Privacy Policy

Effective date: 19 September 2026

Introduction

This Privacy Policy (this "Policy") explains how KarKar Ops LLC ("KarKar", "we", "us", "our") collects, uses, shares and safeguards personal information of users of the KarKar platform (the "Platform").

KarKar Ops LLC is the operator and primary data controller. KarKar IP LLC owns the Platform's intellectual property and, as an affiliate of KarKar Ops LLC under their common parent company KarKar Holding Inc, helps deliver certain Platform notifications (see section 9). When acting in that role, KarKar IP LLC processes personal information solely to deliver those notifications and is bound by this Policy.

This Policy forms part of the KarKar Terms of Service.

1. Information we collect

1.1 Information you give us.

• Identification and contact details — name, email address, telephone number, postal or service address.
• Account credentials, and, if you sign in with Google, the information described in section 5.
• Vehicle information — make, model, year, VIN, licence plate number and state, mileage, and the service history of vehicles you book work on.
• Service and booking information — what you asked for, the offer you accepted, the price, the appointment time and location.
• Messages, photographs and other content you send through the Platform's chat, and free text you enter on a service offer.
• Reviews and ratings you write.
• Customer support correspondence.
• For Technicians: business details, and the identity and banking information Stripe collects in order to pay you.

1.2 Information generated when you use the Platform.

• Payment and transaction records. Card numbers are handled by Stripe, Inc. and are not stored by KarKar.
• Location data used to match you with nearby Technicians and to route a Technician to an appointment.
• Technical and usage data — device type, operating system, browser, IP address, pages viewed, actions taken, timestamps.
• Push notification device tokens, if you enable notifications.
• Cookie, advertising and device identifiers (see section 6).
• The context recorded when you give a consent — see 1.5, which sets it out field by field.

1.3 Information from third parties.

• Vehicle data returned from a licence plate lookup. When you enter a licence plate, we send the plate number and state to a third-party vehicle data service and receive vehicle details back. See section 3.
• Identity and payment-eligibility results from Stripe.
• Google account information, if you sign in with Google (section 5).

1.4 What we collect about a Technician's verification — and what we do not. The published Policy this document replaces said KarKar collects "professional credentials (for Mechanics)". That was not true and the line is deleted. What is true:

• We collect no professional credentials. No licence, certification, registration, qualification, insurance certificate, driving record or background-check result is collected or stored anywhere in the Platform, and none is checked.
• The only verification a Technician passes is Stripe's, on a Stripe Express connected account. Stripe collects and holds whatever identity information its own verification requires, including identity documents and a taxpayer identification number. KarKar does not receive those documents and does not store them.
• What KarKar stores about that verification is exactly five things: the Stripe account identifier, whether that account may accept charges, whether it may receive payouts, whether verification has completed, and when it completed. KarKar also stores the Technician's legal first and last name as Stripe reports it when verification completes.
• Stripe's outstanding-requirements information is read live and never stored. When a Technician opens their dashboard, KarKar asks Stripe what Stripe still needs from them and displays the answer. Nothing about it is written to KarKar's database.
• No background checks are run. Not at onboarding, not later.

1.5 What we record when you give a consent, and why

Some agreements have to be provable years later — that you agreed to receive text messages, that you accepted the terms, that a Technician committed to the warranty standard. When you give one of these consents, KarKar writes a record that cannot be edited or deleted, only added to. This is the one place where we deliberately collect more than we need to run the Platform, and it is worth being exact about it.

Every consent record contains:

• Who you are — your account identifier, your telephone number, or both — your account and the form you submitted
• What you agreed to — the document key, the language and the exact version number of the wording shown to you, kept as a frozen snapshot — the versioned document store
• Whether you granted or withdrew it, and the date and time — the event itself
• Where in the product you did it — sign-up, checkout, the SMS opt-in page, your profile, the warranty setting — the flow you were in
• Your IP address and browser user-agent string — the request
• Approximate location — country, region and city — derived from that IP address, see below
• Your browser's time zone and language — reported by your browser
• A session identifier — random, per browser tab, discarded when the tab closes — generated by us
• A device identifier — random, stored in your browser, see 6 — generated by us

Why. A consent is only worth what can be shown about it. If a bank asks us to prove a card charge was authorised, or a regulator asks us to prove a text-message opt-in was real, "we have a row in a database" is not an answer; the surrounding context is. It also lets us detect an opt-in that was not made by the person it claims to be.

