🔒 Privacy Policy

Last Updated: February 9, 2026

DPDP Act Compliant GDPR Ready ISO 27001 Aligned

        Summary: KAK collects behavioral data to help e-commerce brands optimize their advertising. We never sell your personal data. You can request deletion at any time.
    

1. Who We Are

KAK ("Kill Your CAC") is an intent-based audience optimization platform operated by Two Atom. We help e-commerce brands improve advertising efficiency by analyzing visitor behavior and creating smart audience segments.

Data Controller Contact:
Email: privacy@kak.sh
Data Protection Officer: dpo@kak.sh

2. Data We Collect

Data Type	Purpose	Retention
Page views, clicks, scroll depth	Intent scoring	90 days
Cart & checkout events	Conversion tracking	90 days
Email (if provided)	Audience matching	365 days
IP address	Fraud prevention (anonymized)	30 days
Device identifiers	Cross-session tracking	365 days

3. How We Use Your Data

Intent Scoring: Calculate purchase likelihood (0-100) based on behavior
Audience Segmentation: Group visitors by intent level (Hot/Warm/Cold)
Meta Custom Audiences: Sync hashed identifiers for targeted advertising
Analytics: Aggregate insights for brands (never individual profiles)

4. Legal Basis for Processing

Under the Digital Personal Data Protection Act, 2023 (India) and GDPR:

Consent: For marketing and retargeting purposes
Legitimate Interest: For fraud prevention and security
Contract: To provide services to e-commerce brands

5. Third-Party Sharing

Recipient	Purpose	Data Shared
Meta Platforms Inc.	Custom Audience matching	Hashed email, hashed phone only
Cloud Infrastructure (AWS/GCP)	Data storage	Encrypted data

We never sell your personal data to third parties.

6. Your Rights (DPDP Act)

Under Indian law, you have the right to:

✅ Access - Request a copy of your data
✅ Correction - Fix inaccurate information
✅ Erasure - Request deletion of your data
✅ Portability - Receive data in machine-readable format
✅ Withdraw Consent - Opt-out of marketing at any time
✅ Grievance Redressal - Lodge complaints with us

Exercise Your Rights: Email privacy@kak.sh with subject "Data Subject Request" and we'll respond within 30 days.

7. Children's Privacy

In compliance with DPDP Act Section 9:

We do not knowingly collect data from children under 18
Visitors flagged as minors have profiling automatically disabled
Children's data is never synced to advertising platforms
Parents/guardians may request deletion: privacy@kak.sh

8. Data Security

🔐 AES-256 encryption for PII at rest
🔐 TLS 1.3 for data in transit
🔐 SHA-256 hashing before any third-party sharing
🔐 Row-level security for multi-tenant isolation
🔐 Regular security audits and penetration testing

9. Data Retention

Behavioral events: 90 days
Visitor profiles: 365 days from last activity
Consent records: 7 years (legal requirement)
Deleted data: Purged within 30 days

10. Cookies & Tracking

KAK uses first-party, cookieless tracking by default. We store:

localStorage: kak_vid - Anonymous visitor ID
localStorage: kak_session - Session identifier

No third-party cookies. No cross-site tracking.

11. International Transfers

Data may be processed in:

🇮🇳 India (primary)
🇺🇸 United States (Meta API)

All transfers comply with DPDP Act requirements and use Standard Contractual Clauses where applicable.

12. Updates to This Policy

We may update this policy periodically. Material changes will be notified via the platform or email.

13. Contact & Grievance Redressal

Grievance Officer (DPDP Act Compliance):

Email: grievance@kak.sh

Response time: Within 30 days

Data Protection Officer:

Email: dpo@kak.sh