Privacy Policy

If you are a Shopper, the store you bought from decides why and how your data is used. Their privacy policy, shown on their store, governs that relationship. We process your data on their instructions, as described in Section 6. For requests about your data at a specific store, contact that store first; we will help them respond.

From Visitors

• Contact details you give us (name, email, company, message) when you fill a form, subscribe to a newsletter, or chat with support.
• Technical data collected automatically: IP address, device and browser type, pages viewed, referring site, approximate location derived from IP, and cookie identifiers (see Section 10).

From Sellers

• Account data: name, email, phone, password (hashed), language, time zone, profile photo.
• Business data: store name, legal business name, business address, trade licence or registration number, tax/VAT number, website, industry, and the legal and policy pages you publish.
• Billing data: plan, invoices, billing address, VAT status, and the last four digits and expiry of your payment card. Full card details are collected and stored by our payment processor, never by us.
• Usage data: actions in the dashboard, features used, support tickets, login history, IP addresses and devices used to sign in, API keys and webhook endpoints you create.
• Communications: emails, chat messages, and calls with our support team (calls may be recorded with notice).
• Staff data: name, email, role and activity of any team members you invite.

From Shoppers (processed on behalf of Sellers)

• Identity and contact details: name, email, phone, shipping and billing addresses.
• Order data: products bought, amounts, currency, discounts, payment method type (for example "card" or "cash on delivery"), shipping choice, tracking numbers, returns and refunds.
• Account data if the Shopper creates an account: login credentials (hashed), wishlist, saved addresses, reviews, loyalty balance.
• Marketing data: consent records for email, SMS and WhatsApp, and engagement with messages (delivered, opened, clicked).
• Behavioural data: pages viewed, products viewed, cart contents including abandoned carts, search terms.
• Technical data: IP address, device, browser, cookie identifiers.

We do not collect payment card numbers, CVV codes, or bank details from Shoppers. These are entered into payment forms hosted by the Seller’s payment provider.

From third parties

• Payment providers send us transaction status and, for Sellers, the results of their identity checks.
• Couriers send us shipment status.
• Sign-in providers (for example Google or Apple) send us your name and email if you choose to sign in with them.
• Publicly available business registers, where we verify a Seller's licence.

We do not sell personal data. We do not use Shopper data to advertise to Shoppers, to build cross-store profiles, or for any purpose other than serving the store they interacted with.

We use automated systems to flag fraud, spam, phishing and prohibited goods, and to enforce plan limits. Where an automated decision would significantly affect you (for example suspending a store), a person reviews it before or promptly after it takes effect, and you can ask us to reconsider by contacting privacy@kartlo.app.

We share data only as needed to run the service:

• Sub-processors: hosting and infrastructure, database and backup, content delivery, email delivery, SMS and WhatsApp messaging, payment processing, customer-support tooling, analytics and error monitoring. The current list, with locations, is available on request from legal@kartlo.app. We notify Sellers at least 30 days before adding a sub-processor that will handle Shopper data.
• Payment providers the Seller connects (for example Stripe). They are independent controllers of the payment data they collect.
• Couriers and shipping aggregators the Seller uses, who receive the name, address and phone needed to deliver.
• Sellers receive the Shopper data collected through their own store.
• Professional advisers (lawyers, accountants, auditors, insurers) under confidentiality.
• Authorities where the law requires it or to protect rights, safety or property.
• A buyer or successor if Kartlo is sold or merges, in which case this policy continues to apply and we will notify you.

When a Seller uses Kartlo to collect Shopper data, we act as processor under our Data Processing Agreement (available on request from legal@kartlo.app), which forms part of the Seller Terms. In summary, we:

• process Shopper data only on the Seller's documented instructions and for providing the service;
• keep it confidential and apply the security measures in Section 8;
• use only sub-processors bound by equivalent obligations;
• help the Seller respond to Shopper rights requests, breach notifications and impact assessments;
• delete or return Shopper data when the Seller's account ends, subject to Section 9;
• never use Shopper data for our own marketing or to build profiles across stores.