How the location is worked out — and what does not happen. The country, region and city are estimated from your IP address by a service KarKar runs on its own infrastructure, against a MaxMind GeoLite2 database file held locally (section 3.4). Your IP address is not sent to MaxMind, to a geolocation vendor, or to anyone else. The result is approximate — typically the city of your internet provider's equipment, not your address — and it is stored as three plain fields, not as coordinates.

The device identifier is not a fingerprint. It is a random number we generate and store in your browser. It is not derived from your screen, fonts, graphics hardware, audio hardware or any other characteristic of your device, and it cannot identify you on any website other than ours. Clearing your browser's site data removes it, and the next visit generates a new one.

Fields are left empty rather than guessed. If the location lookup fails or your browser does not report something, the record is written with those fields blank. We do not fill them in later and we have not filled them in for past records — every consent taken before this Policy takes effect has these fields empty, because we did not collect them at the time.

Where it is not collected. Consents that do not come from a browser — when you text START or STOP to our number, or when your carrier tells us to stop — carry no browser context at all. The IP address of the message carrier is not yours and we do not record it as though it were.

2. How we use information

• To create and manage accounts, and to authenticate you.
• To match Clients with Technicians, and to enable bookings, quotes and appointments.
• To process payments, place and release card holds, take payment, issue refunds and credit notes, and pay Technicians.
• To send you service messages — booking status, appointment reminders, arrival confirmation, review reminders, payout notices and one-time passcodes.
• To send marketing messages, where you have separately consented.
• To operate the Platform chat, including the automated screening described in section 4 and the translation described in 3.7.
• To review and decide disputes about a job — including by using the chat messages and the photographs and files shared in a chat as evidence, and making that material available to both the Client and the Technician (section 4.9).
• To detect, investigate and prevent fraud, abuse, off-platform solicitation and security incidents.
• To support KarKar staff in operating the Platform, including through AI assistants that process the information described in section 13.6 on our instructions.
• To analyse how the Platform is used and to improve it.
• To measure the effectiveness of our advertising.
• To comply with law, respond to lawful requests, and enforce our agreements.

3. Service providers and other recipients

We share personal information with the following categories of recipient. This list is intended to be complete as at the effective date of this Policy.

3.1 Processors and service providers

• Amazon Web Services, Inc. (AWS) — What it does for us: Cloud hosting, storage, logging, file storage and queuing for the whole Platform, in the United States What it receives: All Platform data, encrypted in transit and at rest
• Stripe, Inc. — What it does for us: Payment processing, card storage, escrow-style holding of funds, payouts to Technicians, and identity verification of Technicians What it receives: Card and bank details, transaction data, name, email, and for Technicians the identity information Stripe's verification requires
• Google LLC — Firebase and Firebase Authentication — What it does for us: Account authentication and identity token verification What it receives: Account identifiers, email address, authentication tokens
• Google LLC — Firebase Cloud Messaging (FCM) — What it does for us: Delivery of push notifications to your phone or browser What it receives: Device push token and the content of the notification
• Google LLC — Google Ads — What it does for us: Advertising measurement, including remarketing What it receives: Cookie and device identifiers, pages viewed, conversion events. Loaded only after you accept cookies
• Google LLC — Google Ads Data Manager — What it does for us: Measuring which advertising led to a completed booking What it receives: A SHA-256 hash of your email address and of your telephone number, together with the conversion event and its value. We do not send Google your email address or telephone number in readable form. See 3.3
• Mailgun Technologies, Inc. — What it does for us: Sending transactional and notification email, including invoices and credit notes What it receives: Your email address, your name, and the contents of the email
• Twilio Inc. — What it does for us: Sending SMS text messages What it receives: Your mobile number and the contents of the message
• Google LLC — Google Cloud Translation — What it does for us: Translating text between languages, so that a Client and a Technician who do not share a language can transact What it receives: The text of chat messages sent through the Platform, and the Platform's own system and interface text. See 3.7
• PostHog, Inc. — What it does for us: Product analytics What it receives: Usage events, device and session identifiers
• Anthropic, PBC (Claude) — What it does for us: AI assistant used by KarKar staff to look up, summarise and analyse Platform records while operating the Platform What it receives: Whatever record a member of staff asks it to work with: account details, bookings, payments and, where a conversation is flagged or in dispute, chat messages. Not used to train Anthropic's models. See 13.6
• PlateToVin (platetovin.net) — What it does for us: Converting a licence plate into vehicle details What it receives: The licence plate number and the state you entered. See 3.2
• SendGrid (Twilio Inc.) — What it does for us: Email delivery What it receives:

3.2 Licence plate lookups — please read this one

When you enter a vehicle's licence plate number and state, KarKar sends those two pieces of information to PlateToVin, a third-party vehicle data service operating at platetovin.net, and receives vehicle details in return. This means your licence plate leaves KarKar and is processed by a company we do not control, under that company's own terms and privacy practices.

