Privacy Policy

Who we are

Kivoon ("we", "us", "our") is a public transit companion app for the Isle of Man. We are the data controller for the personal data described in this policy.

Contact us at [email protected] for any privacy-related queries.

What data we collect

Website (kivoon.im)

• Analytics: anonymous, aggregated page view and event data collected via Umami Cloud. Umami does not use cookies, does not collect personal data, and does not track users across sites.

Kivoon app

• Account registration: name and email address, provided when you create an account. Used to identify you, sync your preferences across devices, and communicate service updates.
• Location: your device location is used solely to show nearby stops and real-time departures and assist with navigation.
• Preferences: your saved routes, favourite stops, and display settings are stored to personalise your experience.
• IP address: collected automatically when you use the app. Used for security (abuse prevention), approximate geographic region for service delivery, and debugging. We do not use IP addresses for tracking or profiling.
• Usage analytics: anonymous, aggregated analytics (screens viewed, features used) to help us improve the app. No personal identifiers are collected.
• Crash reports: anonymised crash and error data to help us fix bugs.

Lawful basis for processing

We process your data on the following grounds under GDPR:

• Contract (Article 6(1)(b)): processing your account data (name, email, preferences) is necessary to provide the Kivoon service and personalise your experience.
• Legitimate interests (Article 6(1)(f)): anonymous analytics to improve our website and app, security measures to protect against abuse, and processing IP addresses for service delivery and debugging.

How we use your data

• To provide and personalise the Kivoon app, including syncing your preferences across devices.
• To send you service-related communications (e.g. disruption alerts, if opted in).
• To understand how visitors use our website and app so we can improve them.
• To protect our services from automated abuse and ensure security.

Who we share data with

We only share data with processors that are strictly necessary to operate the service:

• Cloudflare (USA) — website hosting, API infrastructure, and bot protection. Cloudflare processes data under their DPA with appropriate safeguards for international transfers.
• Umami Cloud (EU) — privacy-focused, cookie-free website analytics.
• Google Firebase (USA) — app backend infrastructure, user authentication, and crash reporting. Google processes data under standard contractual clauses.

Where data is transferred outside the UK, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or the UK International Data Transfer Agreement.

How long we keep your data

• Account data: retained for as long as your account is active. If you delete your account, your personal data is erased within 30 days.
• IP addresses: retained in server logs for up to 90 days, then automatically deleted.
• Analytics data: aggregated and anonymised; not linked to individuals and retained indefinitely.

Your rights

You have the right to:

• Access the personal data we hold about you.
• Rectification - have inaccurate data corrected.
• Erasure - request deletion of your data.
• Withdraw consent at any time (this does not affect the lawfulness of processing before withdrawal).
• Data portability - receive your data in a structured, machine-readable format.
• Object to processing based on legitimate interests.
• Restrict processing in certain circumstances.

To exercise any of these rights, email [email protected]. We will respond within one month.

Cookies

The Kivoon website does not use cookies. We use Umami Cloud for analytics, which is fully cookie-free.

Children's privacy

Our services are not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. Material changes will be communicated via the website. The "Last updated" date at the top reflects the latest revision.

Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Isle of Man Information Commissioner.