KivoLegal
Privacy Policy
This policy explains what data Kivo (a point-of-sale and shop-management app for Vietnamese grocery stores, on Android, iOS, iPadOS, macOS, Windows and Linux, and this website) collects, why, who receives it, and your rights. It describes how the app actually works. The Vietnamese version (Chính sách quyền riêng tư) prevails if the two differ.
Summary
- Without signing in, the shop's records stay on your device. Kivo receives nothing except anonymous downloads of the sample catalog.
- When you sign in to sync or use cloud AI, data is sent over encrypted connections to Kivo's servers in Singapore and to the providers listed in section 7.
- Kivo has no ads, no analytics or tracking SDKs, does not use advertising identifiers (IDFA / AAID), and does not sell data.
- You can view, correct, export and delete your data at any time. The store owner deletes the account right in the app (Settings → Đồng bộ & tài khoản); see Delete account & data.
1. Who is responsible
Kivo is developed and operated by Nguyễn Thanh Hải, developer of Kivo (an individual, Vietnam). “We” in this policy means that person, the data controller for your account and service data.
Privacy contact: hai2571998@gmail.com.
2. Data that stays on the device
By default everything you enter is stored in a database on that device: products, prices, stock, sales, customers, suppliers, debts, cash book, staff, promotions, tax books, printer settings and AI assistant conversations. The free version works fully without an account and sends none of this anywhere.
Some data never leaves the device, even with sync on: photos of supplier invoices (unless you ask AI to read one, section 4), reference photos for basket recognition, held carts, AI assistant conversations, and per-device settings (printers, voice, text size).
The on-device database is not separately encrypted; it is protected by the operating system's screen lock and device encryption. Please set a screen lock on your selling devices. Backup files (.kivo) and Excel / CSV exports you create are stored where you choose and are under your control. Excel / CSV files you pick to import (product lists with stock, past purchase prices, revenue from your old books) are read only on the device and never sent anywhere; only the records they add to your books sync, the same as records you type in (section 3).
3. Account and sync
An account is only needed to sync devices, use cloud AI or buy Kivo Pro.
| Data | When | Purpose |
|---|---|---|
| Email and password | Sign-up / sign-in | Authentication. Passwords are stored hashed by our authentication provider (Supabase Auth); we cannot read them. |
| Store details: name, phone, address, owner name, receipt footer, logo, bank account for receiving payments | When signed in | Receipts, VietQR codes, same details on every device |
| Store records: products, units, prices, stock, sales, purchases, debts, cash book, stock counts, shift closings, promotions, price history | When signed in with sync on | Sync between the store's devices |
| Customers and suppliers: name, phone, address, credit limit, notes | Same | Debt book, choosing a customer at checkout |
| Staff: name, role, hashes of PIN and recovery code (never the PIN itself) | Same | Staff sign-in on every device |
| Tax profile: tax ID, representative name, address, registration number, the day you started using Kivo; revenue from your old books before that day, typed in or imported from a file (monthly / daily totals only, the file itself is not sent); tax documents you attach (images / PDF) | Same | Household-business tax books and records |
| Product photos you take (Pro) | Same | Same photos on every device |
Data is stored on servers provided by Supabase in Singapore. Each store is isolated by database access rules: only that store's account can read or write it. Product photos and tax documents are kept in private storage with no public links.
On install the app creates a random device ID (not a hardware ID, not linked to advertising IDs) and sends it with server requests to count Pro devices and prevent abuse.
4. Cloud AI
Some features send data to the Google Gemini API through Kivo's servers. They only run when you are signed in and use them (or enable them in Settings). Kivo does not store the images, questions or answers on its servers; server logs record only counts, timings and success / error. We keep daily usage counters to apply limits.
| Feature | Sent | Notes |
|---|---|---|
| Basket recognition — AI check | Photo of the basket / counter, the store's product names for matching | Only when the device is unsure. Can be turned off in Settings → Kho hàng mẫu & AI. |
| Add product by photo | Photo of the package and text read on it; or name, brand, size when asking for a price | |
| Read supplier invoice | Photo of the supplier's invoice | May contain the supplier's name and phone. |
| Voice selling — hard phrases | Text only, never audio; customer names are removed first | If a name cannot be removed, nothing is sent. |
| Promotion suggestions | Product aggregates: name, cost, price, stock, expiry, revenue | No customer data. |
| AI assistant (owner only) | The question, earlier turns, aggregates needed to answer | No customer names, phones or IDs. The server keeps only turn records (no content) for 2 days for limits. |
Google processes this data under the Gemini API Additional Terms. Under those terms, for the tier Kivo currently uses, Google may use submitted content and responses to improve Google products, and human reviewers may read them. Do not use cloud AI features with images containing information you do not want to share. AI output can be wrong; Kivo always lets you review it before saving.
5. Shared catalog and market prices
Shared catalog contributions. When you save a product with a barcode, Kivo sends its name, brand, size, units, barcode and (if any) your own photo of it to the shared catalog so other stores can scan and find it. Prices, stock and customer data are not sent. On the server a contribution is linked only to hashes of the store and account. Once approved, the name, barcode and photo may be published in Kivo's public sample catalog — without the store's identity — with photos licensed CC BY-SA 4.0 credited “Cửa hàng dùng Kivo”. This is on by default; you can turn it off when creating the store or in Settings → Kho hàng mẫu & AI → Kho hàng chung.
Market prices. When adding a product with a barcode, Kivo may show the price range other stores sell it at. The range is computed from retail prices stores have synced, only when at least 5 active stores from at least 5 different accounts have it, and returns only the range and store count, never any store's name or ID. With few stores the range can equal one store's real price. Price sharing is on by default; the owner is told once and can turn it off in Settings → Cửa hàng → Góp giá ẩn danh, after which the store's prices are not counted.
6. Kivo Pro and payments
When you buy or renew Kivo Pro we store: the store, the buying account, amount, transfer code, bank transaction ID and transfer note; and the store's devices with their random device ID, a generic device label (e.g. “Điện thoại (Android)”, not the real device name or model), operating system, and first / last seen times.
You pay by bank transfer to Kivo's account using a VietQR code. Kivo never receives card numbers or banking credentials. SePay notifies us when money arrives; the transfer note may contain the payer's name or phone. Payment records are kept for the period required by accounting and tax law; when you delete your account they are detached from the store and account (no longer attributable to you).
Automatic transfer confirmation (Kivo Pro, only when the owner turns it on). The owner can connect the store's own SePay or APIBank (apibank.com.vn, by 3W Group) account to Kivo, or both (Settings → Bán hàng & in → Tự xác nhận chuyển khoản), and picks which service each payment source uses. A connected service sends Kivo's server every incoming transaction on the bank accounts the store picked in SePay or on apibank.com.vn, so Kivo can complete a sale by itself when the customer pays with the right code. Kivo stores: amount, receiving account number (and virtual account, if any), SePay's or APIBank's and the bank's transaction IDs, time, the Kivo payment code (KV…) and the transfer note (up to 500 characters) — the transfer note may contain the payer's name or phone. Kivo does not store the full description SePay sends along, nor the raw data and account name APIBank sends along, and never receives balances or bank / SePay / APIBank credentials. For SePay's webhook authentication key the server keeps only a hash. APIBank's webhook secret, which the server must read back to check the signature of every APIBank delivery, is kept encrypted on the server (not as a hash); it is not stored on the device and never sent back to the app. Every member of the store (staff included) can see these transactions to reconcile sales. Payers are the store's customers: as in section 10, the store decides the purpose and Kivo processes the data on its behalf. The owner can disconnect each service at any time in the app, even after Pro has ended; when disconnecting, also delete the webhook in SePay (my.sepay.vn) or on apibank.com.vn.
7. Service providers and international transfers
We share data only with providers needed to run the service, under their contracts / terms:
| Provider | Role | Location |
|---|---|---|
| Supabase | Database, authentication, file storage, server functions | Singapore |
| Google (Gemini API) | Cloud AI in section 4 | Google's global infrastructure, possibly outside Vietnam |
| SePay | Bank transfer notifications for Pro purchases; for stores that connect SePay themselves, incoming transactions on the store's accounts (the store uses SePay under its own terms with SePay) | Vietnam |
| APIBank (3W Group) | For stores that connect APIBank themselves, incoming transactions on the store's accounts (the store uses APIBank under its own terms with APIBank) | Vietnam |
| ImageKit, Open Food Facts | Hosting and serving sample-catalog images | Outside Vietnam |
| GitHub | Hosting sample-catalog files for download | Outside Vietnam |
| Apple, Google (operating systems) | Speech recognition, barcode scanning, text recognition, background removal (section 8) | Per Apple / Google policies |
Because servers and some providers are outside Vietnam, your data is transferred abroad. We choose providers with appropriate safeguards, send only what is needed, and complete cross-border transfer formalities under Vietnamese law.
We disclose data to authorities only when legally required.
