Privacy Policy

1. Who We Are and What This Policy Covers

Karma3 Labs, Inc. ("the Company," "we," "us," or "our") operates karma3hq.com (the "Site") and provides an AI-powered behavioral trust-scoring API (the "Service") to marketplace operators, fintech platforms, and other businesses ("Customers"). The Company is located at 228 Hamilton Avenue, Floor 3, Palo Alto, CA 94301, and can be reached at [email protected].

This Privacy Policy describes how we handle personal information in two distinct contexts: (a) information collected directly from visitors to karma3hq.com, and (b) behavioral signal data that our Customers submit to the Service on behalf of their end-users. We handle these categories differently, as explained below.

2. Information We Collect

2.1 Site Visitor Information

When you visit karma3hq.com, we collect:

• Contact details you submit voluntarily (name, work email, company, role) through demo-request forms, contact forms, and newsletter sign-ups;
• Technical data collected automatically: IP address and approximate location (city or region), browser type, operating system, pages visited, referral source, and session timing;
• Cookie and similar identifiers (see our Cookie Policy).

2.2 Behavioral Signal Data (Service API)

Our core product processes behavioral signals that Customers submit via API on behalf of the end-users of their platforms. These signals include session-timing patterns, interaction sequences, device characteristics, and transaction-level metadata: the kinds of behavioral features used to distinguish genuine users from fraud actors. We process this data as a data processor under instructions from the Customer, who is the data controller for their end-users' information. We handle Customer-submitted behavioral data under a Data Processing Agreement and do not use it to train machine-learning models without the Customer's explicit written consent.

2.3 Children's Data

karma3hq.com is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has submitted information to us, contact [email protected] and we will delete it promptly.

3. How We Use Site Visitor Information

We use information collected from Site visitors to:

• Respond to demo requests, sales inquiries, and support communications;
• Operate, maintain, and improve karma3hq.com;
• Send product updates and, where required, marketing communications (with your opt-out honored at any time);
• Detect and prevent abuse of the Site;
• Comply with legal obligations.

We do not sell personal information for monetary value. We do not "share" personal information for cross-context behavioral advertising as that term is defined under California law.

4. Sharing of Information

We share Site visitor personal information only with:

• Service providers acting on our behalf (cloud hosting, email delivery, CRM, analytics) under data processing agreements that restrict their use of the data;
• Legal authorities or courts when required by law, legal process, or to protect rights, safety, or property;
• A successor entity in a merger, acquisition, or asset transfer, subject to this Policy.

Customer-submitted behavioral signal data is shared only as necessary to deliver the contracted Service to that Customer.

5. Cookies and Tracking

We use cookies and similar technologies on karma3hq.com to operate the Site, measure traffic, and support our sales and marketing activities. For a full breakdown of cookie categories and your opt-out options, see our Cookie Policy.

6. Data Retention

Site visitor contact information is retained for as long as needed to maintain the business relationship or satisfy legal obligations, and no longer than 36 months of inactivity. Server access logs are retained 90 days, then aggregated. Behavioral signal data processed through the Service API is retained per each Customer's Data Processing Agreement, typically no longer than 12 months from the date of collection unless contractually extended.

7. Security

We apply administrative, technical, and physical safeguards designed to protect personal information, including TLS encryption in transit, access-controlled databases with least-privilege policies, and periodic security reviews. No system is impenetrable; we cannot guarantee absolute security. In the event of a breach affecting your personal information, we will notify applicable parties as required by law.

8. Your General Rights

Depending on your jurisdiction, you may have rights to access, correct, delete, or restrict the processing of your personal information. To submit a request, email [email protected]. We will respond within the timeframe required by applicable law. If your request concerns behavioral signal data submitted by one of our Customers, we will refer you to the relevant Customer as the data controller for that data.

9. California Residents (CCPA / CPRA)

Under the California Consumer Privacy Act ("CCPA") and the California Privacy Rights Act ("CPRA"), California residents have specific rights regarding personal information collected about them. This section supplements the rest of the Policy.

9.1 Categories We Collect

In the past 12 months, we have collected the following categories of personal information defined under Cal. Civ. Code §1798.140 from Site visitors: identifiers (name, email address, IP address); commercial information (service inquiries and demo requests); internet or other electronic network activity (browsing and interaction data on karma3hq.com); professional or employment-related information (company name, job role); and inferences drawn from the above to understand service interest and detect abuse. Behavioral signal data submitted to the Service API by our Customers on behalf of their end-users is processed by the Company as a data processor under Customer instruction and does not constitute the Company's own collection of California consumer personal information.

9.2 Sources, Purposes, Disclosure

We obtain Site visitor information directly from you and through automatic Site instrumentation. We use it to operate the Site, respond to inquiries, improve the Service, and meet legal obligations. We disclose it only to service providers under written contract and to legal authorities where required.

9.3 Your CCPA / CPRA Rights

• Right to Know: request the categories and specific pieces of personal information we have collected about you in the past 12 months.
• Right to Delete: request deletion of personal information we collected from you, subject to legal exceptions.
• Right to Correct: request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: we do not sell personal information; we do not "share" it for cross-context behavioral advertising as defined under CPRA.
• Right to Limit Use of Sensitive PI: we do not use sensitive personal information for purposes beyond those permitted without authorization.
• Right to Non-Discrimination: we will not deny services, charge different prices, or provide a different level of service because you exercised a right.

9.4 How to Exercise

Submit a verifiable request by emailing [email protected] with the subject line "California Privacy Request." Include enough detail for us to verify you are the person whose information is the subject of the request. We respond within 45 days, with a possible 45-day extension for which we will notify you.

9.5 Authorized Agents

You may designate an authorized agent to make a request on your behalf. The agent must provide proof of authorization; we may also require you to verify your identity directly.

9.6 "Shine the Light"

California Civil Code §1798.83 entitles California residents to request information regarding our disclosure of personal information to third parties for direct marketing. We do not disclose personal information for third-party direct marketing.

9.7 Do Not Track and Global Privacy Control

Under the California Online Privacy Protection Act (Cal. Bus. & Prof. Code §22575), we disclose how we respond to "Do Not Track" (DNT) browser signals. Because there is no common industry standard for interpreting DNT signals, we do not currently respond differently to them. We do not authorize third parties to collect personally identifiable information about your activity across different websites when you use the Service. We honor an opt-out preference signal sent by a platform or browser that complies with the CPRA, such as the Global Privacy Control (GPC); when we detect a GPC signal, we treat it as a valid request to opt out of the sale or sharing of personal information for that browser or device.

10. Changes to This Policy

We may update this Policy from time to time. Material changes will be reflected by a new "Last updated" date and, where appropriate, a notice on karma3hq.com.

11. Contact

Questions, requests, or complaints about this Policy can be sent to: