Kiwi Dynamics Limited ("Kiwi Dynamics", "we", "us") is a New Zealand company headquartered in Tāmaki Makaurau Auckland. This Privacy Policy explains what personal information we collect about you when you visit our website, send us an enquiry, or work with us on a project, why we collect it, how long we keep it, who we share it with (in short: very few), and the rights you have over the information we hold. We have written it to be readable end-to-end by a normal human in under five minutes. If anything is unclear, email us at [email protected] and we will rewrite the unclear bit.
1. Information you give us directly
When you fill in the contact form on this site, we collect the fields you provide – which today is your name, your email address, and the free-text message describing what you are trying to do. We also record which page on the site you submitted the form from, the source identifier of that form (an internal label that helps us tell apart enquiries from the contact page, a solution page, a location page, a case study and so on), the URL you came from before you reached us, and a timestamp of when you submitted. We will only ever ask you for the minimum information we need to reply usefully; if a field is not marked required, leaving it blank will not affect our ability to help you.
If you go on to work with us on a project, we will collect more information as required to deliver that work – which may include contact details for other people on your team, access credentials to systems you have authorised us to integrate with, project documentation, and any data you ask us to process. The terms governing that information are spelled out in the Statement of Work we sign for the engagement, not in this Privacy Policy.
2. Information collected automatically
Like every site behind Cloudflare, we receive a small bundle of metadata with each request that hits our servers. This includes your IP address, the approximate geographic location Cloudflare derives from that IP (typically country, region and city, but never your street), your internet service provider and autonomous system number, your timezone, your user agent string (which encodes browser and operating system), the referring URL if any, and the Cloudflare edge data centre that handled the request. We do not run any third-party analytics, advertising pixels, social media trackers or fingerprinting libraries on this site. We do not have a Google Analytics account, a Meta pixel, a LinkedIn Insight tag, or anything equivalent. The aggregate visit data we look at to understand which pages are useful is recorded by a small first-party endpoint that stores nothing more than a path and a referrer per visit.
We also use Cloudflare Turnstile on the contact form to keep automated submissions out. Turnstile may set a short-lived cookie and run a small JavaScript challenge in the background; it does not perform tracking across other sites and Cloudflare's documentation is the authoritative source for its behaviour.
3. Why we collect it
The information you submit through the contact form is used to reply to your enquiry and, if a conversation develops, to keep useful context for follow-up. The edge metadata that arrives automatically helps us understand where readers of the site are coming from at a country and region level, defend the site from abusive traffic, and triage support questions ("we got an error on Friday afternoon" is much easier to investigate when we can see which edge handled the request). Aggregate visit data helps us understand which content is read and which to retire. We do not use any of this information for advertising, profiling, scoring, or any decision that materially affects you.
4. Where the information lives
Form submissions are stored in a Cloudflare D1 database (SQLite at the edge) inside our Cloudflare account. Email notifications about new submissions are delivered to a Gmail mailbox we own. We do not push form submissions into any third-party CRM, marketing automation tool, or data warehouse. Aggregate visit logs are stored in the same D1 database. The Cloudflare account, the Gmail mailbox and the developer tooling we use to administer them are protected with multi-factor authentication.
5. Who we share it with
We do not sell, rent, license or otherwise share personal information about visitors or enquirers with third parties for marketing or advertising purposes. The unavoidable exceptions, which are common to almost every internet-connected service, are: Cloudflare, which is the infrastructure provider serving every page and storing the form submissions; Google, which operates the Gmail mailbox the notifications land in; and any law enforcement or regulatory body that produces a valid legal order. If we ever materially change which third parties touch your information, we will list the change here and update the date at the top of this page.
6. How long we keep it
Contact form submissions stay in our database for as long as the conversation they started is still useful – which in practice means a handful of months for cold leads and as long as the engagement continues for active clients. If you ask us to delete a submission, we delete it. We do not maintain hidden archives. Edge metadata associated with form submissions is stored alongside them and is deleted at the same time.
7. Your rights under the Privacy Act 2020
New Zealand's Privacy Act 2020 gives you the right to ask any organisation, including this one, what personal information it holds about you, to ask for that information to be corrected if it is wrong, and to ask for it to be deleted in certain circumstances. To exercise any of these rights, email [email protected] with enough detail for us to identify you (typically just the email address you originally submitted from) and what you want done. We will action your request within the 20 working days the Act requires, usually inside a few business days. If you ever feel we have mishandled your information, you can also raise a complaint directly with the Office of the Privacy Commissioner at privacy.org.nz.
8. Changes to this policy
We update this page when we add or remove something that materially changes how we handle your information. The date at the top is the source of truth for when the most recent change was made. We do not silently re-edit older paragraphs; significant rewrites get a one-line summary of what changed at the bottom of this page so you can see what shifted.