Privacy Policy

Last updated: 12 October 2026

This Privacy Policy explains how The Nudge L.L.C-FZ, a limited liability company registered in the Meydan Free Zone, Dubai, United Arab Emirates (“Kiwi”, “we”, “us”), collects, uses, discloses and protects personal information when you use the Kiwi app, communicate with Kiwi through messaging services, use any Kiwi hardware, or visit heykiwi.co (together, the “Services”). By using the Services you acknowledge this Policy. If you do not agree with it, do not use the Services.

1. Information we collect

Information you provide. Account details such as your name, date of birth, email address and phone number, and a record of when you accepted our Terms and this Policy; the messages, instructions, files and other content you send to Kiwi; information you ask Kiwi to remember; information you keep in your Vault, such as the details Kiwi fills into forms, health information and identity documents such as your passport; and anything you submit through our website.

Payment cards. Card details you add are collected directly by our payment card service provider and are not stored by Kiwi. We receive a reference to the card, its brand, the last four digits and its expiry date, and the spending limit you set. When you approve a payment, a single-use card number may be created for that payment only; it is used once and not kept.

Information about other people. Details of people you ask Kiwi to contact, meet, book for or remember, such as their names, contact details and messages. Share another person’s information only where you are entitled to.

Connected accounts. When you connect a third-party account or ask Kiwi to use a third-party service on your behalf, we receive and store the information needed to do so, which may include access tokens, sign-in details and content from that service such as email, calendar entries, contacts and files, to the extent you authorise.

Device and usage information. Information from your device such as IP address, device type, operating system, language, time zone, region, device identifiers and notification tokens; with your permission, location, calendar and contacts; and technical information about how the Services are used, such as log data, feature use and performance.

Information from others. Information from service providers, from third-party services you connect, from people who contact you through the Services, and from publicly available sources, such as websites Kiwi visits for you.

Sensitive information. Some information you share or connect, such as the content of emails and messages, sign-in details, identity documents and precise location, may be treated as sensitive by some laws. We process it to provide the Services you ask for and as this Policy describes. Where the law requires consent for this, you give it by choosing to share or connect that information; if you do not consent, do not share it.

Health information. If you add health information to your Vault, such as allergies, medication, conditions, your blood type, your doctor or your insurance, or ask Kiwi to keep it, we process it with your explicit consent, which you give when you add your first entry or ask Kiwi to keep it. We use it only to carry out tasks that need it, such as telling a restaurant about an allergy when Kiwi books a table, and you can see when Kiwi last used each entry. You can change or delete it at any time; deleting all of it withdraws your consent.

2. How we use information

We use personal information to provide, operate and maintain the Services; to verify your phone number and email address and confirm that you meet our age requirement; to carry out tasks and actions you request or authorise, including filling in forms and making payments you approve, each of which is checked against your request before you are asked to approve it; to personalise the Services, including by remembering information you share and occasions such as your birthday; to communicate with you, including about your account, invites and changes to the Services, and to send you news about Kiwi, which you can opt out of at any time; to maintain safety, security and integrity, and to prevent fraud and misuse; to develop and improve the Services, including through de-identified or aggregated information; to comply with law and enforce our terms; and for any other purpose disclosed to you when the information is collected. We will ask for your consent before using personal information for a new purpose that is not compatible with the one for which it was collected. We do not attempt to re-identify de-identified information.

Kiwi carries out tasks for you; we do not use personal information to make automated decisions about you that have legal or similarly significant effects.

We do not use the content of your conversations or connected accounts to train general-purpose artificial intelligence models.

3. How we disclose information

We do not sell personal information and do not share it for cross-context behavioural advertising. We disclose personal information only: to service providers and subprocessors that process it on our behalf under contract, listed on our Subprocessors page; to third-party services when you direct us to, such as when Kiwi sends a message, makes a booking or signs in on your behalf; when required by law or legal process, or to protect the rights, property or safety of Kiwi, our users or others; to professional advisers, such as lawyers, accountants, auditors and insurers; in connection with an actual or proposed merger, acquisition, financing, sale of assets, insolvency or similar event, including to prospective counterparties and their advisers; and with your consent.

Within Kiwi, the people who manage access and support can see your name, email address and phone number, whether your account is waiting, active or paused, and which services you have connected. They do not read your conversations, memories or saved sign-in details, except with your permission, for security purposes, or where required by law.

4. Google user data and other connected services

Kiwi’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. This section covers information Kiwi receives from Google APIs when you connect a Google account or sign up with Google (“Google user data”), in raw, aggregated or anonymised form, and prevails over anything else in this Policy.

What we access. Only the Google services you connect, with the permissions you grant on Google’s consent screen. Gmail: your email messages, to read and search them, send email you ask Kiwi to send, and archive or delete messages you name. Google Calendar: your calendars and events, to read them, add events, delete events Kiwi added and set your reply to an invitation. Google Contacts: names, nicknames, email addresses and phone numbers, read only. Google Tasks: your tasks, to read them and add tasks. If you sign up with Google, your name and email address. Kiwi does not access your Google Drive, Docs, Sheets or Slides.

How we use it. Only to provide and improve features you use: answering your questions about your own email, calendar, contacts and tasks; doing what you ask, such as sending an email, adding an event or adding a task; and telling you when an email needs your attention, which you can turn off. We do not use Google user data for advertising, to determine creditworthiness or for lending, or to develop, improve or train generalised artificial intelligence or machine-learning models, and we do not sell it.

