1. Information we collect
- Account information — name, email, password (hashed), phone, date of birth, mailing address, and signup intent (buyer or seller).
- Identity & seller verification — government-issued ID and business documents you submit through our seller application, used for compliance and fraud prevention.
- Transactions — orders, refunds, wallet balances, payouts, and tax-related records. Card details are handled by our PCI-compliant payment processor (Stripe); we receive only tokenized references and the last four digits.
- Communications — messages between buyers and sellers, support tickets, and reports of policy violations.
- Device & usage — IP address, device type, browser, app version, crash logs, and pages/actions on KoFaso.
- Cookies & similar tech — to keep you signed in, remember preferences, measure performance, and prevent fraud.
- Location — coarse location from IP, and precise location only when you opt in (for example, to find nearby meet-ups).
2. How we use information
- Operate the marketplace — create accounts, list and discover products, fulfill orders, run wallets and payouts.
- Verify identity, enforce the 18+ age requirement, and meet KYC / anti-money-laundering obligations.
- Prevent fraud, abuse, chargebacks, account takeovers, and unsafe or counterfeit listings.
- Provide customer support, handle refunds, disputes, and meet-up coordination.
- Send transactional messages about your account, orders, and security. Marketing email/SMS only with consent, and you can opt out at any time.
- Improve product quality, run analytics, and comply with legal obligations.
3. Legal bases (for users in regions that require them)
We process your information to perform our contract with you (operating your account and orders), to comply with legal obligations (tax, AML, consumer protection), with your consent (marketing, precise location), and for our legitimate interests in keeping KoFaso safe and improving the service.
4. How we share information
- With sellers and buyers — to complete an order, sellers receive the shipping name, address, and contact needed for delivery; buyers see seller storefront details.
- Service providers — payment processing (Stripe), cloud hosting, email/SMS delivery, analytics, fraud scoring, identity verification, and customer support tooling, each under contractual confidentiality and security obligations.
- Compliance & safety — law enforcement, regulators, or rights-holders when legally required, when needed to investigate fraud or abuse, or to protect users.
- Business transfers — in connection with a merger, acquisition, financing, or sale of assets; the receiving party must honor this policy.
- We do not sell or rent your personal information.
5. Your choices and rights
- Access, update, or delete your account details from Account → Profile.
- Download a copy of your data or request deletion by emailing privacy@kofaso-us.com.
- Unsubscribe from marketing email, manage push notifications, and reply STOP to marketing SMS.
- California (CCPA/CPRA), Colorado, Virginia, and similar U.S. state residents — you have the right to know, access, correct, delete, and limit certain uses of your information, and to appeal a denial. We do not sell personal information or use it for cross-context behavioral advertising.
- Children — KoFaso is not directed to children under 13, and accounts are restricted to users 18 and older. If we learn we have collected information from a child under 13, we will delete it.
6. Data retention
We keep account, transaction, and verification records for as long as your account is active and for the period required to meet tax, accounting, fraud-prevention, and legal obligations (typically up to 7 years for financial records). When data is no longer needed, we delete or de-identify it.
7. Security
We use encryption in transit (TLS), encryption at rest for sensitive fields, hashed passwords, scoped access controls, audit logging, and continuous monitoring. No system is perfectly secure; please use a strong, unique password and enable any additional protections we offer.
8. International transfers
KoFaso is operated in the United States. If you access the service from outside the U.S., your information will be transferred to and processed in the U.S., where data-protection laws may differ from those of your country.
9. Third-party links and integrations
Our service may include links to third-party sites (for example, carrier tracking). Their privacy practices are governed by their own policies; we are not responsible for them.
10. Changes to this policy
We will post material changes in-app or email you at least 7 days before they take effect. The "Effective" date at the top reflects the latest version.
11. Contact
Privacy questions: privacy@kofaso-us.com. Data subject requests: privacy@kofaso-us.com. For order help, please use the in-app Support page.