Privacy Policy

1. Introduction

Karted ("Karted", "we", "our", or "us") is a business-to-business (B2B) commerce platform designed to connect wholesalers, retailers, and other business users through a unified commerce ecosystem.

Karted provides business tools and services that may include ordering, inventory management, customer-specific pricing, marketplace purchasing and bidding, order tracking, claims, credit notes, payment tracking, Instant Pay and other payment functionality, chatbot and support features, business reporting, and integrations with third-party services.

This Privacy Policy explains how Karted collects, uses, stores, protects, and shares information when you use the Karted application and related services.

By using Karted, you acknowledge the practices described in this Privacy Policy.

2. Information We Collect

Karted collects information that is reasonably necessary to provide and operate its B2B commerce and business management services.

Depending on how you use Karted, we may collect the following categories of information.

Account Information

• Name or username.
• Email address.
• Phone number, where provided.
• Password or authentication information.
• Account credentials and account settings.
• Information required to manage your Karted account.

Business Information

Business users may provide information necessary to operate their business account, including:

• Business or company name.
• Business address.
• Business contact information.
• Company or account identifiers.
• Business registration or commercial information where required.
• Information about business locations.
• Information about employees, salespersons, customers, retailers, wholesalers, suppliers, or other business contacts entered by an authorized business user.
• Business configuration and account preferences.

Orders and Commerce Information

To provide B2B commerce functionality, Karted may collect and process information relating to:

• Products and product details.
• Orders and order history.
• Order quantities.
• Quotations and pricing information.
• Customer-specific pricing.
• Wholesale and retail pricing.
• Discounts and promotions.
• Inventory and stock availability.
• Order status and fulfillment information.
• Delivery and order tracking information.
• Claims and claim-related information.
• Credit notes and adjustments.
• Payment status and outstanding balances.
• Business transaction records.

Marketplace Information

Where marketplace functionality is available, Karted may process information related to buying requests and business bids, including:

• Products requested by businesses.
• Requested quantities.
• Business purchasing requirements.
• Supplier or wholesaler bids.
• Bid prices and related commercial information.
• Order and transaction information resulting from marketplace activity.

Financial and Transaction Information

Karted may process limited financial and transaction information required to provide commerce and payment-related functionality.

• Transaction amounts.
• Currency.
• Payment status.
• Payment or transaction identifiers.
• Outstanding payment information.
• Refund or adjustment status.
• Credit note information.
• Payment reconciliation information.

Chatbot and Support Conversation Information

Karted provides a chatbot feature that allows users to communicate with Karted through messages or questions. When you use the chatbot, the messages and information you choose to provide may be sent to Karted's backend services through our application programming interface (API) so that we can process your request and return a response.

Depending on the nature of your request and the information you provide, chatbot conversations may contain business, account, order, product, support, or other information included in your message. Please do not submit passwords, payment card numbers, CVV/security codes, or other highly sensitive information through the chatbot unless specifically requested and supported by Karted.

Chatbot messages and related technical information may be logged or retained by our backend systems as reasonably necessary to operate the chatbot, provide support, maintain security, troubleshoot problems, and comply with applicable legal requirements.

Karted's chatbot is supported by Karted's backend services and may use the Grok API provided by xAI to generate responses. The Android application does not connect directly to the Grok API. Chatbot requests are sent to Karted's backend, which may send limited information to the Grok API to generate the requested response.

For chatbot processing, the information sent from Karted's backend to Grok may include a user ID, company ID, user role, the user's chatbot question, and relevant business information needed to answer the request, such as sales summaries, order information, inventory information, or other business data available to the authorized user. Karted does not intentionally send passwords, payment card numbers, CVV/security codes, or similar highly sensitive authentication or payment information to Grok through the chatbot.

Grok is used to process the information provided by Karted's backend and generate a response. Grok does not have permission through the chatbot to modify Karted's database or independently perform transactions. The generated response is returned to Karted's backend and then provided to the user through the application.

Information transmitted to xAI through the Grok API may be subject to xAI's applicable API data-retention and security practices. xAI currently states that, by default, API requests and responses are stored on its servers for 30 days for abuse or misuse auditing and are not used to train its models without the customer's explicit permission. Where Zero Data Retention (ZDR) is enabled for the applicable xAI team, xAI states that API prompts and outputs are not persisted. Karted will use the applicable xAI configuration and terms for the chatbot service.

Karted's primary application and business data remains managed by Karted's backend infrastructure. However, information specifically transmitted to Grok for chatbot processing is processed by xAI as described above. Users should avoid entering passwords, payment card numbers, CVV/security codes, or other highly sensitive information into the chatbot.

