Privacy Policy

1. Information We Collect

1.1 Account Information

When you create an account, we collect your full name, email address, phone number (optional), and a hashed password. If you sign up via Google or Facebook, we receive your name and email from those providers.

1.2 Order Information

When you place an order, we collect your billing address and order details. Payment information is processed securely by our global payment partners (Stripe, PayPal) — we never store your full credit card number.

1.3 Vendor Information

For vendor applications, we collect business registration details, identity verification, portfolio links, and bank account information for payouts. These documents are stored securely and only accessible to our verification team.

1.4 Automatically Collected Information

We automatically collect your IP address, browser type, device information, pages visited, and referring URLs. This helps us improve our platform and detect fraud.

2. How We Use Information

• To process and fulfill your orders
• To communicate with you about orders, products, and promotions
• To verify vendor identities and maintain marketplace quality
• To improve our platform through analytics and user research
• To comply with legal obligations and enforce our Terms of Service
• To prevent fraud, abuse, and security incidents

3. Information Sharing

We share your information only in these limited circumstances:

• With vendors: When you place an order, the vendor receives your email address to fulfill digital delivery if required.
• With payment processors: Stripe and PayPal process your payments.
• With service providers: Cloud hosting (AWS), email delivery (SendGrid), analytics (Google Analytics).
• Legal compliance: If required by law, court order, or to protect our rights and safety.

4. Cookies & Tracking

We use essential cookies to keep you logged in and remember your cart. We also use analytics cookies (Google Analytics) and marketing pixels (Facebook Pixel) with your consent. See our Cookie Policy for details.

5. Data Retention

We retain your personal data as long as your account is active. Inactive accounts are retained for 24 months before anonymization. Order records are retained for 7 years for tax compliance. Vendor verification documents are retained for the duration of the vendor relationship plus 5 years.

6. Your Rights (GDPR Compliant)

Under applicable data protection laws, you have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your data ("right to be forgotten")
• Restrict or object to processing
• Data portability (receive your data in a machine-readable format)
• Withdraw consent at any time
• Lodge a complaint with a supervisory authority

To exercise these rights, email [email protected].

7. Security

We implement industry-standard security measures including SSL/TLS encryption for all data transmission, encrypted data storage, access controls, and regular security audits. However, no method of electronic storage is 100% secure.

8. Children's Privacy

Kandyam is not intended for children under 13. We do not knowingly collect data from children under 13. If you believe a child has provided us with personal data, please contact us immediately.

9. International Transfers

Your data is stored on servers in global cloud regions. If you're accessing Kandyam from outside these regions, your data may be transferred across borders. We ensure appropriate safeguards (Standard Contractual Clauses) are in place for international transfers.

10. Changes to This Policy

We may update this policy from time to time. We'll notify you of material changes via email or a notice on our website. Continued use after changes constitutes acceptance.

11. Contact Us

Kandyam Inc.
Email: [email protected]