Privacy Policy

Notice at Collection: Retention Periods

We retain the categories of personal information we collect for the length of time necessary to operate our business and to comply with legal obligations or to protect our legal rights.

Notice at Collection: Categories of Personal Information We Sell or Share or Use for Targeted Advertising

When we engage in digital advertising, we may sell the following categories of personal information (according to the broad definition of “sell” under select state privacy laws), share them for purposes of cross-context behavioral advertising, or use them for targeted advertising: personal identifiers (including IP address, mobile advertising IDs) and internet or other electronic activity information. We also use the Shopify platform and Shopify may use the personal information it collects from our Sites to facilitate personalized advertising and share it with third parties (including those that may be located in other countries) in a way that may constitute a sale of personal information or the sharing your personal information for targeted or behavioral advertising. The categories of personal information Shopify collects and may use in this regard are: contact and profile information; device information including IP address, device identifiers, browsers you use; payment information; commercial information about products you view, purchase, review, or rate. For more information about Shopify’s data privacy practices, please see its privacy policy here: https://www.shopify.com/legal/privacy/consumers.

These categories of personal information are sold to or shared for cross-context behavioral advertising or targeted advertising with advertising networks, data brokers and other companies that facilitate or engage in digital advertising. We engage in such sales and sharing to facilitate personalized advertising. We do so by allowing third parties to place cookies or other tracking technologies on our website that may collect information about your online activities over time and across different websites or applications. For more information about the use of cookies and other tracking technologies, see the section “Our Use of Cookies and Analytics” below.

If your state law provides rights to opt-out of such sales and sharing of personal information for cross-context behavioral advertising or targeted advertising, click here to exercise those rights. See U.S. State Data Privacy Rights section below for more information about states with such rights.

We do not sell or share for cross-context behavioral advertising any of the other categories of personal information we collect.

Categories of Third Parties To Whom We Disclose Personal Information

We disclose personal information to the following categories of entities that do not operate as our processors and are not our affiliates: Advertising companies and data brokers and entities operating in those capacities, for purposes of providing advertising and marketing services to us and other parties.

Sources From Which We Collect Personal Information

We collect personal information directly from our customers, website users, social media platforms, and representatives of entities with which we do business or may do business. We also collect personal information from data aggregators and data brokers.

Use or Disclosure of Sensitive Personal Information

We do not collect, use or disclose sensitive personal information to create profiles about or infer characteristics about individuals, or for any purposes other than providing our Services.

No Profiling to Facilitate Decisions with Legal or Other Significant Effects

We do not engage in the automated processing of personal information to create profiles about individuals that are used in furtherance of decisions with legal or other similarly significant effects, such as the provision or denial of financial or lending services, housing, insurance, or access to essential goods or services.

Disclosure of Personal Information For Business Purposes in the Past 12 Months

The following chart describes the categories of personal information we disclosed for a business purpose in the 12 months prior to the date of this Policy:

Business Purposes for Such Disclosures

We disclosed the categories of personal information listed above for the following purposes: to promote and sell our products; operate our rewards program; manage customer, supplier and vendor accounts and relationships; process payments; verify customers’ identities; fulfill orders and transactions; engage in advertising and marketing; operate our IT systems and secure our systems; prevent fraud and other illegal activities; and to obtain professional advice about legal and accounting matters.

Additional Information About How We May Disclose Personal Information and Purposes for Disclosures

We may also disclose your personal information as required or permitted by law to comply with a subpoena or similar legal process or government request, or when we believe in good faith that disclosure is legally required or otherwise necessary to protect our rights and property or the rights, property or safety of others, including to law enforcement agencies, and judicial and regulatory authorities. We may also disclose your personal information to third parties to help detect and protect against fraud or data security vulnerabilities. And we may disclose or transfer your personal information to a third party in the event of an actual or potential sale, merger, reorganization of our entity or other restructuring.

Our Use of Cookies and Other Tracking Technologies

We may use cookies, pixel tags, web beacons and other similar tracking technologies (“tracking technologies”) to automatically collect information through our website. Tracking technologies are small data files placed on your computer, tablet, mobile phone, or other devices that record certain pieces of information when you visit our website. We may use these tracking technologies to help identify irregular behavior, prevent fraudulent activity and improve security, as well as making it possible for you to save your preferences and help us understand how you interact with our website.

We also allow third parties (including Google, Meta and Shopify) to use third party cookies, web beacons, and other storage technologies to collect or receive information about how you interact with our websites and elsewhere on the Internet and use that information to provide analytics and other measurements services, and to deliver and target advertisements tailored to you. Third parties may also use some of these technologies to assist us in determining if you require assistance or are having problems navigating on our websites, and this may include technologies that record your interactions with the website, including without limitation, your keystrokes, mouse clicks, screen touches, and information about when, how and from where you accessed our website.

You may set your browser to notify you when you receive a cookie. Many web browsers also allow you to block cookies. You can disable cookies from your computer system by following the instructions on your browser or at www.youradchoices.com.

