Privacy Policy

1. Who we are and how to contact us

Kistorium is operated by Kistorium Limited (company number 9442772, NZBN 9429053797148) from New Zealand. For any privacy question, or to exercise your rights, contact us at privacy@kistorium.com. If we serve users in the EU and are required to appoint a representative, we will name them here.

2. Our roles: controller and processor

Kistorium plays two roles depending on the data:

• We are the controller for the account, billing, and website data of the people who sign up for and administer a Kist. We decide how that data is used.
• We are the processor for the content captured inside a Kist (recordings and generated guides). We handle that content on the instructions of the customer who owns the Kist, who is the controller of it. Under the New Zealand Privacy Act, we hold this content only as the customer’s service provider (section 11), so the customer, not Kistorium, tells the people who appear in it where the law requires, including under Information Privacy Principle 3A.
• We are the controller of the audit log, because we keep it after a Kist is deleted to protect the service and meet our legal duties.

This split runs through the rest of this policy. If your business needs a Data Processing Agreement, email support@kistorium.com and we will put one in place.

3. What we collect

We collect the following categories of personal information:

• Account and identity data: your name and email address, obtained when you sign in with Google or Microsoft via Firebase Authentication.
• Email data: which kinds of email from us you have said yes or no to, when and where you did; and, for each email we send you, whether it was delivered, bounced or reported as spam, and when a link in it was clicked.
• Kist and usage data: Kist membership and roles, the guides you create, and audit logs of actions in the app.
• Sign-offs: when someone confirms they have read a guide, we record their name, email address, role and the time. When a guide is approved, we record the name the approver types.
• Capture data: screen video, input events (mouse clicks, keystrokes with their timing and modifier keys, scroll-wheel movement, cursor position, and the titles of the windows you switch between), and the step images we take from the recording. The recorder does not record sound or use your microphone. Because recordings capture what is on your screen, they can incidentally include other people's personal information, credentials, or sensitive business data. When Windows identifies the field you are typing into as a password field, we replace those keystrokes with a placeholder before anything is saved. This depends on Windows identifying the field, so it does not cover every application, and it does not change what is visible on screen in the recording itself. You control what you record, and you are responsible for having the right to record it (see our Acceptable Use terms).
• Documents you add while building: PDFs, photos, Word and text files you attach when writing a guide. This content can include personal information about people other than you.
• Payment data: Stripe takes your payment. We give Stripe your name, email address and Kist, and we keep a record of which pack you bought and when. We never see or store your full card number.
• Feedback: feedback you send us is stored with your account, and is deleted when you delete your account. A copy also reaches our support inbox (see Messages to us). We only quote it on our website if you tick the box that says we may, using the name and business name you give.
• Messages to us: when you email us or use the form on our Contact page, we receive your name, email address and message in our support inbox. We use them only to reply to you, and keep them as a record of the conversation. Ask us and we will delete them. To stop spam, the form uses Cloudflare Turnstile, which checks your browser to tell a person from a robot; it does not track you across sites.
• Technical data: IP address, device and browser information, session cookies needed to keep you signed in, and, if a recording fails, a short error report from the recorder (which can include window titles).
• How you found us: when you create an account, we keep a note of where you came from: the campaign tags in the link you followed (such as utm_source), a referral link, or the name of the website that sent you, if your browser tells us. If there is none, we note “direct”. We use it only to see which of our marketing works. It is kept with your Kist and deleted with it. We do not set a separate cookie or keep anything in your browser for this. The note travels in the web address and, for the minute or so it takes to sign in, inside the security cookie that sign-in already uses. That cookie is deleted as soon as sign-in finishes.

4. Why we use it and our lawful basis

We use personal information to:

• provide and operate the service, including producing your tutorials and guides (lawful basis: performance of our contract with you);
• secure the service, prevent abuse, and keep audit records (lawful basis: our legitimate interests in running a safe service);
• take payment and manage purchases (lawful basis: performance of contract);
• count visits to our public pages (lawful basis: our legitimate interests in understanding how our website is used);
• note where a new account came from, such as a campaign link or the website that sent you (lawful basis: our legitimate interests in knowing which of our marketing works);
• send emails about your account, such as invitations, your first guide being ready and receipts (lawful basis: performance of contract);
• send getting started tips and product updates to people who made a Kist (lawful basis: our legitimate interests in helping you use the service you signed up for; you can stop them at any time);
• send offers and pack discounts, only if you said yes to them (lawful basis: your consent, which you can withdraw at any time);
• meet legal obligations, including any required retention (lawful basis: legal obligation).

The lawful-basis labels above map to the GDPR. Under the New Zealand Privacy Act, we collect personal information only for these lawful purposes connected to our service, and only what is necessary for them.

Emails we send: emails about your account always come while you have an account. Everything else you can stop: every tip, update and offer email has a link at the bottom that stops that kind, and you can turn each kind on or off in Settings. We only send offers to people who ticked yes, and we keep a record of when they did and the words they agreed to. People invited into a Kist get only account emails unless they turn more on themselves.

Resend sends our email. To see which emails help, Resend tells us when an email is delivered and when a link in it is clicked (links in our emails pass through Resend to do this). It may also tell us when an email is opened; we keep that but do not use it.

5. AI and automated processing

To turn a recording into a tutorial, we send capture data to AI sub-processors: Google Vertex AI (Gemini) to extract the steps, and ElevenLabs to generate spoken narration. The narration is synthetic (generated by software, not a recording of a real named person). ElevenLabs receives only the narration text and returns the audio. It keeps a copy in our account’s history, and we delete that copy as soon as we have saved ours. The pictures in your guides come from your own recording or from pictures you add. They are not made by AI. We also send Google Vertex AI the text and documents you provide when you write a guide, so it can read your files, draft the written guide and suggest wording, under the same Google Cloud terms that prohibit training.

Kistorium produces content; it does not make automated decisions that have a legal or similarly significant effect on you. Accordingly, the automated-decision rules in GDPR Article 22 do not apply.

6. Who we share it with

We share personal information with the sub-processors that help us run the service, listed on our Security page. Google, Cloudflare, ElevenLabs, and Resend act as our processors, on our instructions. Stripe acts largely as an independent controller for payment data under its own privacy policy. We do not sell your personal information.

Shared guides: if you open a guide someone shared with you, you do not need an account. We briefly use your IP address to stop the link being overused, and it is deleted automatically within about a day. We count how many times the guide is opened. The link keeps working until an Admin of that Kist turns it off, or until the end date they set. A link to a recording that has not been made into a finished guide yet stops working after 30 days. Anyone who has the link can open the guide, so share it only with people you trust.

7. International transfers

Kistorium and its sub-processors process data in the United States and in other locations. Where a provider only stores or processes data on our instructions, it acts as our agent, and we remain responsible for it; the protection comes from our contract with that provider. Where a cross-border transfer rule applies, we rely on safeguards such as the New Zealand Information Privacy Principle 12 comparable-safeguards contracts, the EU Standard Contractual Clauses and the EU-US Data Privacy Framework, and the UK International Data Transfer Addendum, as applicable to each provider.

For New Zealand users: some of your personal information may be stored or processed overseas, where it may not be subject to protections comparable to those in the New Zealand Privacy Act.

8. Retention

We keep recordings and the assets derived from them until you delete them or delete your Kist. We keep your account details while you use Kistorium. You can delete your account yourself in Settings (or at kistorium.com/account if you are in no Kist), or email support@kistorium.com and we will do it for you. Deleted content is removed from the live service immediately. We keep a weekly backup of our database for 12 weeks so we can recover from a disaster, so a deleted record can remain in a backup for up to 12 weeks and is then gone for good. Recordings and other stored media have no separate backup copy.

When you import a document, we read the file, keep only the text taken from it, and do not store the file itself.

We keep your email choices, and the record of the emails we sent you, while you have an account. Deleting your account deletes them.

When someone leaves a Kist or is removed from it, we keep their name and email in that Kist so its history still makes sense. It is deleted when the Kist is deleted, or sooner if they ask us.

When you delete your account, we delete your sign-in and your profile, end your access to every Kist and remove your name and email from it, and delete every Kist where you are the only person, with everything in it. Unused video guides in a deleted Kist are lost. A Kist you created that has another Admin passes to that Admin, with its guides, people and balance; if it still has the name made from yours, it takes the new owner’s instead. In Kists that carry on without you, you show in the member list as Former member, and the invitation you accepted no longer shows your email.

Your name or email can still remain in these places: your sign-offs in Kists that carry on, which keep your name and email as they were when you signed; your approvals there, which keep the name you typed; the activity history of those Kists, which can show your name and, in some older entries, your email; and the payment records Stripe keeps. These are that Kist’s record, or are kept because the law requires it.

Each sign-in gets a limited number of fresh starts. So that deleting and signing up again cannot get around that limit, we keep a scrambled code made from your sign-in (it cannot be turned back into your name or email) and the number of fresh starts it has used, for as long as Kistorium runs. If you sign up again later with the same sign-in, you start a new account, and it counts as one of those fresh starts.

Our servers keep technical logs, which include IP addresses, for 30 days.

When you invite someone, we keep their email address on the invitation so they can accept it. Once an invitation is accepted, cancelled or expires, we delete it 12 months later. Our audit log does not record the address. Audit entries for invitations sent before 2 October 2026 do include it, and are kept with the rest of the audit log below.

When you delete a Kist, we permanently remove its recordings, generated guides, and other content on the same basis. We retain a minimal, append-only audit log of actions taken in the Kist. Audit records hold IDs, dates and times, what was done, the names of the Kists, teams, categories and guides involved, and the name typed by the person who approved a guide. They do not hold the content of your recordings or guides. After a Kist is deleted, we keep the records of payments and credits for 7 years, because New Zealand tax law requires it, and delete every other audit record 12 months after the Kist was deleted.

While you record, the recorder writes the video and its input log to your own computer. These local files are deleted after the upload, and straight away if a recording fails or you cancel it. If the recorder stops unexpectedly, anything it left behind is deleted the next time it opens, once it is more than three hours old. The recorder also keeps small support log files there, and deletes any older than 14 days each time it opens.

9. Security

We protect personal information with encryption in transit and at rest, tenant isolation between Kists, and least-privilege access controls. See our Security overview for detail.

10. Your rights and how to exercise them

You can ask us to give you access to, and to correct, the personal information we hold about you (New Zealand Privacy Act, IPP 6 and 7). If the EU or UK GDPR applies to you, you also have rights to erasure, restriction, data portability, and objection, and the right to complain to a supervisory authority.

To exercise any of these, email privacy@kistorium.com. We will respond within 20 working days under the New Zealand Privacy Act, and within one month where the GDPR applies.

If you are not happy with how we handled your request, you can complain to the New Zealand Privacy Commissioner (privacy.org.nz). You can reach our privacy officer at privacy@kistorium.com.

11. Children

Kistorium is a business tool and is not directed to children. Accounts are only for people aged 18 and over. Anyone may view a guide that an account holder shares with them, without an account. We do not knowingly collect personal information from anyone under 18, and we will delete such information if we discover it.

12. Cookies and local storage

We use cookies and browser local storage that are strictly necessary to run the service, principally to keep you signed in (Firebase Authentication session state), plus a few remembered settings such as video playback speed. Strictly-necessary cookies do not require consent. We do not run third-party advertising or cross-site tracking, so we do not show a cookie consent banner. You can control or clear cookies through your browser settings, though doing so may stop you from staying signed in.

On our public pages (not inside the app) we count page visits with Cloudflare Web Analytics. Your browser sends Cloudflare the page address, the page you came from, your IP address and browser details. It uses no cookies and does not track you across sites.

When you sign in, a short-lived security cookie protects the sign-in from forgery. It lasts at most ten minutes and is deleted when sign-in finishes. For that minute it also carries the note of where you came from (see “How you found us” above), which we keep only if the sign-in creates your account.

13. Breach notification

If a privacy breach is likely to cause serious harm, we will notify the affected individuals and the New Zealand Privacy Commissioner as soon as practicable, in line with the Privacy Act 2020 notifiable-breach scheme, and will meet the equivalent obligations under the GDPR and other laws where they apply.

14. Region-specific disclosures

As we enter new markets we will add the disclosures those markets require, including a California section (CCPA/CPRA), an Australia section (Australian Privacy Principles), and a Canada section (PIPEDA). California residents: we do not sell or share your personal information as those terms are defined under the CCPA/CPRA. These region-specific terms are pending and will be finalised before we actively serve those markets.

15. Changes to this policy

We may update this policy from time to time. We will change the “Last updated” date above and, for material changes, take reasonable steps to let you know. Your continued use of Kistorium after a change means you accept the updated policy.