Privacy Policy

1. Introduction & scope

• This policy applies to all users of Fidella (Customers, Staff, Site Admins, Super Admins) and visitors of fidella.app.
• Fidella is a product of Kiwana Labs Limited (NZBN 9429050289325), a company registered in New Zealand and trading as Kiwana Labs. Where this policy refers to "we", "us", or "Kiwana Labs", it refers to Kiwana Labs Limited acting as the controller of personal data processed through the Fidella platform.

2. Data we collect

• Account data: name, email, a unique account identifier, profile preferences, messaging preferences, analytics consent choices, and country/region.
• Usage data: device info, app interactions, and crash/diagnostic events, with PII scrubbing applied per our internal logging policy.
• Loyalty activity: site memberships, stamps/points, rewards earned and redeemed, and voucher purchases or redemptions.
• Payment data: payment references and tokens processed by our payment processor. We do not store card numbers.
• Support & communications: messages sent to support, contact requests, and interest registrations for unsupported regions.
• Optional profile fields: gender (for self-identification and aggregate, non-identifying reporting) and coarse location (for "nearest site" sorting on the Discover map). Both are optional, never used for advertising, never shared with merchants at the individual level, and can be cleared at any time.
• Age band: we capture a coarse age band at signup (under 16 / 16–18 / adult) to enforce minimum-age requirements. We deliberately do not collect a date of birth.

3. How we use data

• Service delivery (contract): authenticating users, operating loyalty programs, and issuing and redeeming wallet passes and vouchers.
• Security and fraud prevention (legitimate interests): abuse prevention, rate limiting, and incident response.
• Analytics and product improvement (consent): non-essential analytics run only when you give explicit consent. Your consent choice is stored on your account and returned in account exports.
• Marketing (consent): optional communications and offers, unsubscribable at any time.

4. Data sharing

• Identity & auth: our identity and authentication provider, for authentication and profile claims.
• Payment processing: our payment processor, for voucher purchases and related settlements.
• Infrastructure: hosting, storage, CDN, and email providers as subprocessors.
• Analytics & observability: our analytics and error-monitoring providers, with PII scrubbing and consent respected where applicable.
• Business operators (merchants): participating merchants receive only the customer data necessary to fulfil loyalty interactions, under a limited licence.

5. International data transfers

Personal data may be processed outside New Zealand. Where transfers occur, safeguards such as standard contractual clauses or equivalent mechanisms are applied where required by law.

6. Data retention

• Account/profile and server-side consent records: 24 months after deactivation or last verified activity.
• Loyalty, voucher, and financial transaction records: 7 years after the transaction or completion date, and longer where a dispute or legal hold applies.
• Support records: 24 months after ticket closure. Compliance, fraud, and legal-hold records: 7 years after case closure or release.
• Raw logs with identifiers: 30 days. Aggregated telemetry: 13 months.
• Backups: 35-day rolling retention, with masked-restore controls applied before any restored data is reintroduced to production access paths.

7. Legal basis for 7-year ledger retention

When you deactivate or delete your Fidella account we anonymise your profile data after 24 months. We retain the financial and loyalty ledger for 7 years from the deactivation date because we are legally required to keep accurate records of financial, refund, and tax-relevant transactions.

The records we retain are limited to the financial and loyalty transaction history needed for those obligations — for example records of rewards earned and redeemed, vouchers issued and redeemed, promotions applied, voucher purchases, merchant settlement totals, refund records, payment-processor references, and the minimum identifiers needed to reconcile a wallet pass to the correct account.

After profile anonymisation, the only personal information that remains on a retained record is an opaque, pseudonymous account reference together with payment-processor references (required for reconciliation); the rest is non-personal data such as amounts, dates, and the identifiers of the relevant site, reward, or voucher.

If you want ledger entries deleted before the 7-year window expires, contact us at privacy@fidella.app. We will assess whether a tax or anti-money-laundering hold applies. If it does, we will tell you the earliest date the record can be removed.

8. Your rights

• Access, correction, portability (export), and deactivation requests can be submitted via privacy@fidella.app or the in-app account tools. Exports include persisted messaging and analytics consent metadata; raw push subscription endpoints and other device secrets are excluded.
• Deactivation disables access immediately, clears active sessions and device/pass artefacts, and schedules profile anonymisation after 24 months unless a legal hold applies.
• Object to or withdraw consent for non-essential analytics or marketing at any time.
• Complaints may be directed to the relevant supervisory authority in New Zealand.

9. Regional compliance

Fidella is designed to be compatible with GDPR-style rights and the New Zealand Privacy Act. Cross-border transfer assessments and Data Processing Addenda are completed for each merchant and region as required.

10. Contact

Privacy requests: privacy@fidella.app

11. Updates to this policy

We may update this policy from time to time. Material changes will be communicated through the Fidella app or by email. Continued use of Fidella after the effective date constitutes acceptance of the updated policy.