Privacy Policy

Effective: August 24, 2026 · Last updated: August 24, 2026

Entity: Prettli Inc., DBA Kastkart — Delaware corporation Effective date: August 24, 2026 Last updated: August 24, 2026 Contact: privacy@kastkart.com

Scope: This policy applies to kastkart.com (marketing website), the Kastkart Shopper App (iOS and Android), and the Kastkart Seller Dashboard (portal.kastkart.com), all products of Prettli Inc., operating under the trade name Kastkart.

Your privacy is important to us. It is Prettli Inc., DBA Kastkart’s policy to respect your privacy and comply with any applicable law and regulation regarding any personal information we may collect about you, including across our website, https://kastkart.com, the Kastkart Shopper App (iOS and Android), the Kastkart Seller Dashboard (portal.kastkart.com), and other sites we own and operate.

Personal information is any information about you which can be used to identify you. This includes information about you as a person (such as name, address, and date of birth), your devices, payment details, and even information about how you use a website or online service.

In the event our platform contains links to third-party sites and services, please be aware that those sites and services have their own privacy policies. After following a link to any third-party content, you should read their posted privacy policy information about how they collect and use personal information. This Privacy Policy does not apply to any of your activities after you leave our platform.

This policy is effective as of August 24, 2026. Last updated: August 24, 2026.

Information We Collect

Information we collect falls into one of two categories: “voluntarily provided” information and “automatically collected” information.

“Voluntarily provided” information refers to any information you knowingly and actively provide us when using or participating in any of our services and promotions.

“Automatically collected” information refers to any information automatically sent by your devices in the course of accessing our products and services.

Log Data

When you visit our website or use our platform, our servers may automatically log the standard data provided by your web browser or mobile application. It may include your device’s Internet Protocol (IP) address, your browser type and version, the pages you visit, the time and date of your visit, the time spent on each page, and other details about your visit.

Additionally, if you encounter certain errors while using the platform, we may automatically collect data about the error and the circumstances surrounding its occurrence. This data may include technical details about your device, what you were trying to do when the error happened, and other technical information relating to the problem.

Please be aware that while this information may not be personally identifying by itself, it may be possible to combine it with other data to personally identify individual persons.

Device Data

When you visit our website or interact with our services, we may automatically collect data about your device, such as:

Device type (e.g. iOS or Android)
Approximate geo-location data (with your permission, used to show nearby content in the Kastkart Shopper App)

We collect approximate location data at the city or neighborhood level only. We do not collect precise GPS coordinates or location data accurate to within 500 meters. Users can disable location access at any time in device settings.

We do not collect unique device identifiers (such as IDFA or advertising IDs). Data we collect can depend on the individual settings of your device and software. We recommend checking the policies of your device manufacturer or software provider to learn what information they make available to us.

Interaction Data

When you use our platform, we automatically collect interaction signals, including:

Video views
Product taps
Visits to external merchant websites (tap-out events)
Direction requests to physical store locations (“in-store intent”)

This data is used to improve the platform experience and to provide aggregated, non-identifiable performance analytics to sellers. Sellers receive only aggregated data (e.g. total views, total taps) that cannot be used to identify individual users. The only exceptions are information you actively choose to share: if you contact a seller through the platform, your message and account identity are shared with that seller so they can respond, and if you post a public comment, your username is visible alongside your comment. Beyond what you choose to share, no personally identifiable information is shared with sellers.

Automated Product Detection (Kast AI)

Kastkart uses an AI-assisted product detection system (“Kast AI”) that automatically identifies and labels products visible in seller-uploaded videos. Sellers review and may edit or remove any auto-detected product tags before publishing their content. Kastkart does not use automated systems to profile individual shoppers or serve targeted advertising based on personal data. Kast AI operates on content that creators and sellers voluntarily submit for publication. When you record or upload a video as a creator, your video (which may include your image and voice) is processed by our AI systems, including third-party AI providers acting on our behalf (currently Google’s Gemini models), solely to detect and label products, screen for prohibited content, and prepare your video for publication. Kast AI does not profile shoppers browsing the platform and is not used to serve targeted advertising based on personal data.

Personal Information

We may ask for personal information — for example, when you submit content to us, when you subscribe to our newsletter, when you register an account, or when you contact us — which may include one or more of the following:

Email address
Username and display name (public — shown alongside your comments and, if you are a creator, on your published content)
Phone number (collected if you optionally enable Multi-Factor Authentication (MFA), used solely for account security; or if you are a creator or seller and choose to add a contact phone number to your account)
Identity verification information (collected only if you are a creator and choose to request verification — see “Identity Verification” below)
Age group (collected voluntarily during optional profile setup; used for content recommendations and platform analytics)
Gender (collected voluntarily during optional profile setup; used for content recommendations and platform analytics)
Push notification preferences (with your permission; used to send updates from sellers you follow and platform alerts)

Creator and seller account information. If you enable creator mode or operate a seller account, we additionally collect the account holder’s legal first and last name (required before publishing content), and, optionally, a contact phone number and business or mailing address. This information is used for account verification, platform integrity, and compliance purposes. It is kept private and is never displayed publicly or shared with other users.

