Privacy policy

This policy explains how Kitebird Limited ("Kitebird", "we", "us") handles personal information when you visit kitebird.app, join our waitlist or use the Kitebird service. We are based in New Zealand and follow the Privacy Act 2020. If you are in the EU, UK or another region with its own privacy law, you have the rights set out in that law as well.

What we collect

Information you give us

• Your email address and, if you choose, what you're marketing, when you join the waitlist.
• Your name, email address and billing details when you create an account or subscribe.
• The content you upload or create in Kitebird: images, videos, captions and schedules.
• Messages you send us for support.

Information from social platforms you connect

When you connect a social account, you sign in with that platform and approve the permissions we ask for. We only request what we need to publish and report on your posts:

• Instagram (Instagram API with Facebook Login, through a Facebook Page you manage): your account ID, username, profile picture and account type; permission to publish posts, Reels and carousels you schedule; and basic insights for posts we publish.
• Facebook: the list of Pages you manage and choose to connect; permission to publish to those Pages and read engagement on posts we publish.
• TikTok (Login Kit and Content Posting API): your open ID, display name and avatar, the privacy options available for your account, and permission to upload or publish videos and photo posts you create in Kitebird.
• YouTube (YouTube API Services): your channel ID and name, and permission to upload videos you schedule. By connecting YouTube you also agree to the YouTube Terms of Service, and Google's handling of your data is covered by the Google Privacy Policy.
• Threads, LinkedIn and Bluesky: your account ID, handle and permission to publish.

We store the access tokens each platform gives us, encrypted, so we can post at the time you choose. We do not collect your social media passwords.

Information collected automatically

Our servers log basic technical data (IP address, browser type, pages requested and errors) to keep the service secure and working. We use privacy-friendly analytics without advertising cookies.

How we use it

• To publish your content to the accounts you connect, at the times you choose.
• To show you post status, errors and performance for posts we published.
• To warn you when a connection is about to expire or a post may fail.
• To run your account, take payment and provide support.
• To email you about your waitlist spot, your account and important service changes.
• To keep Kitebird secure and to meet our legal obligations.

We do not sell your information. We do not use data from Instagram, Facebook, TikTok or YouTube for advertising, to build profiles of you, or for any purpose other than providing Kitebird to you. We do not use your content or platform data to train AI models.

AI features

If you use AI features such as caption suggestions, the content you choose is sent to the AI provider that powers that feature (or the provider whose API key you add) only to generate the result. We use providers' API terms that do not allow them to train on your data.

Who we share it with

We share information only with:

• The social platforms you connect, when we publish on your behalf.
• Service providers that help us run Kitebird: hosting, database, file storage, email, payments and AI providers. They may only use it to provide their service to us.
• Authorities, where the law requires it.

Some providers store data outside New Zealand. Where that happens we make sure it is protected to a standard comparable to the Privacy Act 2020.

How long we keep it

• Waitlist emails: until you ask us to remove them or we close the waitlist.
• Platform tokens and data: until you disconnect the account, delete your Kitebird account, or remove Kitebird from the platform's settings. We then delete it within 30 days.
• Uploaded media: until you delete it, or 30 days after you close your account.
• Billing records: as long as tax law requires (seven years in New Zealand).

Your rights and deleting your data

You can ask to see or correct the personal information we hold about you, or ask us to delete it, by emailing privacy@kitebird.app. You can disconnect any social account in Kitebird at any time, which deletes its stored tokens. For step-by-step deletion instructions, including removing Kitebird from Facebook, Instagram or TikTok, see our data deletion page.

If you're not happy with how we handle a request, you can complain to the Office of the Privacy Commissioner.

Security

We encrypt data in transit and encrypt access tokens at rest, limit staff access, and review our systems regularly. If a breach is likely to cause serious harm, we will notify you and the Privacy Commissioner as the law requires.

Children

Kitebird is for businesses and people aged 16 and over. We do not knowingly collect information from children.

Changes

If we make significant changes we will update the date at the top and email account holders before they take effect.

Contact

Kitebird Limited, New Zealand. Email privacy@kitebird.app.