We use Google Analytics to evaluate the use of our website. Google Analytics uses cookies and other identifiers to collect information, such as how often users visit a Site, what pages they visit when they do so, and what other websites they visited prior to visiting our website. For information about Google’s privacy practices, please refer to the Google Privacy Policy: https://policies.google.com/privacy?hl=en-US#infocollect.

Notice of Financial Incentive – Our Ka’Chava Rewards Program

Ka’Chava offers consumers the opportunity to participate in our rewards program and our refer a friend program, each of which may provide product discounts in exchange for the collection of the following categories of personal information: first and last name and email address, birthday, social media handle (“Rewards/Referral Information”).

We use this information to operate the program, communicate with participants, and provide you with the associated incentives.

Participation in our rewards or refer-a-friend program is entirely voluntary. You can opt-in by submitting your personal information through the designated sign-up mechanism (e.g., email form or referral portal). You may opt-out at any time by unsubscribing from marketing emails or contacting us as described below.

How the Value of the Incentive is Calculated

We reasonably estimate the value of each registrant’s personal information collected through the rewards and referral programs as under $20, which represents the approximate average value of points received by consumers through points received by registering in the program (separate from points or discounts earned through any product purchases).

Your Rights

You may withdraw from the rewards program at any time. You can do so by clicking the “unsubscribe” link in our emails or by contacting us using the information provided in the “Contact Us” section below.

Personal Information of Minors

Our products and website are not directed to minors under the age of 13 and we do not knowingly sell or share for purposes of behavioral advertising the personal information of minors, including minors under 18 years of age.

SMS Terms and Conditions

Information obtained as part of SMS or text messaging consent will not be shared with third parties or affiliates; it will only be shared with service providers that operate our SMS/text messaging service for the purpose of providing that service.

If you have consented to receive text messages from us, you may receive text messages about discounts or product offerings. Message rates may apply and messaging frequency may vary. You may opt out of text messages by texting STOP to 60782 or click the unsubscribe link where available. For additional information, text HELP to 60782 or email support@kachava.com. Links to our Terms of Service and this Privacy Policy may also be provided.

You agree to provide us with a valid mobile number. If you get a new mobile number, you will need to sign up for the program with your new number.

To the extent permitted by applicable law, you agree that we will not be liable for failed, delayed, or misdirected delivery of any information sent through our text messaging program, any errors in such information, and/or any action you may or may not take in reliance on our program. Additionally, wireless carriers are not liable for delayed or undelivered messages.

Third Party Websites and Platforms

Our website may contain links to third-party websites or platforms, including social media buttons that link to social media platforms. This Policy does not govern how those third parties or social media platforms collect or use personal information and we do not endorse or have control over their practices. The privacy policies and terms of use for those third parties’ websites/apps or social media platforms govern those companies’ privacy practices. We are not responsible for the content or privacy practices of any third-party websites or platforms.

Beans iD, the company that you can interact with to obtain a student or other type of discount, is one of these third-party platforms. Because we do not control Beans iD’s privacy practices, any choices you may make on our website with respect to the processing of your personal information, including to opt-out of certain uses of your information, do not apply to Beans iD webpages you may access through a link on our website. Beans iD may provide its own cookie consent management options.

Securing Your Personal Data

We implement and maintain reasonable security appropriate to the nature of the personal information that we collect, use, retain, transfer or otherwise process. However, there is no perfect security, and reasonable security is a process that involves risk management rather than risk elimination. While we are committed to maintaining a reasonable information security program, no such program can be perfect; in other words, all risk cannot reasonably be eliminated. Data security incidents and breaches can occur due to factors that cannot reasonably be prevented. Accordingly, it cannot be assumed that the occurrence of any given incident or breach results from our failure to implement and maintain reasonable security.

Changes to This Policy

We will review and update this Policy from time to time. If changes are made, we will update the Privacy Policy and reflect the date of such modification in the date above. If the changes are material, you will be notified via a notice on our website.

Accessibility

To make accessibility-related requests or report barriers, please contact us at accessibility@kachava.com.

U.S. State Data Privacy Rights

Consumer Rights Under Comprehensive U.S. State Data Privacy Laws

State privacy laws in the following states give residents of those states various rights with respect to the personal information we collect: California, Colorado, Connecticut, Delaware, Iowa, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia. In addition, Maryland’s privacy law will come into effect after the date of this Policy, on October 1, 2025. The rights provided under these laws are similar in many respects, with some differences from state to state. We list below these rights, noting that not all rights are available under each state’s law:

Right to Know: The right to confirm whether we are processing a resident’s personal information and to access such data. Laws in some states provide the right to know more detailed information.

• California’s privacy law gives residents the right to request the following additional information collected since January 1, 2022: Categories of personal information we have collected about them; categories of sources from which such personal information was collected; categories of personal information that the business sold or disclosed for a business purpose about the consumer; categories of third parties to whom the personal information was sold or disclosed for a business purpose; and the business or commercial purpose for collecting or selling your personal information.

• Privacy laws in Oregon and Minnesota give residents of those states the right to request a list of third party entities to which we have disclosed personal information.

• Maryland’s privacy law gives residents the right to know the categories of third parties to which we have disclosed personal information.