Sellers are responsible for having a lawful basis to collect Shopper data, publishing an accurate privacy policy on their store, obtaining consent for marketing, and honouring Shopper requests. Kartlo provides tools for consent capture, export and deletion to support this.

At checkout, or on a store's account page, a Shopper can choose to save their details in a Kartlo shopper account. It works at every store on Kartlo, so the Shopper does not need a new code or to type their details again at each store. It is optional: you can always check out as a guest.

• What we keep: your mobile number and the fact that you confirmed it with a code, your name, an email if you add one, your saved addresses, and the date you agreed to this.
• Why: to sign you in with your phone, fill in checkout for you, and show you your orders from every store on Kartlo in one place. Our legal basis is your consent, which you give by ticking the box.
• Orders: your account shows the orders you placed at stores on Kartlo with this phone, email or account. Each store still controls its own order and customer records (Section 6); a store never sees your orders at other stores.
• Verified phone: when you place an order with a confirmed phone, the store sees that the phone was verified. It does not see any other detail of your Kartlo account.
• Remembering your device: a cookie on your device remembers a confirmed phone for up to 90 days for that store, and your sign-in keeps you signed in on that device.
• Your choices: you can edit your details, remove addresses, sign out, or delete your Kartlo shopper account at any time from your account page or by writing to us. Deleting it does not delete the orders each store keeps under its own policy.

Before a Seller’s Store located in, or selling to, the United Arab Emirates can go live, we verify the business behind it. This section explains what that involves.

• What we collect: business documents (trade licence, freelance permit or e-Trader licence, and where applicable the memorandum of association, VAT registration certificate and Corporate Tax registration certificate); the front and back of the Emirates ID, or the passport, of the authorised signatory; a selfie of the signatory holding their ID; and the names, roles and contact details of the authorised signatory and the owners of the business, together with the details typed into the verification form.
• Why: to confirm that the Seller is a real, licensed business and that the person acting for it is who they say they are; to meet our obligations under UAE law, including the e-commerce law; to show the verified licence number on the Store; and to prevent fraud, impersonation and misuse of the platform.
• Legal basis: performance of our contract with the Seller, and compliance with our legal obligations under UAE law, including Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and the UAE e-commerce law.
• Where it is stored: the uploaded documents and images, and the details typed into the verification form about people and the business (names, date of birth, Emirates ID and passport numbers, nationality, addresses, email addresses, phone numbers and tax registration numbers), are stored only in the United Arab Emirates, on Microsoft Azure UAE North, with a backup copy in Azure UAE Central. The typed details are encrypted. Our main database in Singapore keeps only the business’s legal and trade name, trade licence number and issuing authority (which are shown on the Store), expiry dates and the progress of the review (see Section 7).
• Who can see it: only Kartlo staff who carry out verification. They open documents through short-lived links that expire within minutes. Documents are never shown on the Store or to Shoppers; only the verified licence number appears in the Store footer.
• How long we keep it: while the Seller’s account is active and for five years after the Store is closed, after which the documents and details are deleted. Expired documents that have been replaced are deleted on the same basis.
• Your rights: the signatory, owners and the Seller can ask to see, correct or update this data at any time (see Section 12). Because verification is a legal requirement for selling in the UAE, deleting it while the Store is active will pause the Store.

Every Store on Kartlo shows a “Report this store” link. Anyone can use it to tell us about suspected fraud, prohibited goods, misleading information or other problems with a Store.

• What a reporter gives us: the reason for the report (for example an unlicensed seller, counterfeit or illegal goods, or a scam), an optional description, and optionally their email so we can follow up. We record which Store was reported and when. We use the reporter’s IP address briefly to limit abuse of the reporting channel; it is not stored with the report.
• Why: to investigate the report, protect Shoppers, enforce our Terms, and cooperate with competent authorities where the law requires it. Our legal basis is our legitimate interest in keeping the platform safe and, where applicable, legal obligation.
• Who sees it: Kartlo staff who handle reports. We do not give the Seller the reporter’s email unless the reporter agrees or the law requires it.
• How long we keep it: for as long as needed to deal with the report and any follow-up action, and then for up to 3 years as a record, or longer where the law or an investigation requires.

