Privacy Policy

Last updated: August 6, 2026 · Effective: August 6, 2026

Kalaiko is currently in private, invitation-only beta. This notice describes what the product actually does today and is accurate as of the date above. It is under review by legal counsel and some parts are still under review. We will publish the completed version, with notice to sellers, before Kalaiko becomes generally available.

1. Who this policy is for

Kalaiko ("Kalaiko", "we", "us") provides a platform where small business owners build an online store and take orders. Two different groups of people give us personal data, and they have different relationships with us:

• Sellers — people who create an account and run a store.
• Buyers — people who order, book, enquire, enrol or leave a review through a seller's storefront.

Buyers do not have a Kalaiko account and generally interact with the seller, not with us.

Where a section applies to only one group, it says so.

2. Kalaiko is in private beta

• Kalaiko is currently a private, invitation-only beta. Stores are live and public, but the

platform is not generally available.

• Payments are disabled. No seller can accept card payments during the beta, no payment is

processed, and no card details are collected by anyone. Stores display an "Enquire" option instead of checkout.

• Beta stores are free. Beta store retention is described in §8.

3. What we collect

3.1 From sellers

3.2 From buyers

Collected by the seller through their storefront, stored by us on their behalf:

We do not collect or store buyers' payment card details. During the beta no payments occur at all. When payments are enabled, card details are entered on the payment provider's own hosted page and never reach Kalaiko's servers.

3.3 Children's data — read this section

Kalaiko collects a limited amount of data about children, because a parent can enrol a child in a class through a seller's storefront. We are explicit about this rather than claiming otherwise.

When a parent enrols a child, we may collect:

• the child's first name — optional, and
• an age range — optional, chosen from broad bands (5–7, 8–10, 11–13, 14+).

Both fields are optional and an enrolment completes with neither provided. We do not collect a child's exact age, surname, date of birth, address, contact details, photograph, or any other identifier. We reduced this deliberately: an exact age field was removed from our systems entirely so it can no longer be stored.

The data is provided by the parent or guardian making the enrolment, is visible only to the seller running the class and to us as the platform, and is never sent to any AI provider (§5).

3.4 Collected automatically

• IP address, browser and device characteristics, and request logs — via our hosting provider.
• A persistent visitor identifier and a session identifier, stored in your browser, used to

count visits and understand where people drop out of a flow. These are pseudonymous: they are not linked to your name or email, but they persist across visits and are treated as personal data.

• Product analytics events — see §6.

4. Who we share it with

We use the following providers. Each receives only what its function requires.

We do not sell personal data. We do not use third-party advertising networks and we run no third-party advertising or cross-site tracking scripts.

5. Artificial intelligence — what is and is not sent

Kalaiko uses AI to help sellers write listings, generate store copy and edit product photos.

What is sent to AI providers:

• Anthropic receives seller-provided business content — store name, business description, category

names, product names, product descriptions, prices — and the seller's own chat messages.

• fal.ai and remove.bg receive product images uploaded by the seller.

What is never sent:

Buyer personal data is never transmitted to any AI provider. Buyer names, email addresses, phone numbers, postal addresses, order contents, enquiry messages, enrolment details, children's data, and images uploaded by buyers are never included in prompts sent to Anthropic, nor in images sent to fal.ai or remove.bg.

6. Analytics

We run first-party analytics only — no third-party analytics SDK, no advertising pixels.

We record product events such as which onboarding step was viewed or completed, and storefront events such as a page or product view. Events carry a pseudonymous visitor or session identifier and, for signed-in sellers, an account identifier.

Event details are stripped of personal data automatically before storage. Any field whose name suggests an email address, password, token, card number, phone number or postal address is discarded at the point of writing, and event details are size-capped. This is enforced in code, not by convention.

7. Cookies and browser storage

We use no advertising or cross-site tracking cookies. What we set:

Browser storage can be cleared through your browser settings. Clearing the authentication cookie signs a seller out; clearing cart storage empties a cart.

8. How long we keep it

During the beta, no store is deleted automatically.

If a seller deletes their store, we remove the store and its content — products, classes, sessions, enrolments, waitlist entries, FAQs, testimonials, gallery images, events and categories.

We want to be precise about a limitation: deleting a store does not by itself delete the seller's account, their onboarding answers, or their stored chat transcripts. Those are tied to the account rather than the store and survive store deletion. A request to delete an account covers them.

Deletion on request is a manual process. A seller or a buyer may request deletion of their personal data by emailing support@kalaiko.com. We will action it within 30 days of the request. We state this as manual deliberately: we have not built an automated self-service deletion tool, and we would rather describe the process we actually operate than one we do not.

Beta stores. A tester's store is theirs. During the beta it stays live and free, and nothing is deleted automatically. At launch a tester may continue on founding-member terms. A tester who chooses not to continue receives 30 days' written notice. After that the store is deactivated — taken offline and unavailable to buyers — and is deleted once a further grace period elapses. We do not delete a store without notice first.

Content export. At any point, a seller may request a full export of their own content — their store details, categories, products, services and classes, FAQs, testimonials, gallery images, events and custom pages — by emailing support@kalaiko.com. This is a manual process operated by us.

The export deliberately excludes buyer data. It contains the seller's own content only. Orders, enquiries, enrolments, appointments, reviews, tips and custom-order requests are not included, and no child's name or age range can appear in an export. A seller's export is not a route to extract other people's personal data, and is built so that data cannot appear in it.

Backups and logs may retain data for a limited period after deletion, and we may retain records where we are legally required to.

9. Your rights

Depending on where you live you may have rights to access, correct, delete, restrict or object to our use of your personal data, to receive a copy in a portable form, and to withdraw consent.

To exercise any of these, email support@kalaiko.com. We will respond within 30 days. All such requests are handled manually.

If you are a buyer: your data was given to a seller through their storefront. You may contact us at the address above, and we will act on your request or pass it to the seller as appropriate.

10. Security

Data is stored with access controls that restrict each seller to their own store's data, enforced at the database level. Traffic is encrypted in transit. Passwords are hashed by our authentication provider and are not visible to us.

No system is perfectly secure, and we cannot guarantee that unauthorised access will never occur.

11. International transfers

Our providers operate in the United States and elsewhere. Using Kalaiko involves transferring your data internationally.

12. Changes

We may update this policy. If we make a material change we will update the date above and, where appropriate, notify sellers directly.

13. Contact

support@kalaiko.com

Operating entity. A registered operating entity for Kalaiko is being formed. This policy will be reissued under that entity, with notice to sellers, once it exists. Until then, contact us at the address above.