Right to Access / Copy: The right to access or request a copy of the personal information we have collected from the resident, subject to certain exceptions.

Right to Delete: The right to request deletion of their personal information that we have collected from or about the resident and to have such information deleted, subject to certain exceptions.

Right to Correct: The right to request that we correct inaccuracies in personal information, taking into account the nature of personal data and purposes of processing such information.

Rights to Opt Out: Various rights to request that we stop using an individual’s personal information for one or more of the following purposes:

• Sale of Personal Information: The right to request that we stop selling their personal information, consistent with the definition of “sale” in each law.
• Targeted Advertising: The right to request that we stop processing their personal information for targeted advertising, subject to exceptions in some state laws.
• Sharing for Cross-Context Behavioral Advertising: California’s law provides the right to request that we stop sharing personal information for cross-context behavioral advertising.

Please note, California’s law is the only law that applies to all state residents, irrespective of the context in which they interact with us (e.g., a customer, a business contact, a vendor). Laws in other states apply only to people when acting in an individual or household context.

California Shine the Light

With reference to California Civil Code Section 1798.83, also known as the “Shine the Light” law, we allow California residents to opt-out of the disclosure of personal information to third parties for those third parties’ direct marketing purposes. To exercise that opt-out option, click here.

Exercising Your Rights

We will respond to requests from residents of states with data privacy laws that apply to us and will do so with respect to the rights that are provided under the requestor’s state law as of the effective date of that law. The laws in some states listed above may not be in effect as of the date of this Privacy Policy.

To exercise rights to know, access/copy, delete, correct, or know third parties to whom personal information is disclosed, submit a request through our webform or by contacting us at privacy@kachava.com. We will provide a substantive response to these requests within 45 days of the date on which we receive your request. If we require additional information or time to process your requests, we will contact you.

To exercise opt-out rights, submit your request here.

Opt-out Preference Signals and Do Not Track

An opt-out preference signal is sent by a platform, technology, or mechanism on behalf of consumers and communicates a consumer’s choice to opt-out of the sale and sharing of personal information for cross-context behavioral advertising with all businesses that recognize the signal, without having to make individualized requests. The signal can be set on certain browsers or through opt-out plug-in tools.

We recognize the Global Privacy Control (“GPC”) signal for users in California, Colorado, Connecticut, Delaware (as of January 1, 2026), Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, and Texas. We will recognize for Maryland in October 2025, when that state’s privacy law comes into effect. If you are logged into your account when you visit our website with the Global Privacy Control signal enabled, we will recognize your opt-out selection with respect to all personal information we collect about you, including through our mobile application. If you are not logged in when you visit the website, we will only recognize your opt-out preference on the browser and device that transmits the signal. If you would like more information about opt-out preference signals, including how to use them, the Global Privacy Control website has such information (https://globalprivacycontrol.org).

We will respond to opt-out requests as soon as feasibly possible, but no later than 15 business days after receipt of your request. If we require additional information or time to process your requests, we will contact you.

We do not respond to the DNT or “Do Not Track” signal.

Exercising Your Rights Using Authorized Agents

Agents may submit opt-out requests on behalf of individuals under several state data privacy laws; this is not an option that is available under all state data privacy laws, though. California residents have the right to designate an agent to submit all other types of requests.

If your agent submits an opt-out request on your behalf, the agent will need to provide us with your signed permission indicating the agent has been authorized to submit the opt-out request on your behalf. This requirement does not apply to any tool that facilitates the operation of the Global Privacy Control signal. Agents can submit opt-out requests here.

If you are a California resident and you use an agent to submit other types of requests, the agent will need to provide us with your signed permission indicating the agent has been authorized to submit the request on your behalf. You will also be required to verify your identity directly with us or confirm with us that you provided the agent with permission to submit the request. Agents can submit requests on behalf of California residents (other than opt-out requests) here.

Please note that this subsection does not apply when an agent is authorized to act on your behalf pursuant to a valid power of attorney. Any such requests will be processed in accordance with state law pertaining to powers of attorney.

Verification of Requests

When you exercise rights other than opt-out rights, we will take steps to verify your identity. We will ask you for at least two pieces of personal information, depending on the nature of the request, and attempt to match those to information that we maintain or collect about you.

If we are unable to verify your identity with the degree of certainty required, we will not be able to respond to the request. We will notify you to explain the basis of the denial.

When We Do Not Act on a Request – Appeal Process

In some cases, we may not act on your requests (e.g., if we cannot do so under other laws that apply). When this is the case, we will explain our reasons for not providing you with the information or taking the action (e.g., correcting data) you requested.

Additionally, you have the right to appeal our decision by contacting us at privacy@kachava.com within 30 days after your receipt of our decision.

Non-Discrimination

If you exercise any of the rights explained in this Privacy Policy, we will continue to treat you fairly. If you exercise your rights under this Privacy Policy, you will not be denied or charged different prices or rates for goods or services or provided a different level or quality of goods or services than others.

Contact Us

If there are any questions regarding this Privacy Policy or to request a copy of this Privacy Policy in another format you may contact us at privacy@kachava.com.