App privacy notice

Last updated: 16 October 2026

KiwiPhone is operated by Rebase Ventures Limited, a company registered in England and Wales, number 12607001. Our registered office is 2 Upperton Gardens, Eastbourne, East Sussex, BN21 2AH, United Kingdom.

Damien Tanner, CEO, is responsible for privacy. Contact him at hi@kiwiphone.app or write to our registered office, marked “KiwiPhone privacy”.

This notice covers the KiwiPhone mobile app and its telephone service for businesses in the United Kingdom, Canada, including Quebec, and New Zealand. Our website privacy notice covers launch-list signups and advertising.

Who is responsible for your information

Rebase decides how to use account, security, support and subscription information to run KiwiPhone. In UK data-protection law, this makes us a controller for those purposes.

A business using KiwiPhone decides why it handles information about its callers and customers. We process that information on its instructions to provide the service. Our data processing agreement sets out those responsibilities. A caller can contact the business directly about its use of their information or contact us for help identifying the right request route.

Account and business information

We collect your email address and authentication records when you sign in. Your business profile includes the details you supply, such as its name, website, services, address and opening hours. Country, province or region and time-zone settings help us provide the appropriate service.

When you import a website, Firecrawl reads its public pages and OpenAI prepares business notes from the text. Public pages can include personal information. You can review the notes and correct them. Google Places processes business searches used during setup under the Google Privacy Policy.

Telnyx receives the information needed to register and operate your number. This includes business details from your reviewed website import and any required address. Telnyx holds carrier verification documents. We keep provider references, registration status and the identity associated with them.

Calls and AI

Telnyx connects business calls. It also handles account and communications-usage data for its own service and legal purposes under its data processing terms. When KiwiPhone’s AI Receptionist answers, OpenAI processes the live conversation to respond using the business notes. Owner-answered incoming calls and outgoing business calls use Telnyx transcription. We save available conversation text and use OpenAI to prepare a summary. AI-answered calls can also produce follow-up tasks.

Call records include telephone numbers, direction, times, routing, outcome and provider references. People records can include names, email addresses and other details supplied in a call. A matching telephone number links records without proving who a person is.

KiwiPhone keeps call conversations as text. Audio playback and voicemail are outside the service. Audio passes through the providers that connect and process the call. Their operational and security retention is separate from the text we keep. OpenAI's published default includes up to 30 days of abuse-monitoring retention, subject to its stated exceptions. Its data controls describe the endpoint rules.

AI responses and transcripts can contain mistakes. The business should check important details before acting. The service does not use a voiceprint to verify identity. Calls placed through your phone's calling app from your personal number use your own carrier and remain outside KiwiPhone transcription.

The business using KiwiPhone must give callers the information and choices required for its use of the service. Contact that business if you want another way to communicate. You can ask us about the handling of your information at the contact above.

Practice calls

Choosing a microphone demo sends your voice to OpenAI for a practice conversation. KiwiPhone discards demo conversation content. We retain session references, its deadline and outcome, including whether speech occurred in both directions, to operate the demo and enforce its limits. Provider retention follows the applicable data controls.

Subscriptions, notifications and support

Apple or Google Play handles purchases and payment methods in the store where you subscribe. RevenueCat processes your KiwiPhone account identifier and purchase information to check subscription access and restore purchases. We keep the subscription status, relevant dates and transaction references. The store retains payment information under its own terms.

Expo delivers notifications through Apple or Google Firebase using your device push token. An alert can include a caller name or number, summary or task text. Your phone settings control lock-screen previews. Turning off notifications affects your ability to see incoming call offers.

We use your account email for service messages and to respond to support or privacy requests. Cloudflare receives messages sent to hi@kiwiphone.app and sends our replies. We save email text and addressing details in Supabase for our privacy officer to read and answer. Attachments and images are removed before storage. Long messages can be shortened.

Reliability and security

We keep limited setup milestones and call diagnostics to investigate failures and manage the service. Diagnostic events describe connection steps and error categories. The diagnostic journal excludes conversation text and sign-in credentials. Account-level milestones support internal reporting; the app's call content is not sent to Meta for advertising.

Access to account records requires authentication. Operator access is restricted. Providers process information needed for their service, and we can disclose information when a law requires it or to protect people and legal rights.

Why we use personal information

For our UK controller activities, we rely on the contract with an individual account holder to provide the service they request. Our legitimate interests cover providing business accounts, protecting the service, handling support and improving reliability. You can ask about these interests and object to this use of your information. Legal obligations can require particular carrier, accounting or disclosure records. Optional marketing relies on the relevant consent or other lawful permission.

Caller-content processing follows the customer's lawful instructions and the applicable law. Customers must establish the basis for their use and any additional condition required for sensitive information. The app is intended for adults running a business. The AI Receptionist cannot provide clinical or legal triage or arrange an emergency response.

In Canada and New Zealand we handle information for the purposes explained here, with the consent or other authority required by the applicable law. Information can come from the business, a caller, a public business website or a service provider. These sources matter when you ask about a record that concerns you.

Providers and overseas processing

Our subprocessors and service providers page explains the services used and links to their public terms. Information is processed in Europe and the United States, with other locations used by provider networks and support operations. Foreign courts or authorities can require disclosure under local law.

For UK transfers, applicable safeguards can include adequacy regulations or EU standard contractual clauses with the UK Addendum. Canadian processing remains subject to applicable accountability and contractual requirements. New Zealand's overseas-disclosure rules apply according to the recipient's role. Contact us for information about the safeguards for your data and a copy where applicable, with confidential material protected.

How long we keep information

Call transcripts, summaries and associated customer records remain with the account for the account's lifetime. There is no automatic age-based expiry. Account closure starts deletion of these records. Contact us to request earlier deletion or to exercise another right.

Setup, business profile, number-order and subscription records remain linked to the account while they are needed to provide the service. Legal obligations or an unresolved number order, dispute or deletion request can require some records to be kept after closure. We restrict retained information to the reason it is still needed.

We retain saved support email text indefinitely. Account deletion removes correspondence linked to that account, including mail matched to its earlier email addresses. You can ask us to erase correspondence from an address that has no account.

Server call diagnostics expire after 30 days. Your phone can hold diagnostic events for up to 3 days while offline; signing out clears that queue. Provider copies can have separate retention periods. Deletion requests also need to cover relevant provider copies, and completion can depend on their response.

Account deletion and your rights

Choosing “Delete account” in Settings and confirming closes access immediately, signs you out and starts cleanup. Your business number stops working. Cleanup removes your account data and requests provider cleanup. Account cleanup logs remain for up to 90 days; unresolved provider work or legal requirements can extend retention for the relevant records.

You can also request account deletion by email, including after uninstalling the app. We check account ownership and aim to handle email requests within 7 days. Contact us if you want to transfer your number before closing the account. Cancel your subscription separately in the store where you bought it.

Depending on the law and circumstances, you can request access to your information, correction, deletion, restriction or a portable copy. You can object to processing and withdraw consent where it is the basis for processing. Withdrawal affects future use. Some information is required to provide the service you requested.

Email us with a description of your request. We use proportionate identity checks and protect other people's information when providing a copy. A caller should identify the business and approximate call date. Please keep passwords, verification codes and identity documents out of the initial email. We will explain any lawful limit or extension to our response.

Complaints

You can raise a privacy concern with Damien Tanner using the contact above. UK customers can complain to the Information Commissioner's Office. In Canada, contact the Office of the Privacy Commissioner of Canada or the relevant provincial authority, including the Commission d'accès à l'information du Québec, British Columbia commissioner or Alberta commissioner. The New Zealand Privacy Commissioner handles NZ privacy complaints.

Changes to this notice

We publish the current version here. When our data practices change, we update the privacy information in the App Store and Google Play. We will give further notice or request consent where the applicable law, our data processing agreement or the store’s rules require it. See the app terms for service conditions.

Emergency calling

Telnyx receives your registered business address and callback number for emergency calling. We keep operational call details to run and secure the service. Emergency calls are not transcribed and do not generate AI notes.