Privacy Policy

• Account details: your email address and a hashed password when you sign up. Passwords are hashed by Supabase (our auth provider) — we never see or store your plaintext password.
• Profile content: an optional display name you set for reviews.
• Reviews & submissions: any content you post — ratings, reviews, business submissions, claim requests.
• Technical data: session cookies for authentication (set by @supabase/ssr), basic request logs (IP, user-agent) retained short-term for security and abuse prevention.
• Business contact details (if you are a service provider): phone numbers, email, location, website — the same information shown publicly on your listing.

• To let you sign in to your account and access features that require authentication.
• To publish your reviews and submissions to the community.
• To let service providers see feedback on their listings and reply to reviews.
• To prevent abuse, spam, and fraud.
• To contact you about your account, listings, or reports you have filed.

Data is stored with Supabase, which hosts on Amazon Web Services. Data is encrypted in transit (TLS) and at rest. Supabase processes data on our behalf under its own privacy terms.

• Other Kiwi Malayali users. Reviews and business listings are public by design. Your display name appears on reviews you write; your email and password are never shown.
• Service providers. When you review a provider, the provider can see the review and your display name so they can reply.
• Our service providers (Supabase, Vercel, email providers) — only as needed to run the platform, under data-processing agreements.
• Law enforcement — only when required by a valid legal process, and only the specific data lawfully requested.

We do not sell your data. We do not share it with advertisers.

We currently use only session cookies needed for authentication. No advertising, tracking, or analytics cookies are set. If we add analytics in the future, this page will be updated and you will be given a chance to opt out where required by law.

Under the NZ Privacy Act 2020 you have the right to:

• Ask what personal information we hold about you.
• Ask us to correct information you believe is wrong.
• Ask us to delete your account and associated data.
• Complain to the Office of the Privacy Commissioner if you think we haven't complied.

To exercise any of these rights, email hello@kiwimalayali.com. We will respond within a reasonable time — usually within 20 working days.

Account data is retained while your account is active. If you ask us to delete your account, we remove your personal information within 30 days. Reviews you have posted may be retained in an anonymised form (without your identity) to preserve the integrity of the community record, unless you specifically ask for them to be deleted too.

Kiwi Malayali is not intended for anyone under 16. We do not knowingly collect information from children under 16. If you believe a child has created an account, please email us and we will delete it.

We may update this policy occasionally. Material changes will be highlighted on the site and, if we have your email, notified by email. The date at the top reflects the current version.

Questions, requests, or complaints: hello@kiwimalayali.com.

Related: Terms of Service.