Device and Technical Information

Depending on the technologies used by the application, Karted may automatically receive certain technical information, including:

• Device type.
• Operating system and version.
• Application version.
• IP address.
• Device identifiers or similar technical identifiers.
• Log information.
• Crash and diagnostic information.
• Application performance information.

3. Information We Do Not Directly Collect

Karted does not intentionally collect or access information that is not required for the functionality of the application.

Karted does not intentionally access:

• Contacts stored on your device.
• SMS messages.
• Call logs.
• Microphone recordings.
• Personal files or media stored on your device.
• Precise location information unless a future feature specifically requires it and appropriate disclosure is provided.

4. How We Use Your Information

Karted may use collected information to:

• Create and manage user accounts.
• Authenticate users and secure accounts.
• Provide B2B commerce services.
• Connect wholesalers and retailers.
• Manage products and inventory.
• Support customer-specific pricing.
• Manage quotations and orders.
• Support marketplace buying requests and supplier bids.
• Track order fulfillment and delivery status.
• Manage claims and credit notes.
• Track payment status and outstanding balances.
• Support payment reconciliation and Instant Pay transactions.
• Process and confirm payments through authorized payment providers.
• Operate and provide the Karted chatbot and related support features.
• Process chatbot messages and return responses to users.
• Monitor, troubleshoot, secure, and improve chatbot and API functionality.
• Provide business dashboards and reporting features.
• Provide customer and supplier management functionality.
• Provide customer support.
• Detect and prevent fraud, abuse, and unauthorized activity.
• Maintain and improve application performance.
• Diagnose technical problems and application crashes.
• Protect the security and integrity of Karted services.
• Comply with applicable legal and regulatory requirements.

Karted does not sell users' personal information.

5. Payment Information

Karted may use third-party payment service providers, including Stripe and other applicable payment providers, to facilitate payments and business transactions.

Where Stripe or another payment provider processes a transaction, including an Instant Pay transaction, payment information may be collected and processed directly by that provider according to its own privacy policy, terms, and security practices.

For Instant Pay, Karted may receive payment and transaction confirmation information from the payment provider so that Karted can update order status, payment status, receipts, refunds, and related business records.

Depending on the payment integration, Karted may receive limited payment-related information required to manage a transaction, including:

• Payment status.
• Transaction or payment identifier.
• Payment amount.
• Currency.
• Payment method type.
• Refund status.
• Payment reconciliation information.

Third-party payment providers may independently collect and process sensitive payment information necessary to complete and secure transactions.

Users should review the privacy policies and terms of the applicable payment provider when making a payment.

6. Square and POS Integrations

Karted may integrate with third-party point-of-sale (POS) systems, including Square, to support commerce and business operations.

Where a POS integration is used, certain information may be exchanged between Karted and the applicable third-party POS provider as necessary to provide the requested integration.

Karted does not operate or control the third-party POS provider's systems, payment processing, or independent data practices.

Information processed by Square or another POS provider is subject to that provider's own privacy policy, terms, and security practices.

7. Data Sharing

Karted does not sell users' personal information.

We may share or disclose information where reasonably necessary to:

• Provide requested Karted services.
• Connect businesses and facilitate B2B commerce.
• Process payments through third-party payment providers, including Stripe where applicable.
• Support Instant Pay transactions and payment confirmation.
• Process chatbot requests through Karted's backend infrastructure.
• Use the Grok API provided by xAI to process limited chatbot context and generate responses where applicable.
• Transmit limited chatbot-related identifiers, including user ID, company ID, and user role, together with the relevant user question and business context needed to generate a response.
• Support POS and other authorized third-party integrations.
• Operate our application and infrastructure.
• Provide customer support.
• Prevent fraud, abuse, or security incidents.
• Maintain transaction and business records.
• Comply with applicable laws and legal processes.
• Protect the rights, property, and safety of Karted, our users, or others.

Where third-party service providers process information on our behalf, they are expected to use the information only for the services they provide and in accordance with applicable agreements and laws.

8. Business and Marketplace Information

Karted is designed to facilitate interactions between businesses. Certain business information may therefore be visible to other authorized business users when necessary to provide the requested service.

For example, depending on the applicable feature, authorized users may be able to view information relating to:

• Business name.
• Products and product availability.
• Business pricing.
• Buying requests.
• Supplier bids.
• Order status.
• Delivery status.
• Transaction-related information.

Users should not enter information into Karted that they are not authorized to share with the relevant business or service provider.

