Privacy Policy

Welcome to Kaso. This Privacy Policy explains how PJ Insights (operating as Kaso Intelligence), a self-employed business registered in Quebec, Canada ("we," "us," or "our"), collects, uses, and protects your personal information when you use the Kaso application ("the App").

We are committed to protecting your privacy and complying with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Quebec privacy legislation.

By using the App, you consent to the collection, use, and disclosure of your personal information as described in this Privacy Policy. If you do not agree with our practices, please do not use the App.

Account Data:

• Email address
• Display name
• Password (securely hashed, never stored in plain text)

Profile Data:

• Avatar image (optional)
• Phone number (optional)
• Timezone preferences
• Notification preferences

Dietary Preferences:

• Allergy information (for safety filtering)
• Lifestyle dietary filters (Premium feature)

Shopping Data:

• Shopping basket contents
• Saved items and favorites
• Product swipe history and interactions
• Store preferences

Payment Data:

• On the web, payment processing is handled by our third-party payment processor, Stripe
• In the iOS app, subscriptions are billed to your Apple ID through the App Store (in-app purchase); subscription status is managed by RevenueCat
• We store only your customer ID and subscription status for subscription management
• We do not store credit card numbers or banking information

Usage Data:

• App usage analytics
• Savings tracking statistics
• Feature usage patterns

Device Data:

• Session cookies for authentication
• Guest session ID (for basket migration when creating an account)

Push Notification Data (mobile app):

• Device push token, device platform, and a device identifier — collected only if you enable reminder notifications
• Used solely to deliver the price-alert reminders you set up
• Removed when you disable push notifications or delete your account

Receipt Photos (mobile app):

• Receipt images you choose to scan are processed transiently to extract grocery items for your list
• Text extraction is performed by our OCR provider (OCR.space); Kaso does not store your receipt images after processing

Location Data:

• With your permission, a one-time approximate location lookup to find grocery stores near you
• You may enter a postal code instead; we do not track your location in the background

Mobile App Analytics:

• Usage analytics events (via PostHog) to understand feature usage and improve the App
• No cross-app tracking and no advertising identifier (IDFA) collection

We use your personal information to:

• Provide the Service: Enable core app functionality including price comparison, shopping lists, and dietary filtering
• Personalize Recommendations: Use product affinity scores to suggest relevant deals based on your shopping history
• Process Payments: Manage Premium subscription billing through our payment processor
• Send Notifications: Deliver deal alerts, price-alert reminder push notifications on your device, and app updates (when you have enabled notifications)
• Improve the Service: Analyze usage patterns to enhance features and fix issues
• Provide Analytics: Generate savings insights and shopping statistics (Premium feature)
• Customer Support: Respond to your inquiries and provide assistance

We may share your information with:

• Payment Processors: Stripe (web subscriptions) and Apple (App Store in-app purchases), for subscription billing (see their privacy policies)
• Subscription Management: RevenueCat, to manage iOS in-app subscription status
• Receipt Processing: OCR.space, to extract text from receipt photos you scan (processed transiently; images are not retained by Kaso)
• Analytics Provider: PostHog, for product usage analytics
• Database and Authentication Provider: For secure data storage and user authentication
• Cloud Hosting Provider: For application hosting and delivery
• Legal Requirements: When required by law, court order, or governmental authority

Aggregated Analytics Data:

We may sell or share aggregated, anonymized analytics data with third parties, including grocery industry partners. This data includes:

• Product popularity trends and preferences
• Shopping volume statistics by product category
• Store preference density and regional trends
• Seasonal purchasing patterns

We implement appropriate technical and organizational measures to protect your personal information:

• Row-Level Security (RLS): Database policies ensure users can only access their own data
• Password Hashing: Industry-standard cryptographic hashing for password storage
• HTTPS Encryption: All data transmitted between your device and our servers is encrypted
• PCI DSS Compliance: Payment processing handled by PCI DSS compliant providers (Stripe, Apple)
• Access Controls: Limited access to personal data on a need-to-know basis

While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

We use the following types of cookies and similar technologies:

• Essential Session Cookies: Required for authentication and core app functionality
• Guest Session ID: Temporary cookie to enable basket migration when you create an account

Mobile App: The iOS app uses the PostHog analytics SDK to collect usage events. It does not use third-party advertising SDKs, cross-app tracking, or Apple's advertising identifier (IDFA).

What We Do NOT Use:

• Third-party advertising cookies
• Cross-site tracking technologies
• Social media tracking pixels

We retain your personal information as follows:

• Account Data: Retained while your account is active
• Shopping History: Retained for analytics and personalization features
• Guest Data: Temporary, session-based (deleted when session expires or account created)
• Payment Records: Retained as required for legal and tax purposes
• Push Tokens: Retained until you disable push notifications or delete your account
• Receipt Photos: Not retained — processed transiently and discarded after text extraction

You may request deletion of your personal data at any time by contacting us. Upon account deletion, we will remove your personal information except where retention is required by law.

Under the Personal Information Protection and Electronic Documents Act (PIPEDA), you have the following rights:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information
• Withdraw Consent: Withdraw your consent to certain data processing activities
• Data Portability: Request your data in a portable format
• Complaint: File a complaint with the Office of the Privacy Commissioner of Canada

How to Exercise Your Rights: Contact us at support@kaso.ca with your request. We will respond within 30 days.

If you are a resident of Quebec, you have additional rights under Quebec privacy legislation:

Quebec Consumer Protection Act:

• Right to transparent information about data collection and use
• Protection against unfair contract terms

Law 25 (Act to modernize legislative provisions respecting the protection of personal information):

• Right to data portability in a commonly used technological format
• Right to be informed of automated decision-making
• Right to have personal information de-indexed from search functions
• Enhanced consent requirements for sensitive information

The App is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@kaso.ca. We will take steps to delete such information promptly.

Your personal information may be stored and processed in North America (Canada and/or United States) where our service providers maintain facilities.

Payment data is processed by Stripe, a PCI DSS compliant payment processor. For information about Stripe's data practices, please refer to Stripe's Privacy Policy.

iOS subscription billing is processed by Apple, and subscription status is managed by RevenueCat (see RevenueCat's Privacy Policy). Receipt photos you scan are processed by OCR.space (see OCR.space's Privacy Policy); this processing may occur outside Canada.

By using the App, you consent to the transfer of your information to these jurisdictions, which may have different data protection laws than your jurisdiction.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws.

Notification of Changes: For material changes, we will notify you through the App or via email before the changes take effect. The "Last updated" date at the top of this policy indicates when it was last revised.

Your continued use of the App after any changes indicates your acceptance of the updated Privacy Policy.

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us:

For more information about your privacy rights, you may also contact the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec.