Privacy Policy

Last updated: 20 August 2026

This Privacy Policy explains how Data & Web3 Services Pty Ltd (ABN 58 661 415 630), trading as Kifaayat (Kifaayat, we, us, our), collects, uses, stores and discloses your personal information when you use the Kifaayat website at kifaayat.shop, the Kifaayat mobile app, and our related services (together, the Platform).

We are an Australian company. The Platform is available to users in Australia, the United States, the United Kingdom, Canada and New Zealand, and this Policy is designed to meet our obligations under the privacy laws of each of those countries, including the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles, the UK GDPR and Data Protection Act 2018, the California Consumer Privacy Act (as amended) and other applicable US state privacy laws, Canada’s PIPEDA, and the New Zealand Privacy Act 2020. For the purposes of the UK GDPR, Kifaayat is the controller of your personal information.

By using the Platform you acknowledge that your personal information will be handled as described in this Policy. Where the law requires your consent (for example, for certain marketing or cookies), we will ask for it.

Contact for all privacy matters: community@kifaayat.shop

1. What We Collect

Information you give us:

• Account and identity data: name, email address, phone number (verified by one-time passcode), username, password/login credentials, profile details, date of birth or age confirmation (you must be 18+), and identity verification documents where required for seller verification.
• Transaction data: delivery and billing addresses, order details, purchase and sales history, payout details, refund and dispute records.
• Payment data: handled by our payment processors (Stripe, PayPal and, in limited cases, Wise). We do not store your full card details; we receive limited information such as payment confirmation, last card digits and payout account status.
• Content: listing photos and videos, item descriptions, comments, reviews, messages sent through the Platform, and anything else you upload.
• Communications: emails, support tickets (via Freshdesk) and correspondence with our team.

Information collected automatically:

• Usage and device data: IP address, device type and identifiers, operating system, app version, browser type, pages and screens viewed, session times, crash and diagnostic data, and interactions with listings and features.
• Approximate location: derived from your IP address or (with your device permission) your device, used for country/region features such as showing listings in your country and map-based features powered by Mapbox.
• Cookies and similar technologies: see our Cookie Policy for details of the cookies, SDKs and analytics tools we use (including Google Analytics and PostHog) and your choices.

Information from third parties:

• Social and third-party logins: if you sign in with Google or Apple (managed via our sign-in provider, Clerk), we receive information such as your name and email address from that provider.
• Payment and fraud signals: from our payment processors in connection with verification, fraud prevention and disputes.

2. How We Use Your Information

We use personal information to:

• create and manage your account, verify your identity and phone number, and provide the Platform and Services;
• facilitate listings, offers, orders, payments, payouts, shipping coordination, refunds and dispute resolution;
• operate AI-assisted features (see section 3);
• communicate with you about your account, orders and the Platform (service messages, push notifications via OneSignal, SMS one-time passcodes, and transactional emails via Resend);
• send you marketing and newsletters (see section 4);
• personalise your experience, including showing listings relevant to your country and size;
• monitor, analyse and improve the Platform, including analytics, research, troubleshooting and A/B testing;
• maintain safety and security — detecting and preventing fraud, circumvention, scams and breaches of our Terms, moderating content and protecting Members;
• comply with our legal obligations, enforce our Terms & Conditions, establish and defend legal claims; and
• support business operations, including in connection with any merger, acquisition, financing or sale of assets (in which case personal information may be transferred as part of the transaction, subject to this Policy).

Legal bases (UK users). Where UK GDPR applies, we process your personal information on the following legal bases: performance of our contract with you (providing the Platform and processing transactions); our legitimate interests (improving and securing the Platform, preventing fraud, marketing our services in ways you would reasonably expect, and promoting Kifaayat); compliance with legal obligations; and your consent (where required, for example for non-essential cookies or where you opt in to certain communications). You may withdraw consent at any time without affecting prior processing.

3. AI Features and Your Images

As of late-August 2026, the Platform uses third-party artificial intelligence services, including but not limited to Anthropic (Claude), OpenAI and Google (Gemini) to power features such as Magic Assist, which helps generate listing titles, descriptions and details from the photos and information you provide, when you have this enabled.

When you upload images or content to the Platform, and in particular when you use Magic Assist or similar AI features, your images and related listing content may be transmitted to and processed by these AI providers to deliver the feature. These providers process the data under their own terms and privacy policies. Depending on the provider and service tier, submitted content may be retained by the provider for a period (for example, for abuse monitoring) and, in some cases, may be used by the provider to improve their models. We seek to use API arrangements that limit providers’ use of your data to delivering the service, and we do not send AI providers your payment details.

Do not upload images containing sensitive documents or other people’s personal information. If you have questions about AI processing, contact community@kifaayat.shop.

4. Marketing, Emails and Use of Your Content

• Email marketing. When you sign up, you will typically be subscribed to Kifaayat marketing emails and newsletters, sent via Beehiiv and Resend. You can opt out at any time using the unsubscribe link in any marketing email (managed via Beehiiv) or by requesting deletion of your account. We will still send you non-promotional service and transactional messages (for example, order updates and security messages).
• Marketing use of your content. As set out in our Terms & Conditions, photos, videos and listing content you upload to Kifaayat may be used by us for marketing and promotional purposes, including in email marketing and on our social media channels.
• Advertising and remarketing. We and our advertising partners (such as Google and Meta) may use cookies and similar identifiers to measure campaigns and show you Kifaayat ads on other services. See our Cookie Policy for the choices available to you, including consent controls and platform opt-outs.

We comply with applicable anti-spam laws, including the Spam Act 2003 (Cth), the UK PECR, CAN-SPAM (US) and CASL (Canada).

5. Who We Share Personal Information With

We share personal information with:

• Other users: information you make public on the Platform (profile, listings, comments, reviews) is visible to other users; when a transaction occurs, we share the information needed to complete it (for example, the Buyer’s delivery details with the Seller).
• Service providers (processors) that operate parts of the Platform on our behalf:
• Payments: Stripe, PayPal, Wise
• Authentication and phone/OTP: Clerk
• Hosting, storage and infrastructure: Supabase (database and storage), Railway, Vercel, Expo/EAS (app build and updates)
• Analytics: Google Analytics, PostHog
• Communications: Resend (transactional email), Beehiiv (newsletters/marketing), OneSignal (push notifications)
• Monitoring: Sentry (error and crash reporting)
• Maps and location: Mapbox or Google Maps
• AI services: Anthropic, OpenAI, Google (see section 3)
• Customer support: our helpdesk provider (Freshdesk)
• App stores and platform partners (Apple, Google) as needed to distribute and operate the App.
• Professional advisers: lawyers, accountants, auditors and insurers, under duties of confidentiality.
• Government, regulators and law enforcement: where required or authorised by law, to respond to lawful requests, or to protect our rights, users or the public.
• Business transfers: a purchaser or prospective purchaser of our business or assets, with appropriate protections.

We do not sell your personal information for money. Some sharing with analytics and advertising providers may constitute a “sale” or “sharing” under the broad definitions in certain US state laws, see section 10 for your rights and how to opt out.

6. International Transfers

We are based in Australia, and our service providers store and process data in various countries, including the United States. This means your personal information will be transferred to, and held in, countries other than your own, whose privacy laws may differ from those of your country. Where we transfer personal information internationally, we take reasonable steps to ensure it is protected consistently with this Policy and applicable law, including using providers that offer recognised safeguards where possible.

7. Retention

We keep personal information only for as long as needed for the purposes in this Policy, and then delete or de-identify it. As a guide:

• Account data: retained while your account is active, and deleted or de-identified within approximately 30 days after your account deletion request is processed, except as below.
• Transaction, payout and tax records: retained for up to 7 years after the transaction, as required by Australian tax and corporate record-keeping laws.
• Dispute, fraud, safety and enforcement records: retained for as long as reasonably necessary to resolve the matter, protect users, or establish or defend legal claims.
• Marketing suppression records: your opt-out is kept so we can honour it.
• Backups and logs: purged on rolling cycles.

To request deletion of your account and data, contact community@kifaayat.shop (we will verify the email linked to your account) or use any in-app deletion option available.

8. Security

We take reasonable technical and organisational measures to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure; including encryption in transit, access controls, authentication via a dedicated identity provider, and reliance on reputable infrastructure providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please protect your login credentials and notify us immediately of any suspected unauthorised access to your account.

