Karido Website Privacy Policy
(Website)
This policy covers the website; the App has a separate privacy policy.
Last updated and effective date: 29 October 2026 — version website-privacy-2026-10-29-en-v8.
KARIDO, a French société par actions simplifiée with a share capital of €6,800, whose registered office is at Lieu-Dit Autigeon, 558 Chemin de la Rivayrolle, 81500 Lavaur, France, registered under number 107 620 007 R.C.S. Castres (SIREN 107 620 007) (“Karido”, “we”, “us”), runs this website, karido.io, to introduce the Karido app, manage its launch waitlist and offer an optional newsletter. This page explains what we collect and why. If you have any question, email contact@karido.io.
Using the Karido app? Its privacy policy, covering accounts, events and AI gift suggestions, is available in French at https://karido.io/privacy/fr.
1. What we collect
If you join the waitlist, we record the email address you enter, the page language, the “landing” source and the sign-up timestamp. Google Firebase also processes the technical connection data needed to receive and secure the request. If you follow the newsletter sign-up button, you reach a Brevo-hosted form; Brevo processes the information submitted and the double-opt-in status under the notices shown on that form. Karido embeds neither Google Analytics nor advertising tracking scripts on this site. External connections relating to offers are described in section 4.
2. Protection against abuse
We use Firebase App Check with reCAPTCHA Enterprise to protect registration requests against bots and abuse. The Google component loads only after a waitlist form is submitted with a valid email address. Simply browsing the website, including pages without a form, does not trigger it. It then processes the technical signals needed to assess risk and uses the _GRECAPTCHA security cookie, without a visual challenge. Google processes this data on our behalf to provide and secure this service; Karido does not use it for advertising or audience measurement.
3. How we use it
We use a waitlist email only to let you know when Karido launches and to offer early access. If you separately choose the newsletter and confirm double opt-in, we use your address to send it until you unsubscribe. We do not sell this data and disclose it only to providers needed to host, secure and deliver the requested service. We won't send you unrelated marketing.
4. Affiliate links
Website gift profiles include Amazon and Awin (AWIN AG) links. We may earn a commission from purchases through these links, at no extra cost to you. Link references identify the publisher, product, merchant or campaign; Karido does not add your waitlist or newsletter email address. Opening a link may disclose your IP address, browser information, the link and, depending on your browser, the referring page to the network and merchant. An external image may already disclose technical data to its host before you click.
Attribution processing and retention depend on the service and merchant. Awin publisher terms provide for cases of joint controllership; Karido retains its obligations and remains available at contact@karido.io. See the Awin and Amazon notices and the merchant’s policy. Merely opening a link does not constitute consent to non-essential tracking: prior consent remains required where applicable. Waitlist or newsletter sign-up does not replace it.
5. Where your data is stored
Waitlist registrations are stored in Cloud Firestore in the European eur3 multi-region. Firebase Hosting serves the website; these services did not move to OVHcloud with the catalogue. Newsletter registrations are processed by Brevo. The contracting entity for the Google Cloud and Firebase paid services used with our French billing profile is Google Cloud France, 8 rue de Londres, 75009 Paris, France. Telephone: +33 1 42 68 53 00 (from France: 01 42 68 53 00). Firebase Hosting uses a global delivery infrastructure; the eur3 region applies to the database and does not establish an exclusive location for all Google services. Certain services may process data outside the EEA or UK. The Google Cloud Data Processing Addendum and Firebase Data Processing Terms describe the transfer mechanisms applicable to the relevant services. You may request information about these transfers and applicable safeguards at contact@karido.io.
Brevo SAS, established in France, processes newsletter registrations on our behalf. For necessary maintenance and support access from India by Brevo CRM Solutions Private Limited, Brevo confirms the application of the European Commission's Standard Contractual Clauses, module 3, supplemented by the UK International Data Transfer Addendum. For access from the United States by Brevo, Inc., Brevo confirms reliance on the EU–US Data Privacy Framework, including its UK Extension, as well as the same Standard Contractual Clauses and UK Addendum. Transfers to Brevo SAS in France benefit from UK adequacy regulations. You may request information about these safeguards at contact@karido.io.
6. Your rights
Subject to the applicable conditions, you have rights of access, rectification, erasure, restriction, objection and portability, and may withdraw consent without affecting earlier processing. Contact contact@karido.io to exercise them. You may complain to the CNIL at https://www.cnil.fr/fr/adresser-une-plainte or, where the UK GDPR applies, to the ICO at https://ico.org.uk/make-a-complaint/.
7. How long we keep it
We keep a waitlist sign-up until launch, abandonment of that purpose, or your withdrawal, whichever happens first.
For the newsletter, we keep your email address and minimal evidence of registration during the subscription, for no more than three years without relevant voluntary contact from you. Merely opening an email, a message sent by Karido or an administrative update does not extend this period. Withdrawal immediately blocks email campaigns. Data no longer needed is cleaned up within thirty days after an unconfirmed request or withdrawal, except where a documented need arises from an applicable obligation, a dispute or the defence of legal claims.
We keep a separate minimal suppression record for at least three years after withdrawal and then review whether it is still needed. It is used only to honour your choice, with no automatic resubscription. A new subscription must follow a new voluntary request from you; importing contacts or an old consent indicator is not sufficient.
8. Changes
If this policy changes, we'll update this page; the date above always reflects the latest version.
9. Representative
Karido appointed Prighter Ltd as its UK representative under Article 27 UK GDPR by a letter signed on 9 October 2026. To contact it or exercise your rights through it, visit https://app.prighter.com/portal/15782771341. This is not a Data Protection Officer appointment.
10. Legal bases
Waitlist registration and newsletter delivery each rely on your consent, which you may withdraw at any time. Processing necessary for form security and abuse prevention relies on our legitimate interest in protecting the service and its users. The security tracker is used exclusively for this protection, which is strictly necessary for the requested service, and therefore does not require cookie consent. Limited retention of an objection serves to honour your choice and meet applicable obligations.