servers located in secure data centres.
- All data transmission uses HTTPS/TLS encryption.
- Verification documents are stored in Firebase Storage with access restricted to authorised personnel.
- Payment data is processed and stored by Stripe in PCI DSS compliant infrastructure.
- We implement access controls, authentication, and monitoring to protect your data.
5. Your Rights and Choices
You have the right to:
- Access: Request a copy of the personal data we hold about you.
- Correction: Request correction of inaccurate personal data.
- Deletion: Request deletion of your account and associated personal data.
- Data Portability: Request your data in a portable format.
- Opt-Out of Communications: Manage push notification preferences in your device settings.
- Location Permissions: Control location access through your device settings.
To exercise any of these rights, contact us at support@kymaflow.com.
6. Data Retention
- Account data is retained for the duration of your account and for 12 months after account deletion for legal and dispute resolution purposes.
- Verification documents are retained for 24 months after verification approval.
- Transaction records are retained for 7 years for tax and financial compliance.
- Push notification tokens are deleted when you uninstall the app or revoke permissions.
7. Children's Privacy
KymaFlow is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children under 18. If we discover that a child under 18 has provided us with personal information, we will delete it promptly.
8. International Data Transfers
KymaFlow primarily operates in New Zealand. Your data may be processed in countries where Google and Stripe maintain their servers. We ensure appropriate safeguards are in place for any international data transfers.
9. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. Continued use of the app after changes constitutes acceptance of the updated policy.
10. Contact Us
If you have questions or concerns about this Privacy Policy, contact us at: