Privacy Policy

Last updated: 9 November 2026 · Effective: 9 November 2026

Kalaikona is currently in private, invitation-only beta. This notice describes what the product actually does today and is accurate as of the date above.

Kalaikona LLC, a Delaware limited liability company, is responsible for the personal data described in this policy.

Registered address: 8 The Green, Suite B, Dover, DE 19901 · Email: support@kalaikona.com

1. Who this policy is for

Kalaikona ("Kalaikona", "we", "us") provides a platform where small business owners build an online store and take orders. Two different groups of people give us personal data, and they have different relationships with us:

• Sellers — people who create an account and run a store.
• Buyers — people who order, book, enquire, enrol or leave a review through a seller's storefront.

Buyers do not have a Kalaikona account and generally interact with the seller, not with us.

Where a section applies to only one group, it says so.

2. Kalaikona is in private beta

• Kalaikona is currently a private, invitation-only beta. Stores are live and public, but the

platform is not generally available.

• Payments. Sellers pay Kalaikona a monthly subscription by card through our payment provider, Stripe.

Buyers pay sellers directly — by card through the seller's own connected Stripe account, or by another method the seller offers, such as UPI. Kalaikona never receives or stores card details.

• Sellers who joined during the free beta: what happens to their store is described in §8.

3. What we collect

3.1 From sellers

3.2 From buyers

Collected by the seller through their storefront, stored by us on their behalf:

We do not collect or store payment card details. Card details are entered on Stripe's own payment page or in Stripe's secure payment field, and never reach Kalaikona's servers.

3.3 Children's data — read this section

Kalaikona collects a limited amount of data about children, because a parent can enrol a child in a class through a seller's storefront. We are explicit about this rather than claiming otherwise.

When a parent enrols a child, we may collect:

• the child's first name — optional, and
• an age range — optional, chosen from broad bands (5–7, 8–10, 11–13, 14+).

Both fields are optional and an enrolment completes with neither provided. We do not collect a child's exact age, surname, date of birth, address, contact details, photograph, or any other identifier. We reduced this deliberately: an exact age field was removed from our systems entirely so it can no longer be stored.

The data is provided by the parent or guardian making the enrolment, is visible only to the seller running the class and to us as the platform, and is never sent to any AI provider (§5).

3.4 Collected automatically

• IP address, browser and device characteristics, and request logs — via our hosting provider.
• A persistent visitor identifier and a session identifier, stored in your browser, used to

count visits and understand where people drop out of a flow. These are pseudonymous: they are not linked to your name or email, but they persist across visits and are treated as personal data.

• Product analytics events — see §6.
• If you report a store: the reason you chose, anything you write, your email if you give one, and a one-way

scrambled form of your IP address (used only to limit repeated reports and to count reports from different people). The seller is not told who reported.

3.5 Public posts we read for research

To learn what home-based sellers struggle with, we read public posts, comments and app-store reviews on platforms such as YouTube, Reddit and Apple's App Store, and public web pages found through a search engine — always through those platforms' official interfaces. We keep only the public text and a link to it, not the author's name or account, we delete what we keep after 90 days, and we never message anyone from what we read. If a reply is ever sent, a person writes and sends it by hand.

4. Who we share it with

We use the following providers. Each receives only what its function requires.

We do not sell personal data. We do not use third-party advertising networks and we run no third-party advertising or cross-site tracking scripts.

People at Kalaikona who can see your data

A small number of people can see store content and the messages sent to us:

• Someone from our support team, who sets up stores, answers enquiries sent to our support address, and helps

sellers with their stores. They can see store content, buyer enquiries and order records for the stores they are helping.

• Our engineering staff, who can see store data when diagnosing a fault.

Everyone with access is bound by a written confidentiality obligation. We keep a record of who has access and remove it when it is no longer needed.

Store content is also held in our source-code and deployment systems (GitHub and Vercel) as part of running and backing up the service.

We keep a copy of the service for testing, in which every person's name, email, phone and address is replaced. Public store content stays as it is on the live site. To demonstrate a store we may copy its public content, never buyers or contact details, into that copy.

Featured stores. If a seller says yes to "Feature my store", her store's public content may appear in posts on Kalaikona's own social accounts; the platform holding a post does so under its own terms. Switching it off withdraws posts not yet published and removes published ones within 7 days.

5. Artificial intelligence — what is and is not sent

Kalaikona uses AI to help sellers write listings, generate store copy and edit product photos.

What is sent to AI providers:

• Anthropic receives seller-provided business content — store name, business description, category

names, product names, product descriptions, prices — and the seller's own chat messages.

