Data Policy

Last updated: 7 July 2026

This Data Policy explains how Kichu handles data at a technical level — where it lives, how shops are kept separate, and how data is retained, exported, and erased. It complements our Privacy Policy (which covers what we collect and why) and our Terms of Use. Where this policy and the Privacy Policy overlap, read them together.

How data is organised

kichu records what happens in a shop — an order placed, a payment settled, a refund issued — as an append-only ledger of business events. This ledger is the durable, auditable record of your business. By design, the ledger is kept free of personal contact information: names, emails, phone numbers, and addresses are not written into it.

Instead, personal contact information is stored in separate, isolated stores ("PII sidecars") linked to the business record by an opaque identifier. This separation is what lets us erase someone's personal data on request without corrupting or rewriting the business history.

Isolation between shops

Every shop's data is isolated per organization. Stored data is partitioned by organization and protected with row-level security so that one shop cannot read another shop's data. Sensitive fields are handled with strict, least-privilege access controls.

Where data is stored

• Structured data (the ledger and the personal-data sidecars) lives in a managed PostgreSQL database hosted in the Singapore region, with encryption in transit and required TLS.
• Files & media (such as product images and uploaded attachments) are stored with a cloud object-storage provider. The database holds only opaque pointers to this content, never the bytes themselves.

Payment data

Kichu does not receive or store full card numbers. Payments are handled by third-party processors, and we retain only tokens and a non-reversible card fingerprint (issuer and last four digits) needed to reference a payment. This keeps sensitive card data outside our systems.

Data retention

We keep data for as long as needed to provide the Services and to satisfy legal, tax, accounting, and security obligations. Business-record events in the ledger are retained as the permanent record of a shop's activity; personal contact information in the sidecars is retained only as long as needed and is erased on a valid request (see below).

Erasure ("right to be forgotten")

When we erase personal data, we perform a hard delete of the relevant sidecar record — not a soft-delete or hidden tombstone. After erasure, the data is gone and reads are indistinguishable from data that never existed. The business-record events remain (for example, that an order was paid on a given date), but they hold only opaque identifiers, never the erased personal information. This design is built to satisfy erasure rights under laws such as the GDPR (Article 17) and applicable U.S. state privacy laws.

One exception: free-text that a merchant chooses to author into permanent business fields (such as a product title) is part of the permanent record and is not individually erasable. Merchants are advised never to put a customer's personal contact details into such fields.

Data export & portability

A merchant can export their organization's data — the full business ledger together with the associated personal-data sidecars — as a downloadable bundle with an integrity checksum and a short-lived, private download link. Customer requests for a copy of their data are today fulfilled with the help of the merchant whose shop holds the data; broader self-serve export is on our roadmap.

Backups

We take regular encrypted backups and keep an off-site copy so we can recover from failures. Because backups are point-in-time snapshots, erased data may persist in a backup until that backup rotates out under our retention schedule, after which it is overwritten.

Sub-processors

We use a small set of vendors to run the Services — including our hosting and database provider, our object-storage provider, payment processors, Meta (messaging and advertising), delivery couriers, and AI providers (Anthropic and OpenRouter). We share only the data each vendor needs, under confidentiality and data-protection obligations. See the Privacy Policyfor details of what is shared and why.

Requests & contact

To request access, export, correction, or erasure of your data, contactprivacy@kichu.dev. If you are a shopper, we may direct your request to the merchant whose shop holds your data and assist them in fulfilling it.

Kichu Inc., New York, USA.