Privacy Policy

KASYMIR LLC ("Kasymir", "we") makes software for businesses to sell, manage stock and money, sell online and read store cameras. This Privacy Policy covers information about:

• Merchants: the businesses that use Kasymir, their owners and staff;
• Visitors: people who visit kasymir.com or contact us;
• Merchants' customers and the people seen by store cameras: information a merchant puts into Kasymir. For this information the merchant decides how it is used and we act on the merchant's instructions. If you are a shopper with a question, it is best to contact the store first; we will help them answer.

• Account and business details: name, email, phone, business name, country, address, tax or business identifiers and the people you invite.
• Verification: documents and details we or our payment partners need to confirm your identity and business.
• Payments and payouts: transaction details and payout status from our payment partners. Full card numbers are handled by the processors.
• Usage and device data: how you use the app, device and browser type, IP address, approximate location, logs and error reports.
• Communications: messages, support requests and survey answers.
• From connected services: when you connect an online store or other service, the data needed for it (products, prices, stock, orders).

Merchants use Kasymir to keep records such as customer names and contact details, purchases, invoices, loyalty status, staff records and, if they turn it on, video from store cameras. We process this information on behalf of the merchant, only to provide the Service, keep it secure and meet legal duties. Merchants are responsible for telling their customers and staff about it and for having the right to collect it.

When a merchant turns on computer vision, video from a phone or the store's own cameras is sent to Kasymir and analyzed. The analysis creates:

• people detections (a box where a person appears), counts, visits, time spent and activity in zones the merchant marks;
• an estimate of gender based on body appearance (no age estimate);
• only if the merchant turns it on: face re-identification templates that recognize a returning face, and named enrollment, where the merchant links a face to a name (for example, for staff).

Face templates are biometric information. They are used only for that merchant, never combined across merchants, never sold, and deleted when the merchant turns the feature off, deletes the person or closes the account. Merchants must give notice and get any consent the law requires before using these features (for example in Illinois, Texas and Colombia).

Video frames and detections are kept only as long as needed for the features the merchant uses and for the retention period the merchant sets, within the limits in the "How long we keep information" section.

• to create and run your account and provide the features you choose;
• to verify identity, prevent fraud and keep the Service secure;
• to work with payment and lending partners when you use those features;
• to answer support requests and send service messages (receipts, security alerts, changes to terms);
• to send product news and offers, which you can turn off at any time;
• to understand usage and improve Kasymir, including its AI features (see below);
• to meet legal, tax and accounting duties and to enforce our Terms.

• Service providers that host data, send email, provide support tools or help us operate, under contracts that limit their use of the data.
• Payment processors and their banks, to provide payments and payouts and to meet their legal duties.
• Lending partners, only when you ask to see or accept an offer.
• Services you connect, such as an online store platform, to make the connection work.
• Legal reasons: to follow the law, a valid legal request, or to protect the rights, safety or property of people or of Kasymir.
• Business changes: in a merger, acquisition or sale of assets, under this Policy.

We do not sell personal information and do not share it for cross-context behavioral advertising.

To improve features like forecasts and people detection, we may use usage data and information that has been de-identified or aggregated so it no longer identifies a person or a merchant. We do not use face templates, named enrollments or a merchant's customer records to train models shared with other merchants unless the merchant agrees.

We use cookies, local storage and similar tools to keep you signed in, remember settings such as language and light or dark mode, secure the Service and understand how it is used. You can control cookies in your browser; some features may not work without them.

• Account and business data: while the account is open, then up to 30 days after closing so you can export it.
• Payment, invoice and tax records: as long as tax, accounting and payment rules require (often several years).
• Camera video frames: a short period, by default no more than 30 days, unless the merchant saves a clip for a security reason. Detection counts and statistics without faces can be kept longer as part of the merchant's reports.
• Face templates and named enrollments: until the merchant turns the feature off, deletes the person, or closes the account, and in any case no longer than the law allows.

We use measures such as encryption in transit, access controls, separation of each merchant's data and monitoring to protect information. No method of storage or transmission is completely secure. If we learn of a security incident that affects your information, we will notify you as the law requires.

• Merchants can view, correct and export most information directly in the app, and close the account at any time.
• You can ask us to access, correct or delete your personal information, or for a copy of it, by writing to us. We may need to confirm your identity first.
• Depending on the state where you live, you may have additional rights, such as to know what we collect, to correct or delete it, and to appeal our decision. We will not treat you differently for using these rights.
• You can unsubscribe from marketing emails using the link in each message; we will still send service messages.

For people in Colombia we follow Law 1581 of 2012 (Ley 1581 de 2012) and its regulations. Under that law you can:

• know, update and correct your personal data;
• ask for proof of the authorization you gave us;
• be told how your data has been used;
• file complaints with the Superintendencia de Industria y Comercio (SIC);
• revoke your authorization or ask for deletion when the law allows;
• access your data free of charge.

Biometric data, such as face templates, is sensitive data in Colombia and is only processed with prior, express and informed consent. To exercise these rights, write to [email protected] with the subject "Habeas data". We answer questions within 10 business days and complaints within 15 business days, as the law sets. If your request is about a store's customer records, we will forward it to the store, which is responsible for that data.

We and our service providers store and process information in the United States and possibly other countries. When information from Colombia or another country is transferred, we use the protections the law requires.

Kasymir is not directed to children under 13 (or the minimum age in your country), and we do not knowingly collect their information for our own purposes. Merchants must not use Kasymir to collect children's information unlawfully.

We may update this Privacy Policy. For important changes we notify merchants by email or in the app before they take effect, and we update the date at the top of this page.