Identity Verification (optional, creators only)

Creators may request an identity check in order to display a verification badge. This is entirely optional; you can create, publish and sell without it.

The check is performed by Stripe Identity, acting as our service provider. You submit a government-issued identification document and a selfie directly to Stripe. Stripe compares the selfie to the photograph on the document to confirm that the person presenting the document is its holder. This comparison uses biometric identifiers.

Kastkart never receives or stores your identification document, your selfie, or any biometric identifier or biometric information derived from them. We receive only the outcome of the check: whether it succeeded, the name Stripe verified, the date, and a reference to the verification session. Stripe’s handling of the documents is governed by Stripe’s own privacy policy.

The badge confirms the identity of the account holder. It is not a statement that the account holder owns, represents, or is endorsed by any brand, product or business featured in their content.

You may withdraw from verification at any time by contacting us; we will remove the badge and the stored outcome.

User-Generated Content

We consider “user-generated content” to be materials (text, image, and/or video content) voluntarily supplied to us by our users for the purpose of publication on our platform. All user-generated content is associated with the account or email address used to submit the materials.

Please be aware that any content you submit for the purpose of publication will be public after posting (and subsequent review or vetting process). Once published, it may be accessible to third parties not covered under this privacy policy.

External Purchases and Transactions

Kastkart does not process purchases, payments, or transactions of any kind. Our platform enables users to discover products and connect with independent sellers, but all commerce occurs outside of Kastkart.

When you interact with a product on our platform, you may be redirected to a third-party merchant website or provided with directions to a physical store location. All purchases, payments, refunds, order tracking, and customer support related to those transactions are handled directly by the seller and are governed by the seller’s own policies.

Kastkart is not responsible for any transactions, product quality, fulfillment, or merchant practices that occur outside our platform.

Legitimate Reasons for Processing Your Personal Information

We only collect and use your personal information when we have a legitimate reason for doing so. In which instance, we only collect personal information that is reasonably necessary to provide our services to you.

Collection and Use of Information

We may collect personal information from you when you do any of the following on our platform:

Register for an account
Sign up to receive updates from us via email
Post a comment, review, or otherwise participate in our online community
Use a mobile device or web browser to access our content
Contact us via email or on any similar technologies
Save videos, follow sellers, or subscribe to seller notifications
Enable creator mode or publish video content
Contact a seller or respond to messages through the platform
Purchase credits or subscribe to a paid plan (payment card details are collected and processed by Stripe, not stored by Kastkart)

We may collect, hold, use, and disclose information for the following purposes, and personal information will not be further processed in a manner that is incompatible with these purposes:

To provide you with our platform’s core features and services
To enable you to customise or personalise your experience of our platform, including the Nearby feed and content recommendations
To contact and communicate with you
For analytics, market research, and business development, including to operate and improve our website and associated applications
To send you marketing and promotional communications. To opt out of these communications, please see “Your rights and controlling your personal information”
To enable you to access and use our platform and associated applications
For internal record keeping and administrative purposes
To comply with our legal obligations and resolve any disputes that we may have
For security and fraud prevention, and to ensure that our platform is safe, secure, and used in line with our terms of service
For technical assessment, including to operate and improve our platform and associated applications
To provide aggregated, non-identifiable analytics to sellers about how users interact with their content (views, taps, in-store intent signals)

Security of Your Personal Information

When we collect and process personal information, and while we retain this information, we will protect it within commercially acceptable means to prevent loss and theft, as well as unauthorised access, disclosure, copying, use, or modification.

Although we will do our best to protect the personal information you provide to us, we advise that no method of electronic transmission or storage is 100% secure and no one can guarantee absolute data security.

You are responsible for selecting any password and its overall security strength, ensuring the security of your own information within the bounds of our services.

How Long We Keep Your Personal Information

We retain personal information only for as long as reasonably necessary to fulfill the specific purpose for which it was collected, consistent with applicable law. We do not retain personal information indefinitely.

If you have provided us with personal information as part of creating an account, we will retain that information for the duration your account exists on our system. If your personal information is no longer needed for its stated purpose, or when you delete your account, we will delete or anonymize your personal information within 30 days, except where retention is required by law for compliance, accounting, or reporting obligations.

Identity verification. Where you have completed an optional identity check, we retain only the outcome of that check (status, verified name, date, and session reference) for as long as your account remains active and the badge is displayed, and we delete it when your account is permanently deleted or the badge is removed, whichever occurs first. Identification documents, selfies, and any biometric identifiers or biometric information are held by Stripe under Stripe’s retention terms and are never stored on Kastkart systems.