Kartlo’s primary data hosting is on AWS ap-southeast-1 (Singapore) through our infrastructure providers. Business verification documents and the personal and business details typed into the verification form are the exception: they are stored only in the United Arab Emirates (Section 6B). Some sub-processors operate in other countries, including the European Economic Area, the United Kingdom and the United States.

Where personal data leaves the UAE, the EEA or the UK, we rely on: transfers to countries recognised as providing adequate protection; the Standard Contractual Clauses of the European Commission and the UK Addendum; the EU–US Data Privacy Framework where the recipient is certified; and any mechanism approved under the UAE Personal Data Protection Law. Copies of the safeguards are available on request.

Sellers selling to residents of countries with data-localisation rules (for example Saudi Arabia) are responsible for confirming that the region Kartlo offers meets their obligations.

We protect data with measures including encryption in transit (TLS) and at rest, tenant isolation so that each store’s data is logically separated and access-controlled, multi-factor authentication for Kartlo staff and offered to Sellers, role-based access, logging and monitoring, regular backups, vulnerability scanning, and staff training. Payment card data is handled by PCI DSS–compliant providers; Kartlo does not store card numbers.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify the relevant authority and affected Sellers without undue delay and, where required, within 72 hours of becoming aware, and support Sellers in notifying their Shoppers.

Report security issues to security@kartlo.app.

Before deleting a closed store, we give the Seller the ability to export products, customers and orders.

On kartlo.app and the Seller dashboard we use:

• Essential cookies for sign-in, security, load balancing and remembering your language. These cannot be switched off.
• Analytics cookies to understand how the site and product are used. Set only with your consent where the law requires it.
• Marketing cookies to measure our own advertising. Set only with your consent.

You can change your choices at any time through your browser settings. A full list of cookies is available on request from privacy@kartlo.app.

Stores built on Kartlo set cookies needed to run the store (cart, session, language, currency). Sellers control any analytics or marketing pixels added to their store and must obtain consent through the cookie banner Kartlo provides.

We send Sellers product news and offers by email only where permitted, and every message includes an unsubscribe link. Unsubscribing does not stop essential service messages (billing, security, changes to terms).

Marketing sent by Sellers to Shoppers through Kartlo (email, SMS, WhatsApp) requires the Seller to hold the Shopper’s consent. Every such message includes an opt-out. If you opt out of a store’s messages, we record it and block further marketing from that store through our platform.

Depending on where you live, you may have the right to: access your personal data; correct it; delete it; restrict or object to processing; receive a copy in a portable format; withdraw consent; not be subject to solely automated decisions with legal or similar effects; and complain to a supervisory authority.

Visitors and Sellers: email privacy@kartlo.app or use the account settings page, where Sellers can update details, export their data, and delete their account. We respond within 30 days (or the period the applicable law requires) and may ask you to verify your identity.

Shoppers: contact the store you shopped with; its contact details are in its footer. If you cannot reach them or they do not respond, email us and we will assist. Shoppers with an account at a store can view, correct, export or delete their data from their account page.

Residents of the EEA/UK may complain to their national data protection authority. UAE residents may contact the UAE Data Office. California residents have rights under the CCPA/CPRA, including to know, delete, correct and opt out of “sale” or “sharing” (we do neither) without discrimination.

Kartlo is not directed at anyone under 18. Sellers must be 18 or older to hold an account. We do not knowingly collect data from children; if you believe a child has provided data to us or to a store on Kartlo, contact privacy@kartlo.app and we will delete it. Sellers selling age-restricted goods are responsible for age verification.

Stores on Kartlo and our own site may link to third-party sites and services (payment providers, couriers, social networks). Their privacy practices are their own; read their policies.

We may update this policy. We will post the new version here with a new “last updated” date and, for material changes, notify Sellers by email or in the dashboard at least 30 days before they take effect. Continued use after that date means you accept the updated policy.

Data protection contact: Louward Labs FZC LLC privacy team
Email: privacy@kartlo.app
Controller and operator: Louward Labs FZC LLC, licence and registration number 2621919703888, Ajman NuVentures Centre Free Zone, BC-893658, 26th Floor, Amber Gem Tower, Ajman, United Arab Emirates