You do not have to use the plate lookup. You can enter your vehicle's details manually instead.

3.3 Advertising measurement using hashed identifiers

To measure which advertising leads to a completed booking, KarKar sends Google a SHA-256 hash of the email address and telephone number associated with a booking, together with the fact that a conversion happened and its value. A hash is a one-way transformation: Google cannot read your email address or phone number from it, but Google can match it against its own hashed records of its users.

3.4 Services we run ourselves

Some processing that might look like a third party is in fact performed on KarKar's own infrastructure and does not involve disclosure to anyone else:

• Automated chat screening runs on KarKar's own servers using open-source software (Microsoft Presidio). Message text is analysed inside KarKar's infrastructure. See section 4 and 13.2.
• Geolocation and ZIP-code lookups are performed by a KarKar-operated service using a locally held MaxMind GeoLite2 database file. IP addresses are looked up locally; they are not sent to MaxMind or to any other outside party. This is also the service that estimates the approximate location stored with a consent record (1.5) — using it for that purpose adds no new recipient of your data.
• Message translation is routed through KarKar's own service, but the translation itself is performed by Google. The service that receives the text is KarKar's; the translation backend behind it is Google Cloud Translation, and it is enabled in production. This means text does leave KarKar. It is therefore disclosed as a processor in the table at 3.1 and described in full at 3.7 below, rather than here.

3.5 Other recipients

• To Technicians and Clients, as needed to complete a booking. A Technician receives the Client's name, contact details, service address, and vehicle information. A Client receives the Technician's business and profile information.
• To the other party in a dispute. Where a job is disputed, the chat between the Client and the Technician — including the photographs and files shared in it — may be used as evidence and is made available to both of them (section 4.9).
• To professional advisers, insurers and auditors.
• To regulators, courts or law enforcement, where required by law or to protect rights, property or safety.
• To an acquirer, in connection with a merger, acquisition, financing or sale of assets.

3.6 What we do not do

KarKar does not sell personal information for money. No mobile phone number, SMS opt-in record or consent record is ever sold or shared with any third party for that third party's own marketing.

3.7 Translation — what leaves KarKar, and when

The Platform offers translation so that a Client and a Technician who do not share a language can still agree scope, price and instructions. Translation is live in production, and the following text is sent to Google Cloud Translation:

• The text of chat messages sent between a Client and a Technician through the Platform. Chat messages routinely contain a service address, a vehicle description, a telephone number, an appointment time and other personal information, because that is what the parties need to discuss.
• The Platform's own system messages and interface strings — status notifications, button labels, and similar text. These are not personal to you, but they are listed here so that the description of what is sent is complete.

Google acts as KarKar's processor for this activity: it translates the text on KarKar's instructions and does not use it to build a profile of you. Translation is not advertising, and this transfer is separate from the hashed-identifier upload described in 3.3.

4. Automated screening of Platform chat

This section describes something the Platform does that most users would not expect, so it is set out plainly.

4.1 Every message sent through the Platform's chat is automatically scanned by software. So is free text entered on a service offer. The scan runs on KarKar's own infrastructure.

4.2 What the scan looks for. Telephone numbers (including numbers written out as words), email addresses, physical addresses, names, links and URLs, payment identifiers, and words and phrases indicating an attempt to move the transaction off the Platform or to pay in cash — including the names of common payment apps.

4.3 How much text is scanned at once. The scan does not look at a single message in isolation. It analyses a rolling window of the sender's recent messages together, so that a phone number split across several messages is still detected.

4.4 What is stored. Where the scan finds a match, KarKar stores the match — what was detected, where in the message, and a confidence score — against that message, and marks the conversation as flagged. Where the match is in a service-offer field rather than a chat message, KarKar creates a hidden internal record containing that text so that reviewers can see it. That hidden record is not shown to the Client or the Technician.

4.5 Escalation. KarKar counts flagged messages per sender. Once a sender reaches a threshold — currently three — the account is escalated for closer review.

4.6 Human review. KarKar staff can read messages that have been flagged, in order to review them, to enforce the non-circumvention rules in the Terms of Service, and to detect fraud.

4.7 Why we do this. To enforce section 10 of the Terms of Service (non-circumvention), to protect users from off-platform payment scams, and to preserve the payment protection, review window and dispute process that only apply to on-platform transactions.

4.8 The scan is automated. Being flagged is not by itself a finding of wrongdoing, and no account is closed by the software alone.

4.9 Chat as evidence in a dispute. Separately from the screening above, the chat between a Client and a Technician — the messages and the photographs and files shared in it — may be used as evidence where a job is disputed, and KarKar makes that material available to both parties so that neither is answering something they cannot see. This is disclosed in the same section as the screening because it concerns the same content: the screening is KarKar reading chat to enforce its own rules, and this is KarKar showing chat to the two people who wrote it. Section 16.6 of the Terms of Service and clause 9.6 of the Technician Agreement state the same rule to each party. Chat content, including shared media, is deleted when you ask us to delete your information (7.4) — so material relied on in a live dispute may cease to be available if either party deletes their account while it is running.

5. Signing in with Google

If you choose to sign in with Google, Google shares a limited set of information with us: your email address, whether Google has verified it, your name, and your profile photo. We never receive your Google password, and we do not gain access to your Gmail, Drive, contacts or any other Google service.

We use this information only to create your KarKar account or to sign you in to an existing one. If the email address Google provides already belongs to a KarKar account, we sign you in to that account rather than creating a duplicate.

If your KarKar account has no profile photo, we make a one-time copy of your Google profile photo and store it as your KarKar photo. It is a copy, not a link: changing your photo in Google will not change it on KarKar, and we never replace a photo you have already set yourself. You can change or remove it at any time in your profile.

Google's own handling of your data is governed by Google's Privacy Policy. You can review and revoke KarKar's access at any time in your Google Account settings.

6. Cookies, analytics and advertising

We use cookies and similar technologies to operate the Platform, understand usage, and measure our advertising:

• Essential cookies — required for the Platform to function (authentication, security); always active.
• Analytics — PostHog, to understand usage and improve the Platform.
• Advertising — Google Ads, to measure ad effectiveness (conversion tracking) and to show relevant ads, including remarketing to prior visitors.

The Google Ads tag runs in a restricted, consent-denied mode (Google Consent Mode) until you accept cookies through our consent banner; advertising cookies are set only after you accept. You can decline or withdraw consent at any time in cookie settings, and opt out through Google directly: Ads personalization (adssettings.google.com). Google processes this data as an independent controller under its own Privacy Policy.

Advertising attribution. When you arrive at the Platform we record how you got here — the Google Ads click identifier (gclid, gbraid or wbraid), campaign parameters (utm_*), the referring site and the first page you landed on — in a first-party cookie named kk_attr that lives for up to 90 days. When you create an account or a booking, that record is attached to it, so that the conversion reported under 3.3 can be tied to the advertisement that produced it. This cookie is set whether or not you accepted cookies in the banner, and it is what makes the upload in 3.3 possible.

The hashed-identifier upload described in 3.3 happens server-side and is not controlled by the cookie banner.

The consent device identifier is separate from all of the above, and the banner does not control it. As described in 1.5, when you give a consent we store a random identifier in your browser so that a later dispute can be answered. It is not used for analytics, not used for advertising, never leaves KarKar, and is not shared with Google, PostHog or anyone else. It is stored whether or not you accepted cookies, because it exists to protect the record of what you agreed to rather than to measure or market to you. Clearing your browser's site data removes it.

7. Data security, retention and deletion

7.1 Security. KarKar uses secure cloud infrastructure hosted by Amazon Web Services in the United States, with encryption in transit and at rest. We restrict internal access to personal information to staff who need it.

7.2 Third-party security. While we select trusted partners, we are not responsible for their security practices or service availability. You should review their privacy policies individually.

7.3 Retention.

7.3.1 Financial and tax records: seven years. We keep the financial record of a booking — the amounts, the dates, the payment reference, the commission we took, and the Stripe account identifier of the Technician paid — for seven (7) years from the end of the tax year in which the money moved. Seven years is chosen to cover the six-year federal window for substantial understatement of income and California's four-year window, with margin.

7.3.2 Consent records are append-only. The record described in 1.5 is never edited and never overwritten. Withdrawing a consent does not erase the record of having given it; it adds a second record saying you withdrew, so the history stays readable in both directions. Retention of these records is covered by the `` note above.

7.3.3 Everything else is kept for as long as it is needed for the purposes described in this Policy, and is deleted when you ask us to delete it, as described in 7.4.

7.3.4 What the Platform actually does today. Nothing is deleted automatically on a schedule. The periods above are honoured by hand when a request is made or when records are reviewed. That is stated so that you know what stands behind the commitment.

7.4 Deletion — what we delete, what we keep, and what we cannot reach.

7.4.1 How to ask. Email info@kar-kar.com. There is no self-service delete button in the app or on the website today; every request is handled manually. We respond within the times in 8.2.

7.4.2 What we delete. On a verified deletion request we delete: your profile; your name, telephone number and email address; your addresses, including service and billing addresses; your vehicles and their details; your chat messages and the photographs and files shared in chat; and your reviews.

7.4.3 What we keep, and it is only this. We keep the financial record described in 7.3.1: amounts, dates, the payment reference, the commission, and the Stripe account identifier. We keep it for the seven-year period and for no other purpose. It does not contain your name.

7.4.4 For Technicians: your tax identity is at Stripe, not with us. Because Technicians are paid through Stripe Express connected accounts, Stripe — not KarKar — collects and holds the legal name and taxpayer identification number used for tax reporting, and Stripe files the return. KarKar does not need to keep a Technician's tax identity in order to reconcile payments; the Stripe account identifier is enough. So a Technician's name is inside 7.4.2 and is deleted on request.

7.4.5 Deleting from KarKar does not delete from Stripe. This is the important one. Stripe holds its own records of you as an independent party, under its own terms and its own retention rules. KarKar cannot delete them and does not control them. Payment records, and for Technicians the identity and tax information Stripe collected during verification, remain with Stripe after everything at KarKar has gone. If you want Stripe's records dealt with, you have to take that up with Stripe. We say this plainly because a deletion promise that leaves it out is a promise we could not keep.

7.4.6 The same is true, to a lesser extent, of other recipients listed in section 3 that hold their own copies — for example an email or SMS provider's delivery logs. We will tell you what we know when you ask.

8. Your privacy rights

8.1 You may request access to, correction of, or deletion of your personal information, and may ask us for a copy of it, by contacting info@kar-kar.com. Section 7.4 sets out exactly what a deletion request removes, what is retained, and what KarKar cannot delete because Stripe holds it independently.

8.2 How we respond. We will confirm receipt of your request within 10 business days and respond substantively within 45 calendar days of receiving it. Where we reasonably need more time, we may extend that period by a further 45 days, and we will tell you before the first period ends why we need longer.

8.3 Verification. We will take reasonable steps to verify that a request comes from you before acting on it, and may ask for information to do so. An authorised agent may make a request on your behalf with proof of authorisation.

8.4 California residents (CCPA/CPRA). You have the right to know what personal information we collect, use and disclose; to access it; to correct it; to delete it; to limit the use of sensitive personal information; and to opt out of the "sale" or "sharing" of personal information for cross-context behavioral advertising.

KarKar does not sell personal information for money. Our use of Google Ads advertising cookies, and the hashed-identifier upload described in 3.3, may constitute "sharing" under the CPRA. You can opt out by declining cookies in our consent banner (or withdrawing consent in cookie settings) and through Google's Ads Settings. We will not discriminate against you for exercising any of these rights.

8.5 You may withdraw SMS consent at any time by replying STOP to any message, and marketing email consent by using the unsubscribe link.

9. SMS and text messaging

KarKar operates two separate SMS programs — transactional (service) messages and marketing/promotional messages — and each requires its own separate, independently given consent. By providing your mobile phone number and opting in to a program, you consent to receive only that program's messages from KarKar; opting in to one program does not enroll you in the other. Transactional messages relate to your account and services — including service status updates (offer sent, payment received, technician en route, arrived, or service completed), appointment confirmations and reminders, account notifications, and one-time verification passcodes (OTP). Marketing and promotional messages may include offers, discounts, and news about KarKar services.

Message frequency varies based on your activity. Message and data rates may apply. Reply STOP to any message to unsubscribe, or HELP for assistance. Consent to either program is separate and independent, and consent to either is not a condition of purchasing any goods or services.

No mobile information or phone numbers will be shared with or sold to third parties or affiliates for marketing or promotional purposes. Mobile opt-in data and consent are never sold or shared with third parties for their own marketing. Mobile information may only be shared with subprocessors that directly support our messaging program — for example, our telecommunications provider Twilio, Inc. — and solely to deliver the messages you have requested. You may withdraw consent at any time by replying STOP.

