Privacy Policy

This Privacy Policy explains how Koarge Inc. ("Koarge," "we," "us," or "our") collects, uses, shares, and protects personal information in connection with our websites and the Koarge checkout service (the "Service"). It forms part of, and should be read together with, our Terms of Service.

To keep the roles clear throughout this policy:

Two roles, and why they matter. This policy covers two different relationships:

Because you are the controller of Your Customers' information, you are responsible for maintaining your own privacy policy and for providing all required notices and obtaining all required consents from Your Customers. This policy does not replace, and is not a substitute for, your own privacy policy.

This policy applies to the Service and our websites. It does not apply to Third-Party Services (such as Stripe or Framer), or to your own website or business, which are governed by their own privacy policies.

We and our providers use cookies and similar technologies (such as pixels, tags, local storage, and device identifiers) on the Koarge website. Cookies are small files stored on your device that help a website function, remember your preferences, and show how the site is used.

Merchant information: We use personal information about you to:

Provide, operate, maintain, secure, and improve the Service and our website;

Create and manage your account and process your subscription and payments;

Communicate with you about your account, transactions, updates, and security or service notices;

Provide customer support and respond to your requests;

Detect, prevent, and investigate fraud, abuse, and security incidents;

Comply with our legal, tax, accounting, and regulatory obligations and enforce our Terms; and

Send you marketing about Koarge, where permitted and with your consent where required (you can opt out at any time).

Marketing communications. We send marketing only in accordance with applicable law — including Canada's anti-spam legislation (CASL) and, where required, your consent — and every marketing email includes an unsubscribe link. Opting out of marketing does not stop transactional or service messages, such as receipts, security alerts, and account notices.

We share personal information only as needed to run our business and provide the Service, and never sell it. We share it in these situations:

With service providers (sub-processors) that host, operate, and support the Service, listed below, who may process personal information only on our instructions and under contract.

With Stripe, to process your subscription and to enable payments through your own connected Stripe account.

Koarge is based in Canada, and we and our sub-processors may store and process personal information in Canada, the European Union (for example, our hosting provider in Germany), and the United States (for example, Stripe, Resend, Amazon Web Services, Google, Meta, Klaviyo, and Atlassian). This means personal information may be transferred to, and processed in, countries other than the one you live in, whose data-protection laws may differ from your own.

When we transfer personal information across borders, we rely on appropriate safeguards required by applicable law, which may include:

Transfers to countries recognized as providing adequate protection (for example, Canada's adequacy status for commercial organizations under EU and UK law);

Standard Contractual Clauses (the EU SCCs and the UK International Data Transfer Addendum) with providers in other countries; and

A provider's certification under a recognized framework, such as the EU–US and UK–US Data Privacy Framework, where applicable.

You may contact us at support@koarge.com to ask about the safeguards we use for a particular transfer. By using the Service, you understand that personal information may be processed in the jurisdictions described above.

We retain personal information for as long as needed to provide the Service, maintain your account, and pursue legitimate business purposes, and for as long as required to meet legal, tax, accounting, and regulatory obligations, resolve disputes, and enforce our agreements.

After your account is closed, we delete or de-identify personal information within 90 days, except where longer retention is required — for example, transaction, billing, and tax records, which we retain for approximately 6–7 years to meet Canadian tax and accounting requirements. Personal information may also persist in secure backups for a limited period until those backups are overwritten on our normal cycle, after which it is deleted.

For Your Customers' information, retention is determined by you as the controller and your configuration. We retain it for as long as needed to provide the Service to you, and we delete or return it in accordance with our agreement with you and your instructions, subject to the legal-retention exceptions above.

We use reasonable technical and organizational measures designed to protect personal information, including encryption in transit (TLS), access controls and authentication, network and infrastructure safeguards, and limiting access to personal information to those who need it to operate the Service.

Payment card details are handled by Stripe, a PCI-DSS–compliant payment provider; Koarge's systems do not receive or store full card numbers. Your Stripe secret API keys are never requested or stored by us.

Merchant-uploaded images and assets stored in Amazon S3 are protected by access controls and are served through access-controlled, signed URLs rather than being publicly accessible.

