Privacy Policy

Kalp is operated by Kalp Technologies Pte. Ltd., a company incorporated in Singapore (“Kalp”, “we”, “us”). This policy covers our website, web application, APIs and related services (the “Service”).

For personal data we collect to run our business, such as account and contact details, we decide how it is used and are responsible for it. For personal data that appears in content our customers upload (for example, a person shown in a product photo), we process it on our customer’s behalf and under their instructions. In that case, the customer’s own privacy notice applies, and requests about that data should go to them first.

We have appointed a Data Protection Officer, who can be reached at privacy@getkalp.com.

Information you give us

• Account details: your name, business email address and password. We store passwords only in salted, hashed form. If you sign in with Google, we receive your name, email address and profile picture from Google, and never your Google password.
• Demo and contact requests: your name, business email, phone number and anything you write to us.
• Workspace content: product photos, documents, product information, website links, answers to questions, edits and approvals, and the listing content generated from them. This is mostly business information, but it can contain personal data, such as people in photos or names in documents.
• Billing details: if you buy a paid plan, your billing contact and company details. Card payments are handled by our payment processor, and we do not store full card numbers.

Information collected automatically

• Usage and log data: actions you take in the Service, the pages and features you use, timestamps, errors, IP address, browser type and device information.
• Cookies: small files needed to keep you signed in and secure. See Cookies.

Information from public sources: when you give us a link to your website or a marketplace listing, we fetch the publicly available product information on that page to build your product record.

We use personal data to:

• Create and manage your account, authenticate you and provide the Service.
• Process your content into product records, questions and listing content.
• Respond to demo requests, support questions and other messages.
• Send service messages, such as security alerts, product changes and billing notices.
• Keep the Service secure, including rate-limiting, fraud prevention and abuse detection.
• Understand how the Service is used and improve it, using aggregated and de-identified data wherever possible.
• Comply with legal obligations and enforce our terms.

With your consent, we may also send you product news. You can unsubscribe at any time using the link in the email.

The Service uses AI models to analyse your content and generate listing text and images. To do this, we send the relevant content (for example, product photos and product details) to AI model providers, which process it on our behalf to return a result.

• No training on your content. We do not use your photos, documents, product information or generated listings to train AI models, and we use AI providers under terms that do not allow them to use that content to train their models.
• Aggregated improvement only. We may use aggregated, de-identified data, such as approval rates, edit counts, error types and marketplace rejection patterns, to improve the Service. This data does not identify you, your brand or your products.
• Human control. AI-generated content is presented to you as a proposal. Nothing is published to a marketplace without a person approving it, and we do not use AI to make decisions about you that have legal or similarly significant effects.

We do not sell your personal data, and we do not share it for cross-context behavioural advertising. We share it only as follows:

• Service providers who process data on our behalf under contract, including cloud hosting and storage (Amazon Web Services), AI model providers (such as OpenAI, Google and models made available through Amazon Web Services), sign-in (Google, if you choose it), email delivery and payment processing. Product keywords may be sent to market-research data providers to build keyword plans. These requests contain product terms, not personal data.
• Your workspace. Content in a workspace is visible to the team members its owner invites.
• Legal reasons, where we believe disclosure is required by law or needed to protect the rights, property or safety of Kalp, our customers or others.
• Business transfers. If we are involved in a merger, acquisition, financing or sale of assets, personal data may transfer as part of that deal, subject to this policy.
• With your consent or at your direction, for example when you connect a marketplace account.

Kalp Technologies Pte. Ltd. is based in Singapore. Our primary servers and file storage are located in India, and some of our service providers, including AI model providers, process data in the United States and other countries. This means your personal data may be processed outside the country where you live.

When we transfer personal data internationally, we take steps to ensure it receives a standard of protection comparable to that required in Singapore under the Personal Data Protection Act 2012. This includes contracts with our providers that require them to protect it and, where applicable, standard contractual clauses approved by the European Commission or the UK.

We keep personal data only for as long as we need it for the purposes in this policy:

• Account and workspace data for as long as your account is active. After you close your account, we delete it within 90 days.
• Demo and contact requests for up to 24 months after our last interaction, unless you become a customer.
• Billing and transaction records for as long as tax and accounting laws require, typically five years.
• Security logs for a limited period, unless needed to investigate an incident.

Deleted data may remain in encrypted backups for a limited period until those backups are overwritten in the normal course. Aggregated, de-identified data may be kept indefinitely.

We use reasonable administrative, technical and physical safeguards to protect personal data. These include encryption in transit, private storage with restricted access, hashed passwords, access controls that limit staff access to what their role requires, and rate limits on sign-in. No system is completely secure. If we become aware of a data breach that affects you, we will notify you and the relevant authorities as the law requires.

We use only cookies that are strictly necessary for the Service to work, such as those that keep you signed in and protect sign-in with Google against forgery. We do not use advertising cookies or third-party tracking cookies. If we introduce optional analytics or marketing cookies in the future, we will update this policy and ask for your consent where the law requires.

Depending on where you live, you may have the right to:

• Access the personal data we hold about you and learn how we use it.
• Correct inaccurate or incomplete personal data.
• Delete your personal data.
• Receive a copy of your personal data in a portable format.
• Object to or restrict certain processing.
• Withdraw consent where we rely on it, without affecting processing before the withdrawal.

To make a request, email privacy@getkalp.com. We may need to verify your identity before responding, and we will reply within the time the law requires. You can also update most account details and delete content directly in the Service. If you are not satisfied with our response, you may complain to your local data protection authority.

Singapore. We handle personal data in line with the Personal Data Protection Act 2012. You may withdraw consent to our use of your personal data by contacting our Data Protection Officer. If you withdraw consent, we may not be able to keep providing the Service. You can also contact the Personal Data Protection Commission.

European Economic Area, United Kingdom and Switzerland. Our legal bases for processing are: performing our contract with you (to provide the Service); our legitimate interests (to secure, support and improve the Service and to market it to businesses), balanced against your rights; compliance with legal obligations; and your consent, where we ask for it.

United States. Residents of California and other states with consumer privacy laws have the rights described above, to the extent those laws apply. We do not sell or share personal data as those laws define it, and we do not use or disclose sensitive personal information for purposes that would give you a right to limit it. We will not discriminate against you for exercising your rights. You may use an authorised agent to submit a request.

India. Where the Digital Personal Data Protection Act 2023 applies, you may exercise your rights to access, correction, erasure and grievance redressal, and nominate another person to exercise them on your behalf, by contacting privacy@getkalp.com.

The Service is intended for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy from time to time. We will post the updated version on this page and change the effective date above. If a change is material, we will also notify you by email or in the Service before it takes effect.

For privacy questions or requests, contact our Data Protection Officer at privacy@getkalp.com. For other legal matters, email legal@getkalp.com.

Kalp Technologies Pte. Ltd., Singapore.