Privacy Policy

KartmaX Technologies Private Limited, together with its affiliates ("KartmaX," "we," "our," or "us"), provides a suite of commerce products for D2C brands: MaX Search, MaX Checkout, MaX Omni, and MaX Commerce (collectively, the "Products").

This Policy explains how we collect, use, disclose, and protect information when you use kartmax.ai or any of the Products — whether you are a Merchant using our Products, an End User interacting with a Merchant's storefront where a Product is deployed, or a visitor to kartmax.ai.

We primarily operate within India and process data in line with applicable Indian law, including the Digital Personal Data Protection Act, 2023, alongside relevant protections for our GCC, UK, and US Merchant base (see Section 11).

Data Controller / Processor Roles

For information collected via kartmax.ai directly, KartmaX is the data controller. For End User data processed through the Products on a Merchant's storefront, the Merchant is generally the data controller, and KartmaX acts as a data processor, handling data per the Merchant's instructions and this Policy.

2.1 Across kartmax.ai and All Products

Depending on your interaction with KartmaX and the Products, we may collect information including account and merchant information such as your name, business name, email address, phone number, business address, tax identification details where applicable, and subscription-related billing information.

We may also collect technical and usage information such as IP address, browser type, device information, session identifiers, cookies, log data, and interactions with our dashboards, websites, and Products.

Where Merchants connect third-party platforms or services, we may receive information through configured integrations, including commerce platform data, catalogue information, inventory information, transaction-related metadata, payment-related information, and logistics or fulfilment data.

2.2 MaX Search

MaX Search improves product discovery and search relevance for Merchant storefronts. It may process search-related information including search queries, keywords, autocomplete interactions, filters applied, clicked search results, product catalogue information, and search performance analytics.

MaX Search primarily uses catalogue and shopper interaction data required to improve search relevance and experience. We do not use Merchant data to train shared or cross-customer AI models unless explicitly authorised by the Merchant.

2.3 Information From Third Parties

We may receive information from third-party services connected by Merchants, including commerce platforms such as Shopify, Magento, and WooCommerce, payment providers, logistics partners, analytics providers, and hosting or infrastructure providers. The information received depends on the integrations configured by the Merchant.

We use collected information to:

• Provide, operate, and improve each Product (search relevance, checkout conversion, order sync, commerce functionality)
• Create aggregated, anonymized insights on Product usage and performance
• Detect, investigate, and prevent fraud, misuse, or security issues
• Respond to Merchant and End User support requests
• Diagnose technical issues and maintain service quality
• Comply with legal and regulatory obligations
• Send service-related notices (e.g., planned maintenance) to Merchant account contacts

We do not use Product data for third-party advertising, and we do not sell personal information.

We respect Merchant ownership of their storefront and customer data. Catalogue, order, and shopper data processed through the Products remain the property of the Merchant. KartmaX processes this data solely to provide and improve the Service, as instructed by the Merchant.

We use cookies on kartmax.ai to understand usage trends. Products embedded in a Merchant's storefront (e.g., Search, Checkout) may use session cookies necessary for core functionality (e.g., maintaining checkout state) and limited persistent cookies for fraud prevention. We do not use Product-level cookies for cross-site advertising.

Disabling cookies may affect functionality (e.g., checkout may not complete without session cookies).

We may share information:

• Within KartmaX: with affiliates and group entities for providing and improving the Service.
• With the Merchant: End User data collected through a Product (e.g., order/delivery details) is inherently shared with the Merchant whose store you're using, as fulfillment requires it.
• With the Merchant's payment gateway (Checkout): for the transaction itself — MaX Checkout does not intermediate payment data.
• For legal compliance: in response to lawful requests from courts, regulators, or law enforcement.
• During business transfers: in connection with a merger, acquisition, or restructuring.

We do not sell personal information.

We retain information only as long as necessary to provide the Products, meet legal obligations, resolve disputes, or enforce agreements.

• Account/Merchant data: retained for the Merchant relationship duration and a reasonable period after termination as required for legal and operational purposes.
• Transaction-linked data (Checkout/Omni): retained per applicable financial record-keeping laws.
• Search/usage logs: retained for a limited period, then anonymized or deleted.

We apply reasonable technical and organizational safeguards, including encryption in transit, access controls, and secure hosting. As MaX Checkout does not handle payment credentials, the scope of sensitive data we hold there is limited by design. No online system is 100% secure, and we cannot guarantee absolute protection.

Breach Notification

In the event personal data is compromised, we will notify the relevant supervisory authority in compliance with applicable law, including within required timeframes where GDPR/UK GDPR applies.

The Products are intended for use by businesses (Merchants) and their adult customers. We do not knowingly collect personal data from individuals under 18 (or under 13 where COPPA applies in the US).

10.1 India — Digital Personal Data Protection Act, 2023

Right to access a summary of processing, correct/update data, request erasure, nominate a representative, withdraw consent, and file a complaint with the Data Protection Board of India.

10.2 UK/EU (GDPR)

Right to access, rectify, erase, restrict, or object to processing; data portability; and to lodge a complaint with a supervisory authority (e.g., the ICO in the UK).

10.3 US (where applicable state laws apply, e.g., CCPA/CPRA)

Right to know, delete, and opt out of sale/sharing of personal information (KartmaX does not sell personal information); right to non-discrimination for exercising these rights.

10.4 GCC

Where applicable, rights under regional frameworks such as the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) may apply.

Requests can be sent to info@kartmax.in and will be acknowledged within a reasonable timeframe.

Given our India, GCC, UK, and US Merchant base, information may be transferred to and processed in countries other than your own. Where required, we apply appropriate safeguards for such transfers in line with applicable law.

The Products may integrate with third-party platforms (Shopify, Magento, WooCommerce, payment gateways, logistics partners). This Policy does not apply to their own data practices; please review their respective privacy policies.

We may update this Policy periodically. Material changes will be notified via email or a notice on kartmax.ai, and the "Last Updated" date will be revised.