Privacy Policy
Effective date: October 20, 2026
This Privacy Policy explains how Vanta Technologies LLC, a Utah limited liability company ("Vanta", "we", "us"), collects, uses, shares and protects personal information when you use the KiwiShort mobile applications, the website kiwishort.com and related services (together, the "Service"). Vanta is the controller of your personal data.
Contact: Vanta Technologies LLC, 560 S 100 W St Unit 15, Provo, UT 84601, United States · privacy@kiwishort.com
1. Information we collect
| Category | Examples | Source |
|---|---|---|
| Identifiers | KiwiShort user ID, device-generated install ID, sign-in identifiers from Apple or Google, email address, IP address, push notification token, advertising ID (IDFA/GAID) only where you permit it | You, your device, sign-in providers |
| Profile | Name and profile picture shared by your sign-in provider, language preference | You, sign-in providers |
| Commercial information | Coins, membership, purchase product, date, store transaction ID and status. We never receive your full card or bank details — payments are processed by Apple or Google | Apple App Store, Google Play |
| Internet / app activity | Series and episodes watched, playback position, watch time, favorites, check-ins and rewards, ad views, app version, device model, operating system, crash and performance data | Your device |
| Approximate location | Country or region inferred from IP address (we do not collect precise GPS location) | Your device / IP |
| Communications | Feedback, screenshots and contact details you send us | You |
| Marketing attribution | Which ad campaign or link led to your install (for example "organic" or the name of an ad network and campaign) — collected only if you allow tracking | AppsFlyer, ad networks |
| Referrals | Which invite code you used and whether the invite was rewarded | You |
| Website data | Pages visited, cookies and similar technologies on kiwishort.com (see our Cookie Policy) | Your browser |
We do not knowingly collect sensitive personal information (such as health, biometric or precise geolocation data), and we do not use personal information to infer characteristics about you.
2. How we use information and our legal bases (EEA/UK)
| Purpose | Legal basis under GDPR / UK GDPR |
|---|---|
| Create and maintain your account, stream content, keep coins, membership, history and favorites in sync | Performance of our contract with you |
| Process purchases, restore purchases, handle refunds | Performance of contract; legal obligation (tax and accounting) |
| Prevent fraud, abuse of rewards, cheating and security incidents | Legitimate interests (protecting the Service and users) |
| Recommend series and improve the Service, analytics | Legitimate interests |
| Show personalised advertising and measure ads | Consent (you can withdraw it at any time under Profile → Settings → Privacy Settings) |
| Measure which marketing campaigns bring new users and purchases (attribution) | Consent (App Tracking Transparency on iOS, the consent dialog in the EEA/UK) |
| Send push notifications about new episodes, rewards and offers | Consent (you turn them on in the app and can turn them off in Settings at any time) |
| Run the invite-a-friend programme and prevent reward abuse | Performance of contract; legitimate interests |
| Show non-personalised ads, frequency capping | Legitimate interests |
| Respond to support requests, send verification codes and service messages | Performance of contract; legitimate interests |
| Comply with law and respond to lawful requests | Legal obligation |
3. Advertising and consent
KiwiShort is partly free and supported by ads served by Google AdMob. When you are in the European Economic Area, the United Kingdom or Switzerland, we ask for your consent through a Google-certified consent management platform (IAB TCF) before personalised ads are shown. In US states with privacy laws, you can opt out of the "sale" or "sharing" of personal information for targeted advertising in the same dialog. On iOS, we ask for permission through Apple's App Tracking Transparency prompt before accessing your advertising identifier. You can change your choices at any time in Profile → Settings → Privacy Settings, and VIP members are not shown ads. Learn how Google uses data: policies.google.com/technologies/partner-sites.
Website. Our website kiwishort.com may show ads from Google AdSense and use Google Analytics. Visitors in the EEA, UK and Switzerland are asked for consent through Google's certified consent message before cookies are used for ads or analytics; until then, Google Consent Mode keeps ad and analytics storage off. You can change your choice with the "Privacy settings" link at the bottom of every page. Details are in our Cookie Policy.
Attribution. We use AppsFlyer to learn which campaigns lead to installs and purchases. On iOS this happens only if you allow tracking in Apple's prompt, and in the EEA/UK only with your consent. Without that permission we only receive aggregated, non-identifying statistics (for example from Apple's SKAdNetwork).
