Privacy Policy

Merchant Information

• Business name, owner name, and business category
• Phone number (WhatsApp-enabled) and email address
• CNIC or NTN number, if required for verification or billing purposes
• Business address and location information
• Payment information for billing (processed through secure third-party payment gateways; we do not store full card numbers)

Customer Information

• WhatsApp phone number (collected only when a Customer claims a Kard)
• Name (if provided during the claim process)
• Date of birth (if collected as part of merchant-configured claim form)

Usage Data

• Campaign performance metrics: lead counts, redemption rates, claim timestamps
• Device and browser information: IP address, browser type, device type (standard analytics)
• Platform usage patterns: pages visited, features used, session duration

We use collected information for the following purposes:

• To operate, maintain, and improve the Kard.pk Platform
• To deliver WhatsApp digital cards to Customers on behalf of Merchants
• To process payments, generate invoices, and manage billing
• To send platform updates, service notifications, and account-related communications
• To provide analytics and performance insights to Merchants
• To detect and prevent fraud, abuse, and security threats
• To comply with applicable legal obligations

We do NOT sell, rent, or trade personal data to third parties for marketing purposes.

• We use the WhatsApp Business API, provided by Meta Platforms Inc., to deliver digital cards to Customers on behalf of Merchants.
• Customer WhatsApp numbers are used solely for the purpose of Kard delivery and are processed in accordance with Meta's WhatsApp Business API Terms of Service and this Privacy Policy.
• Customer WhatsApp numbers are not shared across Merchants. Each Merchant can only access data related to their own Customers.
• We comply with Meta's Business Messaging policies, including restrictions on content types and messaging frequency.

Storage

• Data is stored on cloud servers that comply with applicable data protection standards.
• We implement reasonable administrative, technical, and physical security measures, including encryption at rest and in transit (TLS/SSL).

Retention

• Merchant account data is retained for the duration of the account plus 1 year after account closure, unless a longer retention period is required by law.
• Customer lead data (phone number, claim details) is retained for 90 days after the claim date, after which it is anonymized or deleted.
• Billing records are retained for the period required by Pakistani tax and financial regulations.

• Data Export: Merchants may request a complete export of their account data at any time through the dashboard or by contacting privacy@kard.pk.
• Deletion: Merchants may request account deletion at any time. Upon deletion, all personal data will be removed within 30 days, except where retention is required by law.
• Correction: Merchants may update their business information through the dashboard at any time.
• Opt-out: Merchants may opt out of non-essential communications. Service-critical notifications (billing alerts, security notices) cannot be opted out of while the account is active.

To exercise any of these rights, contact privacy@kard.pk.

• We use minimal cookies for session management (login state) and basic analytics.
• We do not use advertising cookies, cross-site tracking cookies, or third-party marketing trackers.
• Users may disable cookies in their browser settings. Some Platform features may not function correctly with cookies disabled.

The Platform integrates with the following third-party services:

• WhatsApp Business API (Meta Platforms) — for delivering digital cards to Customers
• Pakistani Payment Gateways — for processing payments (JazzCash, Easypaisa, bank transfer, card payments). Payment data is processed by these providers according to their privacy policies.
• Analytics Services — privacy-respecting analytics for platform operations. No cross-site tracking or personal data sharing with analytics providers.

The Kard.pk Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have inadvertently collected data from a person under 18, we will promptly delete such information.

We may update this Privacy Policy from time to time. Material changes will be communicated to registered Merchants via email. The "Effective Date" at the top of this page will always reflect the date of the most recent version.

Continued use of the Platform after a policy update constitutes acceptance of the revised Privacy Policy.