01. Who we are and what this policy covers
This Privacy Policy explains how Honne Technologies Ltd, trading as Kiroa (“Kiroa”, “we”, “us”, “our”), collects, uses and protects personal data. We are a company limited by shares incorporated in Northern Ireland under company number NI703624, with our address at 37 Letter Road, Aghnablaney, Leggs, Enniskillen, Fermanagh, BT93 2BB.
We are the controller of the personal data described in this policy, which is about:
- visitors to kiroa.io and people who contact us, ask for a quote or book a call;
- people who sign up for Kiroa and the businesses they register;
- the team members of our customers who use the Kiroa admin panel (be.kiroa.io).
This policy does not cover the guests of the hotels, venues and travel businesses that use Kiroa. When you send an enquiry, make a booking or pay through a website built with Kiroa, the business that runs that website is the controller of your data and Kiroa only processes it on its behalf, under our Data Processing Terms. Please read that business’s privacy policy, which is linked from its website. If you contact us about such data, we will pass your request to the business concerned.
The English version of this policy prevails over any translation.
02. What data we collect and why
We collect personal data directly from you (when you sign up, fill in a form, write to us or use the admin panel) and automatically, from your device, when you use our websites.
| What we use it for | Data | Legal basis |
|---|---|---|
| Creating and running your account and your business’s subscription | Name, email, password (stored only in encrypted, hashed form), business name, business type and description, country and address, website address and languages, role in the team | Contract with you or your business |
| Recording that the Terms were accepted | Terms version, date and time of acceptance | Legitimate interests (evidence of the contract) and legal obligation |
| Billing | Billing contact, plan and currency, invoices and payment status, VAT number. Card details are collected and stored by Stripe; we never see them | Contract; legal obligation (tax and accounting records) |
| Service emails | Email address, account and billing events (for example, confirming your email, welcome, payment receipts and reminders) | Contract |
| Replying to enquiries, quotes and calls | Name, email, phone, business, the content of your message or enquiry | Legitimate interests (answering you and preparing a quote); contract, if you then become a customer |
| Security and preventing abuse | IP address, browser and device information, bot-protection signals, sign-in records and logs | Legitimate interests (keeping the service and your account secure) |
| Improving Kiroa | Aggregated information about how the service is used, for example the steps of the signup completed. We use it in aggregate, not to profile you | Legitimate interests (improving the service) |
| Telling you about Kiroa | Name and email, if you have agreed or you are a customer | Consent, or legitimate interests for customers (you can opt out at any time) |
| Complying with the law | Any of the above, when required | Legal obligation |
We do not make decisions that have legal or similarly significant effects on you based solely on automated processing. Automated checks such as bot protection only decide whether a form can be sent; if you are wrongly blocked, contact us.
We do not use your personal data to train AI models.
03. Cookies
Some cookies are strictly necessary for the service you ask for, so they do not need your consent. Others, for analytics, are only set if you accept them in the cookie banner, and you can change your choice at any time from “Cookie settings” at the bottom of every page.
| Where | Cookie | Purpose | Type | Duration |
|---|---|---|---|---|
| kiroa.io | NEXT_LOCALE | Remembers the language you chose | Necessary | 1 year |
| kiroa.io | kiroa_consent | Remembers whether you accepted analytics | Necessary | 12 months |
| kiroa.io | Google Analytics (_ga, _ga_*) | Counts visits and shows how the site is used, so we can improve it. Set by Google, which processes the data under its own terms | Analytics, only with your consent | Up to 2 years |
| be.kiroa.io | Sign-in session | Keeps you signed in to the admin panel | Necessary | Session, renewed while you use it |
| be.kiroa.io | kiroa_signup_nonce | Links the confirmation email to the browser that started the signup, to protect your account | Necessary | 24 hours |
| be.kiroa.io | Language preference | Remembers the admin language you chose | Necessary | 1 year |
| be.kiroa.io | Bot protection (Cloudflare Turnstile) | Checks that the signup form is used by a person | Necessary | Session |
Google Analytics is used with IP truncation and without advertising features. If you do not accept analytics, it is not loaded at all.
Websites built with Kiroa are run by our customers, who decide whether to use analytics. On those websites, analytics only load after the visitor consents in the cookie banner.
04. Who we share it with
We do not sell your personal data. We share it only with:
- Service providers that run Kiroa on our behalf and only on our instructions: Supabase (database and sign-in), Vercel (hosting), Stripe (payments and invoices), Resend (email), Upstash (cache) and Cloudflare (bot protection). The current list is kept in clause 10.4 of our Terms.
- Stripe also acts as a controller for some payment data, for example to prevent fraud and meet its legal obligations, under its own privacy policy.
- Honne, our experiences and booking product, only if your business asks to connect it.
- Professional advisers (such as accountants and lawyers), under a duty of confidentiality.
- Public authorities, when the law requires it.
- A buyer or successor, if our business or part of it is sold or reorganised, under this policy.
05. Where your data is stored
Your data is stored in the European Union (Ireland). We are based in the United Kingdom, which the European Commission recognises as providing adequate protection, and the UK recognises the EU in the same way. Some of our service providers may process data in other countries, such as the United States. When they do, we make sure the transfer is protected by an adequacy decision (for example, the EU-US Data Privacy Framework and its UK extension) or by the standard contractual clauses approved by the European Commission and the UK.
06. How long we keep it
| Data | How long |
|---|---|
| Account and business data | While the account is active, and 90 days after the subscription ends, so you can export it or come back |
| Invoices, payments and tax records | 6 years after the end of the financial year they relate to, as UK law requires |
| A signup that was not completed | 30 days |
| Enquiries and quotes that did not lead to a contract | 2 years after our last contact |
| Security logs and sign-in records | 90 days, unless needed to investigate an incident |
| Evidence of accepting the Terms | For as long as the contract lasts and 6 years after it ends |
We may keep data for longer if there is a complaint or a legal claim, or if the law requires it. When we no longer need it, we delete it or make it anonymous.
07. Security
We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit, strict separation between customers’ data, access limited to the people who need it, and confidentiality duties for everyone who works with us. No system is completely secure; if a breach affects your data and puts you at risk, we will tell you and the regulator as the law requires.
08. Your rights
Under UK and EU data protection law you have the right to:
- access the personal data we hold about you;
- have it corrected if it is inaccurate or incomplete;
- have it erased in certain circumstances;
- restrict how we use it in certain circumstances;
- object to our use of it based on legitimate interests, and always to its use for direct marketing;
- receive it in a portable format, or have it sent to another provider (portability);
- withdraw your consent at any time, where we rely on it, without affecting what we did before.
To exercise any of these rights, write to info@kiroa.io. We may ask you to confirm your identity. We reply within one month, or tell you if we need longer because a request is complex. It is usually free; we may charge a reasonable fee or refuse a request that is clearly unfounded or excessive.
If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the UK Information Commissioner’s Office (ico.org.uk) or to the data protection authority of the EU country where you live or work.
09. Children
Kiroa is a service for businesses and is not intended for anyone under 18. We do not knowingly collect data from children; if we learn that we have, we will delete it.
10. Changes to this policy
We may update this policy. We will publish the new version here with its date and, if a change materially affects how we use your data, we will tell registered users by email before it takes effect.
11. Contact
If you have any questions about this policy or how we handle your personal data:
- By post: Honne Technologies Ltd (Kiroa), 37 Letter Road, Aghnablaney, Leggs, Enniskillen, Fermanagh, BT93 2BB
- By email: info@kiroa.io