Some notifications — including SMS/text messages — are sent on behalf of the KarKar platform by KarKar IP LLC, a Delaware affiliate of KarKar Ops LLC under their common parent, KarKar Holding Inc. When acting in this role KarKar IP LLC processes mobile information solely to deliver the messages described above and is bound by this Policy; KarKar Ops LLC remains the operator and primary data controller.

10. Children's privacy

The Platform is intended only for individuals aged 18 or older. We do not knowingly collect information from anyone under 18. If we learn that we have, we will delete it.

11. User content

Content you upload (photographs, vehicle images, reviews, chat attachments) may contain personal information and is processed according to this Policy. Such content is licensed to KarKar Ops LLC and KarKar IP LLC as described in section 14 of the Terms of Service.

12. Information about Technicians shown publicly

A Technician's profile, including their business name, photograph, service area, ratings, reviews and any badges KarKar displays, is publicly visible. Technicians should not put personal information in a profile that they do not want shown publicly.

13. Artificial intelligence and automated processing

This section says where the Platform uses artificial intelligence or other automated processing on your information, where it does not, and what — if anything — is decided by software without a person.

13.1 What "AI" means here. By "AI" we mean software that recognises patterns in text or images using a trained statistical model, including machine translation and natural-language recognition. The Platform uses such software in the limited ways set out below. The Platform does not use generative AI or a large language model to talk to you, to write messages to you, or to make decisions about your account. There is no AI chatbot on the Platform: every message you receive in chat is written by the Client or Technician you are talking to, or is a system notice.

13.2 Chat screening (section 4). The automated screening of chat and service-offer text uses open-source natural-language recognition models (Microsoft Presidio with spaCy language models) to spot things such as names, addresses and telephone numbers, alongside fixed word lists. It runs on KarKar's own servers; the text is not sent to any AI provider. Its only output is a flag for a person to look at. Nothing is blocked, deleted or closed by the model.

13.3 Translation (section 3.7). Translation is performed by a machine-translation model operated by Google (Google Cloud Translation). The text listed in 3.7 is sent to Google for that purpose and for no other. Google does not use it to train its models or to build a profile of you.

13.4 Ratings, statistics and risk signals. The Platform computes some figures about you from your own activity on the Platform: a Technician's average rating and reply time, and a Client's average rating; and, for KarKar's support staff only, simple counts of cancellations and unanswered requests over the last 90 days. These are arithmetic, not AI: they are sums and averages of recorded events, and the rules are fixed and the same for everyone. They are described here because they are automated and because some of them are shown to other users.

13.5 No automated decisions with significant effect. No account is suspended, no booking is refused, no payment is withheld and no price is set by software acting alone. Where the Platform flags something (13.2, 13.4), a member of KarKar staff decides what, if anything, happens next.

13.6 AI tools used by KarKar staff. KarKar's staff use AI assistants to help run the Platform — for example to look up an account when answering a support request, to investigate a dispute, to check a payment, or to analyse how the Platform is being used. When they do, the information the assistant is asked to work with — which can include your name, contact details, booking history, payments and, where a conversation has been flagged under section 4 or is in dispute, chat messages — is sent to the company that operates the assistant, which processes it on KarKar's instructions as a processor. The assistant does not act on your account by itself: any change to an account, a booking or a payment is made or approved by a member of staff.

At the date of this Policy that company is Anthropic, PBC (Claude), which is listed in the table at 3.1. Under the commercial terms KarKar uses, Anthropic does not use the information to train its models.

13.7 AI in engineering. KarKar's engineers use AI coding tools to write and review the Platform's software. That work is done on source code and on the test environment, not on the production database, and is not a use of your information.

13.8 If this changes. If the Platform begins to use AI in a way not described here — in particular an AI that talks to you, that makes a decision about you on its own, or that is trained on your information — we will update this section before doing so and, where the law requires it, tell you directly.

14. Disputes about data handling

Disputes about how we handle personal information follow the procedure in section 17 of the Terms of Service. The operational process in section 16 of the Terms of Service concerns money held for a job and does not apply to privacy complaints.

15. Changes to this Policy

We may update this Policy. Material updates will be communicated through the Platform or by email, and the effective date at the top of this document will change. Continued use after an update takes effect constitutes acceptance.

16. Contact

KarKar Ops LLCRegistered office: 8 The Green STE B, Dover, Kent County, DE 19901, USACorrespondence and notices: 4615 Arriba Dr, Tarzana, CA 91356, USAEmail: info@kar-kar.com