Global Privacy Notice, EU Cookie Policy & Multi-Jurisdiction Disclosures

1. Overview & Dual Role Under Global Data Protection Laws

Modeled on institutional fraud-intelligence and e-commerce operational frameworks (such as Riskified), Kroyon operates in two distinct capacities depending on the context in which personal data is collected:

• Website Visitors & Merchant Workspace Personnel (Kroyon as Data Controller / Business): When you visit kroyon.app or app.kroyon.app, register a Merchant account, configure billing, or communicate with our team, Kroyon acts as the Data Controller (under the EU/UK GDPR) and Business (under the California CCPA/CPRA).
• Merchant E-Commerce Shoppers & Omnichannel Messaging End-Users (Kroyon as Data Processor / Service Provider & Fraud Prevention Controller):
  • In providing Kroyon Converse (omnichannel customer messaging across Facebook Messenger, Instagram Direct, WhatsApp, Web Chat, Voice, and Email) and merchant-specific order management, Kroyon acts strictly as a Data Processor / Service Provider acting on the documented instructions of the respective Merchant.
  • In providing Kroyon Protect (e-commerce checkout fraud detection, COD refusal prevention, and device/IP reputation scoring), Kroyon processes checkout telemetry on behalf of the Merchant and, strictly to the extent necessary to maintain tokenized cross-merchant fraud intelligence and security models, exercises independent controller/business responsibilities under GDPR Article 6(1)(f) and CCPA security exceptions.

2. Categories of Personal Data We Collect & Process

3. Purposes of Processing & Legal Bases (EU / UK GDPR Article 6)

For individuals located in the European Economic Area (EEA), the United Kingdom, and Switzerland, Kroyon relies on the following lawful bases under GDPR Article 6:

1. Legitimate Interests — Fraud Detection, COD Abuse Prevention & Network Security (GDPR Art. 6(1)(f) & Recital 47): Processing checkout telemetry, device fingerprints, IP subnets, and tokenized phone velocity is strictly necessary for the legitimate interests of Merchants and Kroyon in preventing fraudulent transactions, fake Cash-on-Delivery orders, automated bot attacks, and account takeovers. Recital 47 of the GDPR explicitly recognizes the processing of personal data strictly necessary for the purposes of preventing fraud as a legitimate interest.
2. Performance of a Contract (GDPR Art. 6(1)(b)): Processing Merchant account data, workspace configurations, and customer order/chat messages necessary to fulfill customer inquiries, confirm orders, book courier consignments, and generate order status receipts.
3. Compliance with Legal Obligations (GDPR Art. 6(1)(c)): Retaining financial ledger entries, tax/VAT invoices, security audit logs, and responding to lawful data protection or regulatory requests.
4. Consent (GDPR Art. 6(1)(a)): Where required by law for optional analytics/marketing cookies, promotional broadcasts, or explicit voice call initiation. Consent may be withdrawn at any time.

4. EU / EEA, UK & Swiss GDPR Addendum & Data Subject Rights

Primary Infrastructure & International Transfers: Kroyon’s primary production compute and encrypted object storage backups are hosted in Falkenstein (fsn1), Germany (European Union) via Hetzner Online GmbH (ISO/IEC 27001 certified), fronted by Cloudflare’s global edge network. Where personal data is transferred outside the EEA/UK to authorized sub-processors (for example, AI inference providers or regional courier/SMS gateways requested by a Merchant), transfers are safeguarded by the European Commission’s Standard Contractual Clauses (SCCs — Commission Implementing Decision (EU) 2021/914, Modules 2 and 3) and the UK International Data Transfer Addendum (IDTA).