Who we share it with. Only as needed to provide or improve those features: with service providers that host and process it for us under contract, including artificial intelligence service providers that process it only to produce Kiwi’s reply or action and may not use it to train their models, and messaging and voice providers that deliver Kiwi’s replies to you; with the people and services you direct, such as the recipient of an email you ask Kiwi to send; where required by law; to protect against fraud, abuse or security threats; and, with your explicit prior consent, as part of a merger, acquisition or sale of assets. We never transfer it to advertisers, data brokers or other information resellers.

People at Kiwi. No one at Kiwi reads Google user data unless you ask us to for a specific message or file, it is needed for security purposes such as investigating abuse, it is needed to comply with law, or it has been aggregated and anonymised for internal operations.

How we protect it. Google user data is encrypted in transit. The tokens that let Kiwi reach your Google account are encrypted again before we store them and stay on our servers. Each user’s data is kept separate from every other user’s, and access by our staff and service providers is limited to what they need.

How long we keep it. Kiwi reads your Google data when it needs it and does not keep copies of your emails, events or tasks. It keeps only: a copy of your contacts’ names, nicknames, email addresses and phone numbers, so it can find the person you mean; for Gmail, each message’s identifier and whether Kiwi alerted you about it, a short note about each email that needs your attention, and the emails Kiwi moved, so a move can be undone; and a record of your requests and of each action Kiwi took for you, such as an email it sent or an event it added. Kiwi’s replies to you, which may summarise Google user data, and anything you ask Kiwi to remember, stay in your conversation history.

Deletion. When you disconnect Google from Kiwi, we revoke Kiwi’s access with Google and delete its tokens, the contacts copy and the Gmail identifiers, notes and moves kept for it. If you disconnect only some Google services, we delete what was kept for each of them, and revoke the access with Google when the last one goes. Your conversation history, memories and records of requests and actions stay until you delete them, delete your account or ask us to delete them. Deleting your account deletes all of your Google user data. If you remove Kiwi’s access in your Google Account instead, Kiwi can no longer reach your Google data; disconnect in Kiwi or write to support@heykiwi.co and we will delete what we kept. Copies in backups are deleted as section 7 describes.

Other connected services. Information received from Microsoft and other connected services is used only to provide and improve user-facing features of the Services, is not used for advertising, and is not read by people at Kiwi except with your permission, for security purposes, or where required by law. Your use of a third-party service is governed by that service’s own terms and privacy policy.

5. Joining the waitlist

When you sign up, in Messages, on our website or in the app, we keep your phone number, email address, name and date of birth, and when you accepted our Terms and this Policy, and use them to confirm who you are and to let you in when a place opens up. If you sign up with Apple or Google, that company shares your name and email address with us. If a sign-up is never finished, we delete it after 30 days. If you finish signing up but have not been let in within twelve months, we delete your account. You can delete it yourself at any time at app.heykiwi.co.

6. Cookies

Our website does not use advertising or analytics cookies. We count visits without cookies to see how the website is used: the pages viewed, the site that linked to them, and the browser, device type and country, never in a way that identifies you. At app.heykiwi.co we use browser storage that is strictly necessary to keep you signed in. Because we do not track you across other websites, we do not respond differently to Do Not Track signals. Our hosting providers may process standard server log data, such as IP addresses, to operate and secure the website.

7. Retention

We keep personal information for as long as your account is active and as needed to provide the Services, and afterwards as necessary to comply with legal obligations, resolve disputes, enforce agreements and protect the Services. In deciding how long to keep it we consider its amount, nature and sensitivity, the risk of harm from misuse, the purposes we use it for and our legal obligations. When you delete information or your account, it is removed from the active Services promptly; copies in backups are kept out of use and deleted in the ordinary course of our and our providers’ backup cycles. Information in your Vault is kept until you remove it or delete your account; removing a card also removes it from our payment card service provider. We may keep and use information that has been anonymised, so that it can no longer be linked to you, without limit.

8. Security

We use technical and organisational measures designed to protect personal information, including encryption of stored credentials, health information and identity documents, and records of each use of them. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. International transfers

We and our subprocessors may process personal information in the United States and other countries whose data protection laws may differ from those where you live. Where required, we rely on appropriate safeguards for such transfers. You may contact us for more information about them.

10. Your choices and rights

You can access and delete much of your information, including your whole account, from the app, and disconnect connected accounts at any time. Depending on where you live, you may have rights to access, correct, delete, restrict or port your personal information, to object to certain processing, and to withdraw consent. To make a request, contact support@heykiwi.co. We may need to verify your identity, and the authority of anyone making a request for you, before responding. If we decline a request we will say why, and you may appeal by replying to our decision. We will not discriminate against you for exercising these rights. You can turn off location, calendar and contacts access in your device settings. Except as section 4 provides for Google user data, revoking a connected service’s access does not affect information we have already received from it. If you do not provide information we need, we may not be able to provide some or all of the Services. We do not sell personal information, share it for targeted advertising or knowingly collect it from anyone under 16. If you are in the European Economic Area or the United Kingdom, The Nudge L.L.C-FZ is the controller of your personal information, and our legal bases are the performance of our contract with you, our legitimate interests in operating, securing and improving the Services, compliance with law, and your consent where we ask for it; you may also complain to your local data protection authority.

11. Children

The Services are intended for people 18 and older. We do not knowingly collect personal information from children and will delete it if we learn we have. A parent or guardian who believes we have can contact us.

12. Changes to this Policy

We may update this Policy from time to time. If we make material changes we will notify you through the Services or by other means. Changes take effect when posted unless we say otherwise. Your continued use of the Services after the changes take effect means you accept the updated Policy.

13. Contact

The Nudge L.L.C-FZ, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates. support@heykiwi.co