Children’s Privacy

We do not aim any of our products or services directly at children under the age of 13 and we do not knowingly collect personal information about children under 13.

Disclosure of Personal Information to Third Parties

We may disclose personal information to:

Third-party service providers for the purpose of enabling them to provide their services, including analytics, video processing, authentication, identity verification, database hosting, payment infrastructure, and consent management providers
Our employees, contractors, and/or related entities
Courts, tribunals, regulatory authorities, and law enforcement officers, as required by law, in connection with any actual or prospective legal proceedings, or in order to establish, exercise, or defend our legal rights
An entity that buys, or to which we transfer all or substantially all of our assets and business

We do not sell your personal information.

Sellers on the Kastkart platform receive only aggregated, non-identifiable performance data (such as total video views, product taps, and in-store intent signals). The only exceptions are information you actively choose to share — such as when you contact a seller through the platform (your message and account identity are shared with that seller so they can respond) or when you post a public comment (your username is visible alongside your comment). Beyond what you choose to share, no personally identifiable information about users is shared with sellers.

Third-party services we currently use include:

Google Analytics 4 (via Google Tag Manager)
Firebase (authentication, database, push notifications, and analytics)
Google AI / Gemini (automated product detection and content screening for creator videos — see “Automated Product Detection (Kast AI)”)
Mux (video processing and streaming)
Stripe (payment processing for seller and creator subscriptions and credits — not used for shopper transactions — and identity verification for creators (Stripe Identity))
Cloudflare (content delivery and serving of public share links)
GetTerms (cookie consent management)

International Transfers of Personal Information

The personal information we collect is stored and/or processed in the United States of America, or where we or our partners, affiliates, and third-party providers maintain facilities.

The countries to which we store, process, or transfer your personal information may not have the same data protection laws as the country in which you initially provided the information. If we transfer your personal information to third parties in other countries: (i) we will perform those transfers in accordance with the requirements of applicable law; and (ii) we will protect the transferred personal information in accordance with this privacy policy.

Your Rights and Controlling Your Personal Information

Your choice: By providing personal information to us, you understand we will collect, hold, use, and disclose your personal information in accordance with this privacy policy. You do not have to provide personal information to us, however, if you do not, it may affect your use of our platform or the products and/or services offered on or through it.

Information from third parties: If we receive personal information about you from a third party, we will protect it as set out in this privacy policy.

Marketing permission: If you have previously agreed to us using your personal information for direct marketing purposes, you may change your mind at any time by contacting us using the details below.

Access: You may request details of the personal information that we hold about you.

Correction: If you believe that any information we hold about you is inaccurate, out of date, incomplete, irrelevant, or misleading, please contact us using the details provided in this privacy policy. We will take reasonable steps to correct any information found to be inaccurate, incomplete, misleading, or out of date.

Non-discrimination: We will not discriminate against you for exercising any of your rights over your personal information.

Downloading of personal information: You may request a download of the personal information you have shared through our platform. Please contact us using the details below.

Notification of data breaches: We will comply with laws applicable to us in respect of any data breach. In the event of a data breach affecting your personal information, we will notify affected users and relevant regulatory authorities within the timeframes required by applicable law — within 72 hours for GDPR purposes, and as soon as reasonably possible for CCPA purposes.

Complaints: If you believe that we have breached a relevant data protection law and wish to make a complaint, please contact us using the details below. We will promptly investigate your complaint and respond to you in writing.

Opt out of communications: You may opt out of receiving marketing and promotional communications from us at any time by clicking the “unsubscribe” link included in any marketing email we send you, or by contacting us directly using the contact information provided in this privacy policy.

Please be aware that even if you opt out of marketing communications, we may still contact you when necessary for non-promotional purposes, including managing your account, responding to service inquiries, or providing important updates related to your use of our services.

Business Transfers

If we or our assets are acquired, or in the unlikely event that we go out of business or enter bankruptcy, we would include data, including your personal information, among the assets transferred to any parties who acquire us. You acknowledge that such transfers may occur, and that any parties who acquire us may continue to use your personal information according to this policy.

Limits of Our Policy

Our platform may link to external sites that are not operated by us. Please be aware that we have no control over the content and policies of those sites, and cannot accept responsibility or liability for their respective privacy practices.

Changes to This Policy

At our discretion, we may change our privacy policy to reflect updates to our business processes, current acceptable practices, or legislative or regulatory changes. If we decide to change this privacy policy, we will post the changes here at the same link by which you are accessing this privacy policy.

If the changes are significant, or if required by applicable law, we will contact you and all our registered users with the new details and links to the updated or changed policy.