8. Device permissions
The app asks for a permission only when you use a feature that needs it; declining leaves the rest working.
| Permission | Used for |
|---|---|
| Camera | Scanning barcodes and payment QR stickers, basket recognition, photographing products / invoices |
| Photo library | Choosing product photos and a receipt logo |
| Microphone, speech recognition | Voice selling. Audio is recognised by the operating system's speech service (Apple or Google) and may be processed on Apple / Google servers under their policies. Kivo does not store or upload audio. |
| Bluetooth | Finding and connecting Bluetooth receipt printers |
| Local network | Finding receipt printers on the store's Wi-Fi |
| Location (Android 11 and below only) | Required by the OS to scan for Bluetooth devices. Kivo never reads your location. |
Barcode scanning, object detection, text recognition on packages and background removal run on the device using Google ML Kit (Android) and Apple Vision (iOS / macOS); photos are not uploaded for this. ML Kit may send Google diagnostic data about the library's own operation (not images), as disclosed by Google.
9. Sample catalog and image downloads
Once a week on Wi-Fi the app may download sample-catalog updates and image packs (can be turned off in Settings → Kho hàng mẫu & AI). These downloads are anonymous: no account or device ID. Sample-catalog product images are fetched directly from ImageKit or Open Food Facts. As with any connection, those servers see your IP address.
10. Data the store enters about other people
When you record customers', suppliers' or staff names and phone numbers in Kivo, your store decides the purpose of that data; Kivo is the tool and, with sync on, processes it on your behalf. You are responsible for informing them and obtaining consent where the law requires. We use that data only to provide features to your store.
11. How we use data
- To provide the features you choose: sync, cloud AI, shared catalog, market prices, automatic transfer confirmation, Kivo Pro.
- To keep the service safe: authentication, device counting, usage limits, abuse prevention.
- To support you when you contact us. Support staff can see the store account's email and phone; each access is logged.
- To meet legal obligations (accounting, tax, lawful requests).
We process data on the basis of your consent (you choose to sign in and enable features, and can withdraw at any time) and to perform a contract when you buy Kivo Pro. We do not use your data for advertising, and do not sell, rent or profile it.
12. Retention
- On the device: until you delete it in the app, clear app data or uninstall.
- On the server: while the account is active. When the owner deletes the account in the app, the account and the store's synced data are deleted immediately; email requests are handled within 30 days. Details in Delete account & data.
- After account deletion: a one-way hash of the store ID and whether the Pro trial was used, so the trial is not granted again.
- AI assistant turn records (no content): 2 days.
- Transfers received through SePay or APIBank (automatic transfer confirmation): 180 days. Old transfers are removed when a new one arrives, on reconnecting or on disconnecting, so a store with no transfers for a long time may keep older ones until then. Deleted at once when the account is deleted.
- Pro payment records: for the period required by accounting and tax law (anonymised after account deletion).
- Infrastructure backups are overwritten on the provider's schedule.
13. Security
All app–server traffic uses HTTPS (TLS). Each store's data is isolated by database access rules; image and document storage is private; PINs are stored only as hashes; support access is logged. No system is perfectly secure. If a breach affects you, we will notify you and the competent authority as required.
14. Your rights
Under Vietnam's Personal Data Protection Law and related regulations you may:
- be informed about processing (this policy);
- access and get a copy of your data — in the app: Settings → Sao lưu & khôi phục to export everything, or export Excel / CSV;
- correct data — directly in the app;
- delete data and your account — in the app at Settings → Đồng bộ & tài khoản → Xoá tài khoản; see Delete account & data;
- withdraw consent — sign out, turn off sync, cloud AI, catalog contributions and price sharing, disconnect SePay and APIBank in Settings;
- object to or restrict processing, complain and claim compensation as provided by law.
Send requests to hai2571998@gmail.com from your account email. We acknowledge within 72 hours and resolve within the legal time limits. You may also complain to Vietnam's personal data protection authority (Department of Cyber Security and High-Tech Crime Prevention, Ministry of Public Security).
15. Children
Kivo is a tool for shops and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe we have, tell us and we will delete it.
16. This website
This website uses no cookies, no analytics or tracking, and self-hosts its fonts. Your light / dark choice is remembered only in your browser. The hosting provider may keep technical access logs (IP address, time) to operate the site and prevent attacks.
17. Changes
When we change this policy we update the effective date at the top. If a change reduces your rights or adds a new purpose, we will announce it in the app before it applies and ask for consent again where needed.
18. Contact
Nguyễn Thanh Hải, developer of Kivo · hai2571998@gmail.com · Vietnam