9. Data Security

We use reasonable technical and organizational security measures designed to protect information against unauthorized access, alteration, disclosure, loss, or destruction.

Payment information handled by third-party payment providers is subject to the security measures maintained by those providers.

However, no electronic storage system, application, or method of transmission over the internet can be guaranteed to be completely secure.

10. Data Retention

Karted may retain information for as long as reasonably necessary to:

• Provide Karted services.
• Maintain business and transaction records.
• Maintain order and payment history.
• Fulfill contractual or business requirements.
• Resolve disputes and claims.
• Prevent fraud and abuse.
• Maintain security.
• Comply with legal, tax, accounting, or regulatory obligations.
• Retain chatbot messages or related technical logs for as long as reasonably necessary to operate, secure, troubleshoot, and support the chatbot service, subject to applicable requirements.

When information is no longer required, Karted may delete, anonymize, or securely dispose of it, subject to applicable legal and legitimate business requirements.

Information sent to third-party AI providers for chatbot processing may be subject to the provider's own retention practices. For the Grok API, xAI currently states that API requests and responses are stored for 30 days by default for abuse or misuse auditing and are automatically deleted after that period. If Zero Data Retention (ZDR) is enabled for the applicable xAI team, xAI states that API prompts and outputs are not persisted. The applicable retention period may therefore depend on the xAI configuration used by Karted.

11. Account Deletion

Karted provides users with the ability to request deletion of their account and associated personal information.

Users can initiate account deletion from within the Karted application:

• Open the Karted application.
• Go to the Manage or applicable account section.
• Select "Delete Account".
• Confirm the deletion request.

Users may also request account deletion by contacting Karted through the designated support email address provided on this page. Account deletion requests submitted by email may be subject to verification before processing.

Certain information may be retained where required for legal, tax, accounting, fraud prevention, security, dispute resolution, or other legitimate business purposes. Any retained information will be kept only for the period necessary to satisfy the applicable requirement and will then be securely deleted or anonymized, as applicable.

Deleting an account may result in permanent loss of access to orders, transaction history, business records, claims, credit notes, and other services associated with the account.

12. Third-Party Services

Karted may use third-party service providers to operate and support its services.

These services may include:

• Stripe for payment processing, including Instant Pay transactions, where applicable.
• Square for POS-related integrations where applicable.
• Karted's backend/API infrastructure for processing application requests and chatbot messages.
• xAI / Grok API for processing limited chatbot context and generating chatbot responses. Information sent to Grok may include user ID, company ID, user role, the user's chatbot question, and relevant business information needed to answer the request.
• Cloud hosting and infrastructure providers.
• Authentication and security services.
• Analytics or crash-reporting services, where applicable.
• Other technical service providers required to operate Karted.

Third-party providers may process information on our behalf or independently according to their own terms and privacy policies. In particular, when the Grok API is used, xAI processes the information transmitted by Karted's backend to generate the chatbot response. Users should review the applicable xAI privacy and API terms for additional information about its processing practices.

13. Children's Privacy

Karted is primarily designed for business and commercial users and is not directed toward children.

We do not knowingly collect personal information from children where such collection is prohibited by applicable law.

If we become aware that we have collected personal information from a child in circumstances where it should not have been collected, we will take reasonable steps to delete the information.

14. Your Privacy Rights

Depending on your location and applicable law, you may have rights regarding your personal information, including the right to:

• Request access to your personal information.
• Request correction of inaccurate information.
• Request deletion of certain personal information.
• Request information about how your information is used or shared.
• Exercise other privacy rights provided by applicable law.

Privacy requests may be submitted using the contact information provided below.

We may need to verify your identity before completing certain privacy requests.

15. International Data Processing

Depending on the services and third-party providers used by Karted, including the Grok API provided by xAI, information may be processed or stored in countries other than the country where you are located.

Where required by applicable law, we will take reasonable measures to provide appropriate protections for information transferred across jurisdictions.

16. Current Features and Future Services

Karted may introduce additional services, integrations, or features in the future.

If a new feature requires the collection, use, or sharing of additional categories of personal information, Karted may update this Privacy Policy and provide additional disclosures where required by applicable law. Current features may include chatbot/API processing and Instant Pay payment processing as described in this Privacy Policy.

Features that are not currently available are not intended to be represented as current data collection or processing practices under this Privacy Policy.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our application, services, third-party integrations, legal requirements, or privacy practices.

When we make changes, we will update the Last Updated date at the beginning of this Privacy Policy.

Users are encouraged to review this Privacy Policy periodically.