Additional Disclosures for U.S. States Privacy Law Compliance

The following section applies to residents of U.S. states with applicable comprehensive privacy laws, including but not limited to California, Colorado, Virginia, Connecticut, Oregon, Indiana, Kentucky, Rhode Island, Delaware, New Hampshire, New Jersey, Minnesota, Maryland, and other states that have enacted or may enact consumer data privacy legislation. Where state law grants rights beyond those listed below, we honor those rights upon request.

Do Not Track

Some browsers have a “Do Not Track” feature that lets you tell websites that you do not want to have your online activities tracked. At this time, we do not respond to browser “Do Not Track” signals.

California Privacy Laws — CCPA/CPRA

Under California Civil Code Section 1798.83, if you live in California and your business relationship with us is mainly for personal, family, or household purposes, you may ask us about the information we release to other organizations for their marketing purposes.

To make such a request, please contact us using the details provided in this privacy policy with “Request for California privacy information” in the subject line. You may make this type of request once every calendar year.

California Notice of Collection

In the past 12 months, we have collected the following categories of personal information enumerated in the CCPA:

Identifiers, such as email address, phone number, account name, and IP address
Demographics, such as age group or gender (collected voluntarily)
Audio or visual data, such as videos shared or published on the platform
Geolocation data (approximate, with permission)
Inferences, such as information about your interests, preferences, and content recommendations
Legal name (collected from creators and sellers for account verification)
Biometric information (collected by our identity verification provider from creators who request optional verification; never received or stored by Kastkart)
Commercial information, such as records of credits or subscriptions purchased (sellers and creators only)

Right to Know and Delete

You have the right to request that we delete your personal information and to know certain information about our data practices in the preceding 12 months. To exercise any of these rights, please contact us using the details provided in this privacy policy, or visit our Account Deletion page.

Shine the Light

You have the right to request information from us regarding the manner in which we share certain personal information with third parties and affiliates for their own direct marketing purposes. To receive this information, send us a request using the contact details provided in this privacy policy. Requests must include “Privacy Rights Request” in the first line of the description.

Biometric Information (Illinois, Texas, Washington)

If you choose to complete an optional identity check, a biometric identifier (a scan of facial geometry derived from your selfie and your identification document) is collected and used solely to confirm that you are the person shown on the document you submitted, for the purpose of issuing a verification badge on your Kastkart account. It is not used for any other purpose, and it is never sold, leased, traded or otherwise profited from.

This collection is carried out by Stripe, Inc. as our service provider, and your consent is obtained by Stripe before collection. Kastkart does not receive, store, or have access to any biometric identifier or biometric information.

Biometric identifiers are permanently destroyed by Stripe when the purpose for collection has been satisfied, or within three years of your last interaction with Kastkart, whichever occurs first. Kastkart retains only the non-biometric outcome of the check, as described in “How Long We Keep Your Personal Information”.

Illinois residents may contact us using the details in “Contact Us” with questions about this policy.

Data Controller

We, Prettli Inc., DBA Kastkart, are a Data Controller with respect to the personal information you provide to us. We determine what personal information to collect and for what purpose.

Legal Bases for Processing Your Personal Information

We will only collect and use your personal information when we have a legal right to do so. Our lawful bases include:

Consent — where you give us consent to collect and use your personal information for a specific purpose. You may withdraw your consent at any time.
Performance of a contract — where processing is necessary to provide our services.
Legitimate interests — where we assess it is necessary for our legitimate interests, such as to provide, operate, improve, and communicate our services.
Compliance with the law — where we have a legal obligation to use or keep your personal information.
Identity verification — where you request a verification badge, we process identity data on the basis of your explicit consent (Article 9(2)(a) GDPR, for the biometric element) and our legitimate interests (Article 6(1)(f)) in preventing impersonation and maintaining trust on the Platform. You may withdraw consent at any time by asking us to remove the badge; withdrawal does not affect processing carried out beforehand.

International Transfers Outside of the EEA

We will ensure that any transfer of personal information from countries in the European Economic Area (EEA) to countries outside the EEA will be protected by appropriate safeguards. We rely on the European Commission’s Standard Contractual Clauses (SCCs) as the transfer mechanism for personal data transferred outside the EEA.

Restrict: You have the right to request that we restrict the processing of your personal information in certain circumstances.

Object: You have the right to object to processing of your personal information that is based on our legitimate interests.

Data portability: You may have the right to request a copy of the personal information we hold about you in a commonly used, machine-readable format.

Deletion: You may request that we delete the personal information we hold about you. If you terminate or delete your account, we will delete your personal information within 30 days of the deletion of your account. To submit a deletion request, visit our Account Deletion page.

Contact Us

For any questions or concerns regarding your privacy, you may contact us using the following details:

Kastkart Privacy Team privacy@kastkart.com