LEGAL · KAI COACH NZ
Privacy Policy
Our commitment
Kai Coach NZ takes your privacy seriously. We comply with the NZ Privacy Act 2020 and the 13 Information Privacy Principles (IPPs). This policy explains what we collect, why, and your rights.
1. What we collect
- Identity: name, email, profile photo (from Google sign-in via Emergent Auth)
- Preferences: household size, budget, dietary preferences, preferred supermarket
- Usage: meal plans generated, grocery lists, savings tracker
- Device: Expo push token, OS, basic diagnostic logs
- Payment: handled 100% by Stripe — we never see or store your card details. We retain Stripe customer + subscription IDs only.
2. Why we use it
- To deliver your weekly meal plans and grocery lists
- To match specials to items on your list and send push/email alerts
- To bill your subscription through Stripe
- To improve the service (aggregated, de-identified analytics only)
- To comply with NZ law
3. Who we share it with (third-party processors)
We use a small number of carefully-chosen third parties. None of them sell your data.
- Stripe (payments) — processes subscriptions; stores card data under PCI-DSS
- SendGrid (email) — delivers specials alerts and transactional emails
- Expo Push (notifications) — delivers push alerts to your device
- Emergent Auth (Google OAuth) — handles sign-in
- Apple Sign in with Apple (iOS only) — handles sign-in on Apple devices
- Cloud infrastructure — hosts backend services (region: NZ/AU/US)
4. Where your data lives
Your data is stored on secure cloud infrastructure. Some processors (e.g. Stripe, SendGrid) are based in the USA. By using Kai Coach, you consent to data being transferred outside NZ for processing, subject to equivalent protections.
5. How long we keep it
- Active accounts: as long as you're a user
- Inactive accounts: 3 years after last login, then deleted
- Financial records (invoices): 7 years per NZ tax law
- Backups: rolling 30-day encrypted backups
6. Your rights (NZ Privacy Act 2020)
You have the right to:
- Access the personal information we hold about you
- Correct information that is wrong
- Delete your account and associated data
- Object to marketing (use the unsubscribe link in any email, or toggle in Profile → Notifications)
Email kaicoachnz@gmail.com to exercise any of these. We respond within 20 working days.
7. Cookies & tracking
We use a single httpOnly session cookie to keep you signed in. No advertising or cross-site tracking cookies. We may add privacy-respecting analytics (e.g. anonymised, aggregated) later; this policy will be updated first. See our Cookie & Data Notice for details.
8. Children
Kai Coach is not intended for children under 16. If you believe a minor has signed up, email us and we'll delete the account.
9. Security
We use HTTPS everywhere, industry-standard password hashing (via Stripe/Google — we never touch your password), restricted-scope API keys, and encrypted data at rest. No system is 100% secure; tell us at kaicoachnz@gmail.com if you find a vulnerability.
10. Complaints
If you're unhappy with how we handle your data, email us first at kaicoachnz@gmail.com. If unresolved, you can complain to the NZ Office of the Privacy Commissioner at privacy.org.nz.
11. Updates
We'll notify you in-app or by email at least 14 days before material changes to this policy.
Email: kaicoachnz@gmail.com