4.1 Your Rights Under the GDPR

Subject to statutory conditions, EEA, UK, and Swiss residents have the right to:

• Right of Access (Art. 15): Obtain confirmation of whether we process your personal data and receive a copy of that data.
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete personal data.
• Right to Erasure / “Right to be Forgotten” (Art. 17): Request deletion of your personal data via our User Data Deletion Portal or by emailing [email protected].
• Right to Restriction & Right to Object (Arts. 18 & 21): Object to processing based on legitimate interests or request restricted processing during a dispute.
• Right to Data Portability (Art. 20): Receive your personal data in a structured, machine-readable JSON/CSV format.
• Automated Decision-Making & Human Review (Art. 22): Kroyon Protect is designed with a human-in-the-loop Case Review queue (REVIEW / VERIFY) so high-risk orders are routed to Merchant analysts or verified via OTP rather than permanently barring consumers without recourse. You may request human review of any automated risk disposition at any time.

You also have the right to lodge a complaint with your local Data Protection Supervisory Authority (such as the German Federal Commissioner for Data Protection and Freedom of Information (BfDI), the Irish DPC, or the UK Information Commissioner’s Office (ICO)).

5. California Privacy Rights Addendum (CCPA / CPRA Notice at Collection)

This section applies to residents of the State of California pursuant to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (CCPA / CPRA, Cal. Civ. Code § 1798.100 et seq.).

5.1 Notice of No “Sale” or “Sharing” of Personal Information

Kroyon does NOT “sell” Personal Information for monetary or other valuable consideration, and Kroyon does NOT “share” Personal Information for cross-context behavioral advertising (as those terms are defined under Cal. Civ. Code § 1798.140(ad) and (ah)), including the Personal Information of minors under 16 years of age. Furthermore, Kroyon does not use or disclose Sensitive Personal Information for any purpose other than the permissible security, fraud-prevention, and service-delivery exceptions specified in Cal. Civ. Code § 1798.121(a) and 11 CCR § 7027(m).

5.2 Statutory CCPA Categories Collected & Disclosed for a Business Purpose in the Preceding 12 Months

5.3 Exercising Your California Privacy Rights

California residents have the right to: (1) Know / Access the specific pieces and categories of Personal Information collected; (2) Delete Personal Information (subject to statutory fraud-prevention and security retention exceptions under Cal. Civ. Code § 1798.105(d)); (3) Correct inaccurate Personal Information; and (4) Non-Discrimination for exercising any CCPA right. To submit a verifiable consumer request (or an Authorized Agent request), use our Self-Service Data Request & Deletion Portal or email [email protected]. We verify requests by matching at least two data points (or three for specific pieces of data) and respond within 45 calendar days.

6. EU & Global Cookie & Device Telemetry Policy

In accordance with Directive 2002/58/EC (the EU ePrivacy Directive) and the GDPR, this Cookie & Device Telemetry Policy explains how Kroyon uses cookies, local storage tokens, and fraud-prevention device signals on our dashboard and on Merchant storefronts where the Kroyon Protect beacon or Kroyon Converse chat widget is deployed.

Zero Third-Party Ad-Tech Trackers: Kroyon does not place third-party advertising pixels, retargeting cookies, or behavioral ad-network trackers on either app.kroyon.app or Merchant storefronts. All cookies and storage entries set by Kroyon are Strictly Necessary for authentication, workspace routing, customer chat continuity, or checkout fraud prevention (exempt from prior banner consent under Article 5(3) of the ePrivacy Directive where strictly necessary to provide a secure checkout service requested by the subscriber/user).

7. Bangladesh Statutory & Regulatory Compliance Declarations

Because Kroyon powers e-commerce fraud prevention, social commerce automation, courier logistics, and digital payments for merchants operating in the People’s Republic of Bangladesh, Kroyon maintains dedicated technical and legal compliance with applicable Bangladesh laws and regulatory directives:

• Cyber Security Act, 2023 & Information and Communication Technology (ICT) Act, 2006 (Bangladesh): Kroyon enforces cryptographic access controls, immutable audit logging, automated prompt-injection & PII-leak filtering (kroyon-security-rs), and strict tenant isolation to prevent unauthorized data access, identity theft, or cyber offenses defined under the Cyber Security Act 2023.
• National Digital Commerce Operation Guidelines, 2021 (Ministry of Commerce, Government of Bangladesh): Kroyon Converse and Kroyon Protect assist merchants in complying with mandatory digital commerce transparency requirements, including:
  • Clear itemization of product price, delivery fee (Inside Dhaka / Sub-Dhaka / Outside Dhaka), and advance vs. COD balance on customer order pages (/o/[token]) and receipts;
  • Verifiable customer order confirmation via OTP, chat confirmation, or public order modification tracking before courier handover;
  • Automated consignment tracking linkage with licensed Bangladesh couriers (Pathao, RedX, Steadfast, eCourier, Paperfly); and
  • Complete auditability of order timestamps, cancellations, and refund/top-up records for at least six (6) years where required by commercial and tax regulations.
• Bangladesh Bank Payment Systems & MFS Security Standards: Kroyon never collects, stores, or logs raw credit/debit card Primary Account Numbers (PAN), CVV/CVC security codes, or Mobile Financial Service (bKash, Nagad, Rocket, Upay) customer PINs or OTPs. All digital payment sessions are redirected to and settled directly by Bangladesh Bank-authorized Payment Systems Operators (PSOs) and gateways such as SSLCOMMERZ, verified server-side via dual MD5 (verify_sign) and HMAC-SHA256 (verify_sign_sha2) cryptographic validation.
• Consumer Rights Protection Act, 2009 (Bangladesh): Kroyon prohibits merchants from using AI personas to misrepresent product specifications, weight, origin, or pricing, and provides shoppers with transparent digital order receipts.

8. Meta Platform Data (Facebook Messenger, Instagram & WhatsApp) Declarations

Kroyon integrates with Meta Platforms, Inc. via the official Facebook Graph API, Messenger Platform, Instagram Messaging API, and WhatsApp Business Platform (Cloud API). In strict compliance with the Meta Platform Terms and Developer Policies:

1. Purpose Limitation: Meta Platform Data (including Page-Scoped User IDs (PSIDs), Instagram-Scoped User IDs (IGSIDs), WhatsApp Business Account IDs, Phone Number IDs, and message payloads) is processed solely to provide customer messaging, order management, and AI assistant services to the specific Merchant Page, Instagram Professional Account, or WhatsApp Business Account that the end-user messaged.
2. Zero Cross-Merchant Commingling or Ad-Targeting of Meta Data: Kroyon never sells, licenses, or transfers Meta Platform Data to data brokers, never uses Meta conversation contents to build cross-merchant advertising profiles, and never uses one Merchant’s Meta Platform Data to train models shared with other Merchants.
3. Immediate Revocation & Automated Deletion: Whenever a Merchant disconnects a Facebook Page, Instagram account, or WhatsApp channel—or when an end-user removes Kroyon via Facebook’s Apps and Websites settings—Kroyon immediately revokes the stored OAuth access tokens and processes automated erasure via our signed Meta Data Deletion Callback (POST https://api.kroyon.app/v1/converse/hooks/meta/data-deletion) and our public User Data Deletion Instructions Page.

9. Data Retention Schedule & Technical Security Architecture

Kroyon retains personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Notice:

• Omnichannel Chat Threads & Voice Recordings: Retained for the active life of the Merchant’s workspace (or shorter if deleted by the shopper via the widget’s Delete from memory control or a Data Deletion request). Upon workspace termination, all conversation data is permanently purged within 30 days.
• Order Risk Evaluations & Tokenized Phone Hashes: Retained for up to 24 months to support merchant chargeback/return dispute resolution and seasonal fraud detection, after which raw identifiers are purged.
• Financial Ledger & Tax Records: Retained for 6 years in compliance with statutory accounting and tax laws.
• Defense-in-Depth Security Controls: All data in transit is encrypted via TLS 1.3; all databases and Hetzner Object Storage backups are encrypted at rest (AES-256); customer phone numbers in Kroyon Protect are tokenized via keyed HMAC-SHA256; and all outbound AI responses pass through our deterministic Rust security engine (kroyon-security-rs) to prevent accidental secret or PII disclosure.