Privacy Policy - KartupAI

1. INTRODUCTION

Kartup AI ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and website (the "Service"). We operate under the principles of Data Minimization—meaning we only collect what is strictly necessary to serve you money.

2. DATA WE COLLECT (AND WHAT WE DON'T)

A. Information You Provide to Us:

Account Information: When you register, we collect your name and email address.
No financial data at all: Kartup AI does not collect, request or store card numbers, CVV codes, expiry dates, PINs, bank logins, or even which bank you use. There is no bank profile in the product.

B. Information Collected Automatically:

Device Data: IP address, device type, and operating system (for App Store optimization).
Search history: We store your searches and the products they returned, so your recent searches are there when you come back and so we can see which searches return poor results.
Log Data: Our servers automatically record information created by your use of the Service to help our team to identify and fix bugs.

3. HOW WE USE YOUR DATA

We use the information we collect solely to:

Answer your search: Send your search wording, and any product photo or voice note you provide, to Google's Gemini API in order to understand the request and write the summary you read. Your search wording is also sent to the providers that do the looking: Exa, Tavily, Firecrawl, scrape.do and SerpApi. A voice note is transcribed before it is used.
Price alerts: If you ask us to watch a product, we store the product, the price you asked to be told about and your email address, and we email you when a check finds the price at or below it.
Your saved products: Store your wishlist so it is there when you sign in on another device.
Affiliate attribution: Ensure our partner links work, through vCommission for product Buy links and CueLinks for coupons and other outbound links. That commission is how the service stays free to you.

We do not hold a profile of your bank cards, and we do not forecast future prices.

4. DATA SHARING AND DISCLOSURE

We do not sell your personal data to third-party advertisers. We only share data in the following limited circumstances:

AI Processing: Your search wording, and any photo or voice note, is sent to Google Gemini. We use a paid Google Cloud channel rather than a free consumer one. What Google may do with that data is governed by Google's own terms, not by ours, so read theirs if it matters to you.
Service Providers: Supabase hosts the database. The site itself runs on Amazon Web Services (EC2 in the US East region), with Cloudflare in front of it and Amazon CloudFront serving images and other static files. It is not hosted on Vercel.
Legal Requirements: We may disclose data if required by Indian law or in response to valid requests by public authorities.

5. DATA RETENTION & YOUR "RIGHT TO BE FORGOTTEN"

In compliance with the DPDP Act (2023/2026), Kartup AI provides you with full control over your data:

Retention: We retain your search history only as long as your account is active.
Deletion: Use "Delete my account" in Profile settings, or email [email protected] from the address on the account. Either way the request is recorded and your account, wishlist and price alerts are removed. Deletion is actioned by our team rather than instantly by software, so allow up to 30 days, and write to us at that address if you have not had confirmation by then.
Anonymization: We may retain non-identifiable, aggregated data (e.g., "1,000 people searched for iPhone 15 today") for market trend analysis.

6. COOKIES AND TRACKING

Two things always load, because the site does not work without them: the cookie that keeps you logged in, and CueLinks, which attributes the affiliate commission when you follow a retailer link from KartupAI.

Nothing else loads until you say yes. When you first arrive you are asked, and until you accept, none of the scripts below run:

Google Analytics (gtag.js) - page and event analytics. Loads only with your consent to analytics.
Microsoft Clarity - session and interaction analytics, including heatmaps. Loads only with your consent to analytics.
Google AdSense - advertising. Loads only with your consent to advertising.

Hotjar is not used. PostHog and Simple Analytics were removed; they collected page views that Google Analytics already collected.

You can change or withdraw your choice at any time from the "Cookie choices" link in the site footer, which reopens the same options. Withdrawing is one click and takes effect immediately. You can also block these with your browser or extension settings, and on mobile through your device settings.

7. SECURITY MEASURES

The developer team has implemented SSL/TLS encryption for all data in transit. Our database is "encrypted at rest," meaning even if the physical servers were accessed, your email and bank preferences remain unreadable.

8. CHILDREN'S PRIVACY

Kartup AI is intended for users aged 18 and above. We do not knowingly collect data from children. If we discover a user is under 18, we will delete their account immediately.

9. CHANGES TO THIS POLICY

As we move from Alpha to Beta, we may update this policy. We will notify you of any significant changes via a push notification or an in-app popup.

10. CONTACT OUR DATA PROTECTION OFFICER (DPO)

If you have questions regarding your data, the DPDP Act, or our security protocols, please contact our team:

Email: [email protected]

Subject: Data Privacy Inquiry