No method of transmission over the internet or method of storage is completely secure, and while we work to protect personal information, we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

If a security breach affecting your or Your Customers' personal information occurs, we will notify affected parties and authorities as, and within the timeframes, required by applicable law (for example, breaches "of real risk of significant harm" under Canada's PIPEDA, and the 72-hour authority-notification standard under the GDPR).

Depending on where you live, you may have rights to access, correct, update, or delete your personal information; to receive a copy in a portable format; to object to or restrict certain processing; and to withdraw consent where processing is based on consent. You will not be discriminated against for exercising these rights.

You can update much of your account information directly in the Service, or exercise your rights by contacting us at support@koarge.com. We may need to verify your identity before acting. We respond within the timeframes required by applicable law, and some information may be retained where the law permits or requires (see Retention).

To withdraw consent for cookies or marketing, use our cookie-preferences link or the unsubscribe link in our emails; this does not affect processing already carried out or non-consent-based processing.

Your Customers' rights: If one of Your Customers wishes to exercise privacy rights over information processed through your store, they should contact you as the controller, and you are responsible for responding. As your processor, we will provide reasonable assistance to help you meet those requests — for example, by making available the functionality to access, export, correct, or delete the relevant order data, or, where you cannot do so yourself, by acting on your documented instructions. The nature and scope of this assistance are set out further in our Data Processing Agreement. If a Customer contacts us directly, we will generally refer them to you.

As a Canadian company, we handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws, including, where they apply, British Columbia's PIPA, Alberta's PIPA, and Quebec's Law 25.

Canadian residents may access and correct their personal information, and may withdraw consent, subject to legal and contractual limits. We obtain consent where required, use personal information only for the purposes described in this policy, and safeguard it as described in the Security section.

You may contact our Privacy Officer at support@koarge.com with any question, request, or concern. If we do not resolve your concern to your satisfaction, you may contact the Office of the Privacy Commissioner of Canada (or your provincial privacy regulator, such as the Commission d'accès à l'information du Québec).

Where the EU GDPR or UK GDPR applies, Koarge is the controller of Merchant information and a processor of Your Customers' information (for which you are the controller). Our legal bases for processing Merchant information are described in How We Use Information.

Subject to applicable law, you have the right to access, correct, delete, and port your personal information; to restrict or object to processing; and to withdraw consent. You may exercise these rights as described in Your Rights and Choices. You also have the right to lodge a complaint with your local supervisory authority (in the EEA) or the UK Information Commissioner's Office (ICO).

Our processing of Your Customers' personal information on your behalf is governed by a Data Processing Agreement, which forms part of our agreement with you. International transfers are protected by the safeguards described in International Transfers, including Standard Contractual Clauses and the UK Addendum where applicable.

We do not currently maintain an establishment in the EEA or UK. Where legally required, we will designate a representative and provide their contact details in this policy.

Several U.S. states, including California, have comprehensive privacy laws. Where these apply to information we process about residents who interact with us directly (such as Merchants), you may have rights to know, access, correct, and delete your personal information, to receive a copy, and to opt out of targeted advertising and any "sale" or "sharing" of personal information. We do not sell personal information, and we honour opt-outs of targeted advertising and recognized opt-out preference signals such as Global Privacy Control (GPC), as described in Cookies and Similar Technologies.

Where we process a state resident's information on a Merchant's behalf, we act as a service provider / processor and use that information only to provide the Service and on the Merchant's instructions, not for our own purposes.

You will not be discriminated against for exercising your privacy rights. To exercise them, contact us at support@koarge.com.

The Service is intended for business use and is not directed to children. We do not knowingly collect personal information from anyone under 18 years of age (or the applicable age of majority in your jurisdiction). If you believe a child has provided us personal information, contact us at support@koarge.com and we will delete it. You are responsible for ensuring the Service is not used to knowingly collect personal information from children through your store.

We may update this policy from time to time. When we do, we will post the updated version with a new "Last updated" date, and for material changes we will provide additional notice by email or through the Service before the changes take effect. Your continued use of the Service after an update takes effect constitutes acceptance of the updated policy.

If you have any questions, requests, or concerns about this policy or your personal information, contact us at:

Koarge Inc. — Privacy Officer

99 Dalhousie Drive, Winnipeg, Manitoba R3T 3M2, Canada

support@koarge.com