Privacy Policy

Welcome to Kaso. This Privacy Policy explains how PJ Insights (operating as Kaso Intelligence), a self-employed business registered in Quebec, Canada ("we," "us," or "our"), collects, uses, and protects your personal information when you use the Kaso website and the Kaso mobile apps for iOS and Android (collectively, "the App").

We are committed to protecting your privacy and complying with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Quebec privacy legislation.

By using the App, you consent to the collection, use, and disclosure of your personal information as described in this Privacy Policy. If you do not agree with our practices, please do not use the App.

Account Data:

• Email address
• Display name
• Password (securely hashed, never stored in plain text)

Profile Data:

• Avatar image (optional)
• Phone number (optional)
• Timezone preferences
• Notification preferences

Dietary Preferences:

• Allergy information (for safety filtering)
• Lifestyle dietary filters (Premium feature)

Shopping Data:

• Shopping basket contents
• Saved items and favorites
• Product swipe history and interactions
• Store preferences

Payment Data:

• On the web, payment processing is handled by our third-party payment processor, Stripe
• In the iOS app, subscriptions are billed to your Apple ID through the App Store (in-app purchase)
• In the Android app, subscriptions are billed to your Google account through Google Play Billing (in-app purchase)
• On both mobile platforms, subscription status is managed by RevenueCat
• We store only your customer ID and subscription status for subscription management
• We do not store credit card numbers or banking information

Usage Data:

• App usage analytics
• Savings tracking statistics
• Feature usage patterns

Device Data:

• Session cookies for authentication
• Guest session ID (for basket migration when creating an account)

Push Notification Data (mobile app):

• Device push token, device platform (iOS or Android), and a device identifier — collected only if you enable reminder notifications
• Used solely to deliver the price-alert reminders you set up, through Expo's push notification service and, from there, Apple's (APNs) or Google's (FCM) push infrastructure
• Removed when you disable push notifications or delete your account

Receipt Photos (mobile app):

• We access only the photo you capture with the camera or pick from your library for a scan — we never read the rest of your photo library
• That image leaves your device: it is uploaded to our servers and forwarded to our third-party OCR provider, OCR.space, which extracts the text (this processing may occur outside Canada)
• Only the extracted text is returned to your list. The image is handled transiently and used for nothing else — Kaso never stores your receipt photos

Location Data:

• The App requests precise location permission on both iOS and Android, and reads your device's position only at the moment you ask it to find grocery stores near you — never on a schedule, and never in the background (the Android app does not request background-location permission at all)
• On Android you may grant approximate location instead of precise; the App still works, with less exact store distances
• The coordinates are used to rank nearby stores and stay on your device. Only your region and, if you save it, your home postal code are stored on our servers
• You may skip location entirely and enter a postal code instead, or turn the permission off at any time in your device settings

Mobile App Analytics:

• Usage analytics events (via PostHog) to understand feature usage and improve the App
• No cross-app tracking, and no advertising identifier collection — neither Apple's IDFA on iOS nor Google's advertising ID (AAID) on Android

We use your personal information to:

• Provide the Service: Enable core app functionality including price comparison, shopping lists, and dietary filtering
• Personalize Recommendations: Use product affinity scores to suggest relevant deals based on your shopping history
• Process Payments: Manage Premium subscription billing through our payment processor
• Send Notifications: Deliver deal alerts, price-alert reminder push notifications on your device, and app updates (when you have enabled notifications)
• Improve the Service: Analyze usage patterns to enhance features and fix issues
• Provide Analytics: Generate savings insights and shopping statistics (Premium feature)
• Customer Support: Respond to your inquiries and provide assistance

We may share your information with:

• Payment Processors: Stripe (web subscriptions), Apple (App Store in-app purchases on iOS) and Google LLC (Google Play Billing in-app purchases on Android), for subscription billing (see their privacy policies)
• Subscription Management: RevenueCat, to manage in-app subscription status on iOS and Android
• Push Notification Delivery: Expo's push notification service and, through it, Apple (APNs) or Google (FCM), to deliver the reminders you enable
• Email Delivery: Resend, which receives your email address and the contents of the emails we send you — subscription receipts, billing and trial notices, the shopping-list reminders you set up, and a one-time welcome email when you create an account. You can stop the reminders and the welcome email at any time using the unsubscribe link they carry; billing notices are contractual and are always sent
• Receipt Processing: OCR.space, which receives the receipt photo itself in order to extract its text (processed transiently; images are not retained by Kaso)
• Analytics Provider: PostHog, for product usage analytics
• Audience Measurement: Vercel Web Analytics, for aggregate page-view statistics. It sets no cookies, and it loads only after you accept analytics — before you choose, or if you decline, it is not loaded at all
• Supabase: Database and user authentication, for secure data storage and sign-in
• Vercel: Application hosting and delivery
• Background Job Processing: Inngest, which runs our scheduled and queued work — subscription events, billing notices, reminder delivery and the welcome email. To do so it receives, and retains as job history, your account identifier, subscription event details, your email address, and the rendered contents of the email being sent (including its unsubscribe link)
• Rate Limiting and Abuse Prevention: Upstash, which briefly stores your IP address and/or account identifier as a counter so we can block abuse of features such as receipt scanning, feedback and sign-in
• Legal Requirements: When required by law, court order, or governmental authority

