Privacy Policy

This policy explains what personal data Klivo Relay collects, why we collect it, and the rights you have over your data. We follow the UK GDPR and the Data Protection Act 2018.

1. Who is the controller

Klivo Relay Ltd, registered in England and Wales, is the data controller for the personal data described below. Contact us at hello@klivorelay.com.

2. What we collect

We collect the following categories of personal data:

• Account data— your email address (used to sign in via magic link) and any name you choose to attach to events.
• Event data— the events you create, their titles, the streams they produce, and the recordings we store on your behalf.
• Guest uploads— photographs that guests upload to your events via QR code. Klivo Relay does not require guests to log in.
• Technical data— IP address, browser type and operating system, used to keep the Service secure and to apply rate limits to public endpoints.
• Usage analytics— if you accept the analytics cookie, we record aggregate page views and feature usage. See our Cookie Policy for details.

3. Why we collect it (lawful bases)

• Contract— to provide the Service you signed up for (creating accounts, streaming, billing).
• Legitimate interests— to keep the Service secure, prevent abuse, and improve features. We have considered the balance of interests in each case.
• Consent— for optional analytics and any future marketing emails. You can withdraw consent at any time.
• Legal obligation— to comply with tax, fraud and other statutory obligations.

4. Who we share data with

We use a small number of trusted processors to run the Service:

• Cloudflare— live streaming infrastructure, edge networking and photo storage.
• Supabase— authentication and the database that stores your account and event records.
• Vercel— hosting for the website and, subject to your consent, privacy-friendly analytics.

We do not sell your personal data and we do not share it with advertisers.

5. International transfers

Some of our processors operate outside the United Kingdom. Where data leaves the UK, we rely on the UK’s adequacy decisions or Standard Contractual Clauses with appropriate safeguards.

6. How long we keep it

We keep account data for as long as your account is active and for a reasonable period afterwards to comply with our legal obligations. Streams and photos are kept according to the plan you chose, or until you delete them. You may request deletion at any time.

7. Your rights

You can ask us to:

• access the personal data we hold about you,
• correct it if it is wrong,
• delete it (subject to legal retention obligations),
• restrict or object to processing,
• port your data to another service, and
• withdraw any consent you have given.

Send any request to hello@klivorelay.com. If you’re not happy with our response, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

8. Security

We apply technical and organisational measures appropriate to the risks: TLS in transit, encryption at rest, rate limiting, scoped API tokens, and access control on the database via row-level security.

9. Children

The Service is not directed at children under 16. If you believe a child has provided us personal data, contact us and we will delete it.

10. Changes

We may update this policy. Material changes will be highlighted on the Service or by email before they take effect.