• fal.ai and remove.bg receive product images uploaded by the seller.
• Anthropic also receives the photos a seller adds to her store (products, cover, gallery), once each, to check

them against the categories no store may sell (Terms §5).

What is never sent:

Buyer personal data is never transmitted to any AI provider. Buyer names, email addresses, phone numbers, postal addresses, order contents, enquiry messages, enrolment details, children's data, and images uploaded by buyers are never included in prompts sent to Anthropic, nor in images sent to fal.ai or remove.bg.

6. Analytics

We run first-party analytics only — no third-party analytics SDK, no advertising pixels.

We record product events such as which onboarding step was viewed or completed, and storefront events such as a page or product view. Events carry a pseudonymous visitor or session identifier and, for signed-in sellers, an account identifier.

Event details are stripped of personal data automatically before storage. Any field whose name suggests an email address, password, token, card number, phone number or postal address is discarded at the point of writing, and event details are size-capped. This is enforced in code, not by convention.

7. Cookies and browser storage

We use no advertising or cross-site tracking cookies. What we set:

Browser storage can be cleared through your browser settings. Clearing the authentication cookie signs a seller out; clearing cart storage empties a cart.

8. How long we keep it

A store is deleted automatically only after it has been offline for 30 days because its subscription ended, and only after we have emailed the seller the date (below, and Terms §7).

If a seller deletes their store, we remove the store and its content — products, classes, sessions, enrolments, waitlist entries, FAQs, testimonials, gallery images, events and categories.

We want to be precise about a limitation: deleting a store does not by itself delete the seller's account, their onboarding answers, or their stored chat transcripts. Those are tied to the account rather than the store and survive store deletion. A request to delete an account covers them.

Deletion on request is a manual process. A seller or a buyer may request deletion of their personal data by emailing support@kalaikona.com. We will action it within 30 days of the request. We state this as manual deliberately: we have not built an automated self-service deletion tool, and we would rather describe the process we actually operate than one we do not.

Sellers who joined during the free beta. A seller's store is theirs. Before a beta seller's first charge we give 30 days' written notice. If she does not start a subscription by the date in that notice, the store is deactivated — taken offline and unavailable to buyers — and is deleted 30 days later; we email the date. We do not delete a store without notice first. A store whose subscription ends — because a payment cannot be taken, or because the seller cancelled — goes offline the same way and is deleted 30 days later, unless the subscription is restarted first; we email the date (Terms §7).

Content export. At any point, a seller may request a full export of their own content — their store details, categories, products, services and classes, FAQs, testimonials, gallery images, events and custom pages — by emailing support@kalaikona.com. This is a manual process operated by us.

The export deliberately excludes buyer data. It contains the seller's own content only. Orders, enquiries, enrolments, appointments, reviews, tips and custom-order requests are not included, and no child's name or age range can appear in an export. A seller's export is not a route to extract other people's personal data, and is built so that data cannot appear in it.

Backups and logs may retain data for a limited period after deletion, and we may retain records where we are legally required to.

9. Your rights

Depending on where you live you may have rights to access, correct, delete, restrict or object to our use of your personal data, to receive a copy in a portable form, and to withdraw consent.

To exercise any of these, email support@kalaikona.com. We will respond within 30 days. All such requests are handled manually.

If you are a buyer: your data was given to a seller through their storefront. You may contact us at the address above, and we will act on your request or pass it to the seller as appropriate.

If you are in India: the Digital Personal Data Protection Act, 2023 applies to the personal data we process about you. You have the rights it gives you — to know what we hold, to correct or erase it, to nominate someone to exercise your rights, and to have your grievance heard. Our Grievance Officer can be reached at support@kalaikona.com (mark the subject "Grievance"); the Grievance Officer acknowledges within 48 hours and responds within 30 days, and is the person who answers, on Kalaikona's behalf, any question about how your personal data is processed. A seller in India is the data fiduciary for the data her buyers give her through her store; we process it on her behalf and pass her any request that is hers to answer. Postal address for the Grievance Officer: Kalaikona LLC, 8 The Green, Suite B, Dover, DE 19901.

10. Security

Data is stored with access controls that restrict each seller to their own store's data, enforced at the database level. Traffic is encrypted in transit. Passwords are hashed by our authentication provider and are not visible to us.

No system is perfectly secure, and we cannot guarantee that unauthorised access will never occur.

11. International transfers

Our providers operate in the United States and elsewhere. Using Kalaikona involves transferring your data internationally.

12. Changes

We may update this policy. If we make a material change we will update the date above and, where appropriate, notify sellers directly.

13. Contact

Kalaikona is operated by Kalaikona LLC, a Delaware limited liability company.

Registered address: 8 The Green, Suite B, Dover, DE 19901

Email: support@kalaikona.com