Push notifications. If you turn on notifications, we store a device token issued through Google Firebase Cloud Messaging (which uses Apple Push Notification service on iPhone) to send you messages. You can turn notifications off in the app or in your phone's settings at any time.
4. How we share information
We do not sell your personal information for money. We share it only with:
- Service providers (processors) that host and operate the Service on our behalf: cloud hosting and storage, content delivery networks, email delivery, crash reporting and customer support tools — bound by contract to use data only for our instructions.
- Apple and Google to process in-app purchases and subscriptions, when you choose to sign in with them, and (Google Firebase) to deliver push notifications.
- AppsFlyer (attribution) — only with your permission as described in Section 3.
- Advertising partners (Google AdMob and its demand partners) to deliver and measure ads, according to your consent and opt-out choices. Under some US state laws this may be considered "sharing" for cross-context behavioural advertising; you can opt out as described below.
- Authorities when required by law, or to protect rights, safety and property.
- A successor in a merger, acquisition or sale of assets, subject to this policy.
5. International transfers
We are based in the United States and our providers may process data in the US and other countries. When we transfer personal data from the EEA, UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum), the EU-US Data Privacy Framework where a provider is certified, or other lawful transfer mechanisms.
6. Retention
- Account, wallet, history and favorites: while your account is active.
- After you delete your account: personal data is deleted or anonymised within 30 days; purchase records are kept anonymised for up to 7 years for tax and accounting.
- Support messages: up to 2 years. Security and server logs: up to 90 days.
7. Your rights — EEA, UK and Switzerland
You have the right to access, rectify, erase, restrict or object to processing of your personal data, to data portability, and to withdraw consent at any time (without affecting prior processing). You may object to processing based on legitimate interests and to direct marketing at any time. You also have the right to lodge a complaint with your local data protection supervisory authority. To exercise your rights, email privacy@kiwishort.com from the email linked to your account or include your KiwiShort user ID (Profile tab). We respond within one month.
EU / UK representative (GDPR Art. 27): [EU REPRESENTATIVE NAME AND ADDRESS] · [UK REPRESENTATIVE NAME AND ADDRESS]
8. Your rights — United States (California and other states)
If you live in California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana or another US state with a consumer privacy law, you have the right to:
- Know / access the categories and specific pieces of personal information we collected, the sources, purposes and the categories of third parties we disclose it to;
- Delete personal information we collected from you;
- Correct inaccurate personal information;
- Opt out of the sale or sharing of personal information and of targeted advertising — use Profile → Settings → Privacy Settings in the app, or email us with the subject "Do Not Sell or Share". We honour Global Privacy Control signals on our website;
- Data portability; and
- Non-discrimination — we will not deny service or charge different prices because you exercised your rights.
The categories of personal information we collected in the last 12 months are listed in Section 1; the business purposes in Section 2; and the categories of recipients in Section 4. We do not sell personal information for monetary consideration and we do not knowingly sell or share personal information of consumers under 16. You may use an authorised agent; we may ask you to verify your identity (by confirming account details) before fulfilling a request. If we deny your request you may appeal by replying to our decision; if the appeal is denied you may contact your state Attorney General.
9. Children
The Service is intended only for adults aged 18 and over and is not directed to children. We do not knowingly collect personal information from anyone under 18 (or under 16 in the EEA). If you believe a minor has provided us data, contact us and we will delete it.
10. Security
We use encryption in transit (HTTPS/TLS), encrypted video streams, access controls and least-privilege access to protect your data. No method of transmission or storage is 100% secure.
11. Your choices
- Delete your account: Profile → Settings → Delete Account, or see kiwishort.com/delete-account.
- Ad choices: Profile → Settings → Privacy Settings; iOS Settings → Privacy & Security → Tracking; Android Settings → Google → Ads.
- Push notifications: Profile → Settings → Notifications, or your phone's notification settings.
- Website cookies: the "Privacy settings" link at the bottom of kiwishort.com, or your browser settings.
- Unlink sign-in providers in your Apple ID or Google account settings.
12. Changes
We may update this policy. If changes are material we will notify you in the app before they take effect. The effective date above shows the latest version.