9. Your Rights and Choices (All Users)

Subject to applicable law, you can:

• Access the personal information we hold about you and request a copy;
• Correct inaccurate or incomplete information (much of your information can be updated in your account settings);
• Delete your personal information and your account;
• Object to or restrict certain processing, including direct marketing (opt out any time);
• Port certain information in a structured, machine-readable format;
• Withdraw consent where processing is based on consent; and
• Complain to us first at community@kifaayat.shop, and if unsatisfied, to your privacy regulator (see sections below).

To exercise any right, email community@kifaayat.shop. We may need to verify your identity. We will respond within the timeframe required by applicable law (generally within 30 days; 45 days for certain US state requests, extendable with notice). We will not discriminate against you for exercising your rights. An authorised agent may make a request on your behalf where the law allows, with proof of authority. Note that for personal information you provided directly to third-party platforms (for example Stripe or PayPal), you may also need to contact them directly.

10. Additional Information by Region

Australia. We handle personal information consistently with the Australian Privacy Principles. You may complain to us and, if unresolved, to the Office of the Australian Information Commissioner (OAIC, oaic.gov.au). We will deal with overseas disclosures in accordance with APP 8 as described in section 6.

United Kingdom. In addition to the rights in section 9, UK users have the rights under UK GDPR to object to processing based on legitimate interests, to object absolutely to direct marketing, and rights relating to automated decision-making (we do not make solely automated decisions producing legal or similarly significant effects about you). Our legal bases are set out in section 2. You may lodge a complaint with the Information Commissioner’s Office (ICO, ico.org.uk). We are not established in the EU and do not target the EU; this Policy addresses UK GDPR.

United States (California and other states). Depending on your state, you may have rights to know/access, correct, delete, and opt out of “sale”/“sharing” of personal information and targeted advertising. Categories of personal information we collect are described in section 1 (identifiers; customer records; commercial information; internet activity; approximate geolocation; audio-visual content you upload; and inferences for recommendations); purposes are in section 2; disclosures are in section 5. We do not knowingly collect or sell the personal information of anyone under 18 (the Platform is 18+), and we do not use or disclose sensitive personal information for purposes requiring a right to limit. To opt out of cookie-based “sharing” for advertising/analytics, use the cookie controls described in our Cookie Policy or contact us; where legally required we honour opt-out preference signals such as Global Privacy Control. California residents may exercise “Shine the Light” and CCPA rights by contacting community@kifaayat.shop.

Canada. We handle personal information in accordance with PIPEDA. You may withdraw consent (subject to legal or contractual restrictions and reasonable notice); this may affect our ability to provide the Services. You may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

New Zealand. We handle personal information in accordance with the Privacy Act 2020 and its Information Privacy Principles. You may complain to the Office of the Privacy Commissioner (privacy.org.nz).

11. Children

The Platform is not intended for, and must not be used by, anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided us personal information, contact community@kifaayat.shop and we will take steps to delete it.

12. Third-Party Links and Services

The Platform may contain links to third-party websites and relies on third-party services (listed in section 5) that have their own privacy policies. We are not responsible for the privacy practices of third parties, and we encourage you to review their policies, including: Stripe (stripe.com/privacy), PayPal (paypal.com/privacy), Wise (wise.com/privacy-policy), Clerk (clerk.com/privacy), Supabase (supabase.com/privacy), Google (policies.google.com/privacy), PostHog (posthog.com/privacy), OneSignal (onesignal.com/privacy_policy), Sentry (sentry.io/privacy), Mapbox (mapbox.com/legal/privacy), Resend (resend.com/legal/privacy-policy), Beehiiv (beehiiv.com/privacy), Anthropic (anthropic.com/privacy), OpenAI (openai.com/policies/privacy-policy).

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on the Platform and update the “Last updated” date, and for material changes we will notify you by email or prominent notice before the changes take effect. Please review this Policy periodically.

14. Contact Us

Data & Web3 Services Pty Ltd (ABN 58 661 415 630), trading as Kifaayat

Privacy contact: community@kifaayat.shop

Website: www.kifaayat.shop