Privacy Policy

Last updated: [DATE]

1. Introduction

Nacho Kai (“Nacho Kai,” “we,” “us,” or “our”) provides an agency management platform that helps marketing and SEO agencies manage clients, content, search performance, and team operations. This Privacy Policy explains what information we collect, how we use it, the legal bases on which we rely, and the rights you have. It applies to our website at nachokai.com, the Nacho Kai application, and related services (collectively, the “Services”). Nacho Kai is operated by [LEGAL ENTITY NAME], [ADDRESS].

2. Who this policy is for

Our Services are used by agencies (our “Customers”) and their authorized users. Agencies may use the Services to process information about their own clients and, in some cases, those clients' customers. Where an agency uses Nacho Kai to process personal data, the agency is the “controller” of that data and Nacho Kai acts as a “processor” on their behalf. For data we collect about our own Customers and website visitors, Nacho Kai is the controller.

3. Information we collect

Information you provide directly: account and profile details (name, email, role, company), billing and subscription information, content and notes you upload, support and demo/contact-form submissions, and any other information you choose to provide.

Information collected through integrations and APIs: when you connect third-party services (for example Shopify, Google Analytics, Google Search Console, WordPress, Gusto, or others), we receive data from those services as authorized by you. Through Shopify's APIs this may include store information, product and content data, and, depending on the integration scope, order and customer-related data necessary to provide the Services.

Information collected automatically: log data, device and browser information, IP address, usage and analytics data, and cookies or similar technologies.

4. How we use information

We use information to provide, maintain, and improve the Services; to authenticate users and secure accounts; to generate the platform's intelligence features (such as building client profiles and surfacing insights and alerts); to communicate with you about the Services; to process payments; to provide support; to comply with legal obligations; and to detect, prevent, and address fraud or abuse.

5. Legal bases for processing (EEA/UK)

Where applicable, we process personal data on the basis of: performance of a contract; our legitimate interests in operating and improving the Services; your consent (where required, for example certain cookies or marketing); and compliance with legal obligations.

6. How we share information

We share information with service providers and subprocessors who help us operate the Services (for example hosting, database, email delivery, and analytics providers), bound by appropriate confidentiality and data-protection obligations. We may share information to comply with law, enforce our terms, protect rights and safety, or in connection with a business transfer. We do not sell personal information.

7. Shopify data and mandatory data requests

If you install Nacho Kai through Shopify, we process data made available through Shopify's APIs solely to provide the Services. We respond to Shopify's mandatory data-subject and shop-data requests, including deletion requests, via Shopify's compliance webhooks. Merchant and buyer data obtained through Shopify is used only as needed to deliver the Services and is not used for unrelated purposes.

8. Data retention

We retain personal data for as long as needed to provide the Services and for legitimate business or legal purposes. When data is no longer needed, we delete or anonymize it. Customers may request deletion as described below; integration data may also be removed when an integration is disconnected.

9. Your rights

Depending on your location, you may have rights to access, correct, delete, or port your personal data, to object to or restrict certain processing, and to withdraw consent. California residents have rights under the CPRA, including the right to know, delete, correct, and opt out of “sharing” for cross-context behavioral advertising (we do not sell personal information). To exercise rights, contact us at [PRIVACY EMAIL]. If we process data on behalf of an agency (as a processor), please direct requests to that agency; we will assist them as required.

10. International transfers

We may process and store information in countries other than your own. Where required, we use appropriate safeguards (such as Standard Contractual Clauses) for international transfers.

11. Security

We use administrative, technical, and organizational measures designed to protect personal data, including encryption in transit, access controls, and secure infrastructure. No system is perfectly secure, and we cannot guarantee absolute security.

12. Children's privacy

The Services are not directed to children under 16, and we do not knowingly collect personal data from children.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version with a new “Last updated” date and, where required, provide additional notice.

14. Contact

Questions or requests: [PRIVACY EMAIL] or [MAILING ADDRESS].