How we handle your data.

Two kinds. What you hand us, and what your browser tells us.

What you give us. Name, email, company, phone if you add it, and whatever you write in a form or an email.

What you try on the home page. The web address, the industry and the sentence you type into the field at the top of the home page, and what we read from that address: the business's name, logo and goods.

What we get automatically. IP address, browser and device, pages viewed, the page you came from, and rough location from the IP address.

What comes with a form. When you send one, we keep the IP address, rough location, browser and device it came from, and how long the page was open, with what you sent, so we can tell a real request from spam.

What the product records. If you use Karo as a customer, the platform stores the operational data your team puts in, under your customer agreement. What the till app, Karo POS, collects is set out in its own section below.

We use personal data for the purposes set out in this section, and not for others.

To answer you when you get in touch or book a demo.

To see which businesses tried Karo on the home page, and to get in touch with them about it.

To run and secure the site.

To keep spam and automated submissions out of our forms.

To understand which pages work and which do not.

To send you what you asked for, and nothing you did not.

To meet bookkeeping and tax obligations under Swedish law.

Under the GDPR we rely on your consent for analytics and marketing email, on contract or steps taken before a contract when you ask for a demo, on legitimate interest for site security and basic product improvement, and on legal obligation for bookkeeping.

We use a small set of processors to run the site and the business. Hosting and analytics, email delivery, meeting scheduling, CRM, and an AI service that reads the sentence you type on the home page to set up the demo. They process data only on our instructions.

We do not sell personal data. We do not trade it.

Some providers sit outside the EU and EEA. Where they do, the transfer rests on the European Commission's standard contractual clauses or an adequacy decision.

The site sets the cookies it needs to work. Nothing else loads until you say so.

Analytics and marketing cookies stay blocked until you consent through the cookie banner. We run that on Cookiebot, with Google Consent Mode set to deny by default.

You can change or withdraw your choice at any time through the banner, and clear cookies in your browser. Declining analytics does not break the site.

This section covers Karo POS, the till app that runs Karo Counter. It matches the privacy details on the app's page in the App Store.

Who decides. Karo Commerce AB is the controller for the staff who use the app at work, and for the app's diagnostics. For the details a business enters about its own customers, the business is the controller and Karo is its processor, under the business's agreement with Karo.

Staff. Name, staff ID and role. The PIN that unlocks the till is kept only as a hash, and it is not stored on the device.

Sales and returns. The products, amounts, payment method, receipt data, time, register and store of every sale and return.

Customers. The name, email and phone number that staff enter for a customer, used for the customer's record and to send receipts by email.

The device. An identifier for the device and a credential of its own, used to pair it with the business's register, and the token that lets the app receive push notifications.

Diagnostics. Crash reports and performance data, linked to the staff ID, so we can find and fix faults. The app removes tokens and pairing codes from a report before it is sent.

Permissions. The camera only scans the QR code that pairs the device, and it keeps no image. Bluetooth and the local network are only used to find receipt printers.

Why. To run the till. To meet Skatteverket's rules for cash registers (SKVFS 2021:17), with a control unit and a journal. To meet the Swedish Bookkeeping Act (Bokföringslagen). And for support, security and fixing crashes. The legal bases are the business's contract with Karo, the legal obligations in the cash register and bookkeeping rules, and our legitimate interest in an app that is secure and works.

What the app does not do. It does not track you across other apps or websites, it shows no ads, and we do not sell the data.

Who receives it. AWS hosts the platform in its EU regions. fiskaly runs the control unit (SIGN SE). Sentry receives the diagnostics, in its EU region in Germany. Expo delivers push notifications. Resend sends receipts by email. Surfboard processes card payments through Karo Pay. Each receives only what its job needs.

How long. Cash register and bookkeeping records are kept for seven years, as Swedish law requires (Bokföringslagen, chapter 7, section 2), also after a business leaves Karo. A business that leaves has 90 days to log in and export its data, and everything else is deleted when the 90 days end.

Your rights in the app. Staff can ask the business they work for, or write to hello@usekaro.io, for a copy of their data or to have it corrected or deleted. A customer of a business asks that business, which decides, and we help it as its processor. Removing a customer in the app deactivates the record and does not erase it, and receipts and cash register records stay for the seven years the law requires.

Contact and demo enquiries, up to 24 months after our last exchange.

The IP address that comes with a form, 90 days.

What you try on the home page, up to 24 months.

Analytics, up to 14 months.

Accounting records, seven years, because Swedish law says so.

Everything else goes when we no longer need it.

You can ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to limit what we do with it, object to processing based on legitimate interest, or ask for it in a portable file.

Consent can be withdrawn at any time and applies from that point forward.

Write to hello@usekaro.io and we will answer within one month.

If you think we handled it badly, you can complain to the Swedish Authority for Privacy Protection, IMY, at imy.se.

When this policy changes we update the date at the top. If a change matters to you, we will say so more loudly than a date.

Karo Commerce AB, Stockholm, Sweden. VAT SE559585281401. hello@usekaro.io