Privacy Policy

Last updated: 7 July 2026

This Privacy Policy explains how Kichu Inc. ("Kichu", "we", "us") collects, uses, shares, and protects personal information when you use the kichu platform — our website, merchant dashboard, hosted storefronts, messaging inbox, APIs, and related services (together, the "Services").

Kichu is a commerce platform for merchants. In most cases we act as a data processor handling information on behalf of the merchant (the "data controller") who runs a shop on kichu — for example, the personal data of that shop's customers. For our own merchant account holders, and for visitors to our marketing site, we act as a data controller. This policy describes both roles.

Who we are

Kichu Inc., New York, USA. For any privacy question, request, or complaint, contact us at privacy@kichu.dev.

Information we collect

We collect the following categories of personal information.

Merchant account data

• Account & identity — the name and verified email of the people who create and administer a shop, and an optional verified phone number.
• Billing — a payment-method token from our payment processor for your kichu subscription. We never receive or store your full card number.
• Usage — how you interact with the dashboard, so we can operate, secure, and improve the Services.

Customer data (processed on behalf of merchants)

When a shopper buys from or messages a shop on kichu, we process the shopper's data on that merchant's behalf, including:

• Contact details — name, email, and phone number.
• Order & shipping details — shipping address, order contents, and order history.
• Payment identifiers — tokens and a card fingerprint (a non-reversible reference, last-4 and issuer) from the payment processor. Raw card numbers never reach Kichu.
• Messages — the content of conversations exchanged through connected Instagram, WhatsApp, and Messenger channels.
• Marketing consent — whether a shopper has opted in to receive messages on a given channel (email, SMS, WhatsApp) or to have hashed identifiers shared with advertising platforms.

Site visitor data

When you browse our marketing site we use a small number of first-party cookies to remember your language, theme, and accent choices. We do not sell this information.

How we use information

• To provide, operate, secure, and improve the Services.
• To process orders, payments, deliveries, and returns.
• To power AI features that assist merchants — for example drafting replies to customer messages or generating a storefront design (see "AI features" below).
• To send transactional communications (such as one-time sign-in codes and order updates), and — only with the recipient's opt-in — marketing messages.
• To detect, prevent, and investigate fraud, abuse, and security incidents.
• To comply with legal obligations.

How we share information

We do not sell personal information. We share it only as follows.

• With the merchant whose shop a shopper transacts with — that merchant receives their own customers' order and contact data.
• Payment processors — to authorize and settle payments (for example bKash, Nagad, Cash-on-Delivery flows, and card processors such as Stripe). Where the bring-your-own-processor model applies, funds flow to the merchant's own processor account and Kichu does not hold your funds.
• Messaging & advertising platforms — Meta (WhatsApp, Messenger, Instagram) to deliver conversations, and, only with opt-in, Meta Conversions API and Google Enhanced Conversions to which we send hashed email/phone identifiers for ad measurement.
• AI providers — Anthropic and OpenRouter, to power AI assistance (see below).
• Delivery partners — couriers (such as Pathao and Steadfast) to fulfil shipments; a phone number is required to book a parcel.
• Infrastructure providers — our hosting and object-storage vendors, under confidentiality obligations.
• Legal & safety — when required by law, or to protect the rights, safety, and property of Kichu, our merchants, or the public.

AI features

Some features use large-language-model providers (Anthropic and OpenRouter) to generate text — for example suggested replies to customer messages or a generated storefront design. Relevant content is sent to these providers to produce a response. We do not permit these providers to train their models on your data. AI output is a draft: a human decides what is sent or published.

International data transfers & where data lives

Kichu Inc. is based in the United States. Our production systems are hosted in the Singapore region, and blob content (such as product images) is stored with a cloud object-storage provider. Because we operate internationally, your information may be processed in the United States, Singapore, and other countries. Where transfers are subject to data-protection law (including the EU/EEA and Bangladesh), we rely on appropriate safeguards such as standard contractual clauses.

Data retention

We keep personal information for as long as needed to provide the Services and to meet legal, accounting, and security obligations. Kichu's ledger of business events is deliberately kept free of personal contact information — personal data lives in separate stores that can be erased on request without disturbing the business record. See our Data Policy for the technical detail.

Your rights

Depending on where you live, you may have the right to access, correct, delete, export, or restrict the processing of your personal information, to object to certain processing, and to withdraw consent. We honour these rights — including erasure and data export — for all users, and in particular for those protected by the EU/EEA General Data Protection Regulation, U.S. state privacy laws, and Bangladesh law.

Because a merchant is the controller of their customers' data, a shopper's request is usually fulfilled through the merchant, with our support. To make a request, or if the merchant cannot help, contactprivacy@kichu.dev. We will respond within the timeframe required by applicable law.

Security

We protect information with encryption in transit, per-organization isolation of stored data, strict handling of sensitive fields, and least-privilege access controls. No system is perfectly secure, but we work continuously to safeguard your data and to disclose incidents as required by law.

Children

The Services are not directed to children under 13 (or the minimum age in your jurisdiction), and we do not knowingly collect their personal information.

Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the date above and, where appropriate, notify you.

Contact

Kichu Inc., New York, USA —privacy@kichu.dev.