Privacy Policy

Last updated: September 2026

1. Introduction

Kikaye ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our services.

Important: We collect sensitive data (HubSpot API tokens). These are your production credentials. We treat them with the security of a financial password.

2. Information We Collect

2.1 Information You Provide

• Account Information: Email, name, password (if using email login)
• Payment Information: Processed by Stripe; we do not store card details
• HubSpot Connection: The authorisation you grant when you connect HubSpot (or, for older accounts, a HubSpot API token you pasted). Required to use the service, and encrypted at rest. You can revoke it from Kikaye or from HubSpot at any time.
• Partner Code: If you arrived through a Kikaye partner's link or entered their code at signup, which partner referred you. Partners see only that a numbered customer paid, never your name or details.
• Team Data: Email addresses of team members you invite

2.2 Information Collected Automatically

• Session Cookies: To keep you logged in, and to remember a partner's code for the rest of your visit if you arrived through their link
• Server Logs: IP address, browser type, pages visited (standard web server logs)
• Country, for prices: we look up the country of your IP address on our own server, using the IP Geolocation by DB-IP database, to show prices in your currency. The address is not sent to anyone for this and the country is not stored. Your browser's time zone may be kept in a cookie for the same purpose.
• Google OAuth Profile: Name, email, profile picture (if signing in with Google)

2.3 Information from Third Parties

• Google: Profile information when you authenticate with Google
• Stripe: Confirmation of successful payments
• HubSpot: We read contacts, email subscription status, lists, deals, owners, pipelines and (on Enterprise portals, if you allow it) custom objects, only as needed for the apps you use. We write back only when you act in an app: changing a subscription in HubSubs, recording an RSVP or attendance in HubRSVP, or creating an attendee list. HubDash never writes.

3. How We Use Your Information

• To provide the service: Authenticate you, store your settings, read from your HubSpot portal
• Billing: Process subscriptions and payments via Stripe
• Support: Respond to your support requests
• Security: Detect and prevent fraud or abuse
• Legal: Comply with law or legal process

4. Who We Share Your Data With

• Stripe: Payment processor. They handle billing and keep PCI compliance.
• Google: Only if you authenticate via Google (they already have your profile).
• HubSpot: We use their API to read from your portal, only with your token.
• Service providers: Railway (hosting), Cloudflare (CDN), Google Fonts (typography)

We do not sell your data. We do not share your HubSpot token with anyone except HubSpot via their API.

5. Data Security

• HubSpot tokens are encrypted at rest using AES-256
• Passwords are hashed with bcrypt
• All data is transmitted over HTTPS (TLS 1.2+)
• Database is on a private, firewalled server

While we use industry-standard protections, no security is perfect. If you believe your account is compromised, contact us immediately.

6. Your Rights

Under Australian Privacy Act:

• Access: You can request a copy of your personal information
• Correction: You can correct inaccurate data
• Deletion: You can request deletion (we will delete your account and associated data within 30 days)
• Opt-out: You can stop receiving communications

To exercise these rights, email ash@kikaye.com with "Privacy Request" in the subject line.

Under GDPR (if you're in EU):

• Right to access, correct, delete ("right to be forgotten")
• Right to data portability (export your data)
• Right to restrict processing
• Right to object to processing
• Right to lodge a complaint with your data protection authority (EDPB)
• Right to withdraw consent at any time

Legal basis for processing: Your explicit consent (when you sign up) and performance of the contract (when you use the service).

7. Data Retention

• Active accounts: Data kept while you use the service
• Deleted accounts: Permanently deleted within 30 days (except legally required records)
• Server logs: Kept for 7 days then deleted
• Payment records: Kept for 7 years (tax/legal requirement)

8. Cookies & Tracking

• Session cookies: Essential, remember you're logged in
• No analytics tracking: We do not use Google Analytics or third-party tracking
• No advertising pixels: We do not track you across other websites

9. Children & Minors

Kikaye is not intended for anyone under 18. We do not knowingly collect data from minors. If you're under 18, please do not use this service.

10. International Data Transfers

Your data may be stored or processed in Australia, US (Stripe), or US (Google). By using Kikaye, you consent to this transfer. We have agreements in place (Standard Contractual Clauses) to protect your data.

11. Changes to This Policy

We may update this policy. Changes are effective when posted. Continued use means you accept the updated policy.

12. Contact Us

Privacy Questions or Requests:
Email: ash@kikaye.com
Subject: "Privacy Request" or "Privacy Concern"
Response time: Within 30 days

Complaints (Australia):
You have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you believe we've breached the Privacy Act.