Aggregated Analytics Data:

We may share or license aggregated statistics with third parties, including grocery industry partners. This data is aggregated and de-identified before it leaves Kaso, so that it cannot reasonably be used — on its own or combined with other information — to identify you. We never sell information that identifies you. It covers:

• Product popularity trends and preferences
• Shopping volume statistics by product category
• Store preference density and regional trends
• Seasonal purchasing patterns

We implement appropriate technical and organizational measures to protect your personal information:

• Row-Level Security (RLS): Database policies ensure users can only access their own data
• Password Hashing: Industry-standard cryptographic hashing for password storage
• HTTPS Encryption: All data transmitted between your device and our servers is encrypted
• PCI DSS Compliance: Payment processing handled by PCI DSS compliant providers (Stripe, Apple, Google)
• Access Controls: Limited access to personal data on a need-to-know basis

While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

We use the following types of cookies and similar technologies:

• Essential Session Cookies: Required for authentication and core app functionality
• Guest Session ID: Temporary cookie to enable basket migration when you create an account
• Referral Code: If you open an invite link, the invite code it carries is stored for up to 30 days so we can credit the friend who invited you when you create an account. It holds only that code, is read once and then deleted, and is not used to track your activity

Mobile App: The iOS and Android apps use the PostHog analytics SDK to collect usage events. They do not use third-party advertising SDKs, cross-app tracking, Apple's advertising identifier (IDFA), or Google's advertising ID (AAID).

What We Do NOT Use:

• Third-party advertising cookies
• Cross-site tracking technologies
• Social media tracking pixels

We retain your personal information as follows:

• Account Data: Retained while your account is active
• Shopping History: Retained for analytics and personalization features
• Guest Data: Shopping lists created without an account are automatically deleted 7 days after they are created — or sooner, if you create an account and we transfer them to it
• Payment Records: Retained as required for legal and tax purposes
• Push Tokens: Retained until you disable push notifications or delete your account
• Receipt Photos: Not retained by Kaso — forwarded to OCR.space for text extraction and discarded; only the extracted text is kept, in the list you added it to

You may request deletion of your personal data at any time by contacting us. Upon account deletion, we will remove your personal information except where retention is required by law.

Under the Personal Information Protection and Electronic Documents Act (PIPEDA), you have the following rights:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information
• Withdraw Consent: Withdraw your consent to certain data processing activities
• Data Portability: Request your data in a portable format
• Complaint: File a complaint with the Office of the Privacy Commissioner of Canada

How to Exercise Your Rights: Contact us at support@kaso.ca with your request. We will respond within 30 days.

If you are a resident of Quebec, you have additional rights under Quebec privacy legislation:

Quebec Consumer Protection Act:

• Right to transparent information about data collection and use
• Protection against unfair contract terms

Law 25 (Act to modernize legislative provisions respecting the protection of personal information):

• Right to data portability in a commonly used technological format
• Right to be informed of automated decision-making
• Right to have personal information de-indexed from search functions
• Enhanced consent requirements for sensitive information

The App is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@kaso.ca. We will take steps to delete such information promptly.

Stored in Canada. Your account, shopping lists, saved items, preferences and the other information held in your Kaso account are stored in our database, which is hosted in the Montreal, Canada region. The short-lived rate-limiting counters described in Section 4 — which briefly hold your IP address — are kept in Canada as well, in that same region.

Processed partly in the United States. Running the App does involve processing outside Canada. Our application servers run in the United States, so your request data passes through there while a page or an action is being handled, and our analytics provider (PostHog) receives its data in the United States. Resend, which delivers our emails, stores email metadata and logs in the United States, and Inngest, which runs our background jobs, processes them there as well.

Payment data is processed by Stripe, a PCI DSS compliant payment processor. For information about Stripe's data practices, please refer to Stripe's Privacy Policy.

iOS subscription billing is processed by Apple and Android subscription billing by Google (Google Play Billing); on both platforms subscription status is managed by RevenueCat (see RevenueCat's Privacy Policy). Receipt photos you scan are processed by OCR.space (see OCR.space's Privacy Policy); this processing may occur outside Canada.

By using the App, you consent to the transfer of your information to these jurisdictions, which may have different data protection laws than your jurisdiction.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws.

Notification of Changes: For material changes, we will notify you through the App or via email before the changes take effect. The "Last updated" date at the top of this policy indicates when it was last revised.

Your continued use of the App after any changes indicates your acceptance of the updated Privacy Policy.

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us:

For more information about your privacy rights, you may also contact the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec.