Privacy Policy

1. Who We Are

Kairo Ventures ("we," "us," "our") is a company registered in the Dubai free zone in Dubai, United Arab Emirates. We operate the Build This Now platform at buildthisnow.com ("the Platform"). This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the Platform.

2. Data We Collect

2.1 Information You Provide

• Account data: email address, full name, and profile avatar when you create an account
• Onboarding preferences: experience level, interests, and motivations you share during onboarding
• Payment data: processed securely by our third-party payment provider — we receive a transaction reference, purchase amount, and confirmation status but never your full card number or bank details
• Support communications: any messages you send us via email

2.2 Information Collected Automatically

• Usage data: pages viewed, build kits browsed, steps completed, and feature interactions
• Device and browser data: IP address, browser type, operating system, screen resolution, and language preferences
• Cookies and local storage: session tokens for authentication, preferences, and anonymous analytics identifiers
• Bot protection data: we use a third-party challenge service on forms to distinguish real users from automated traffic — this service may collect device signals for verification purposes

3. How We Use Your Data

We use your personal data to:

• Create and maintain your account, authenticate your sessions, and secure access to purchased content
• Process purchases and deliver digital build kits you have bought
• Track your build progress so you can resume where you left off
• Personalize your experience based on your onboarding preferences (experience level, interests)
• Send transactional emails: account verification, password resets, and purchase confirmations
• Improve the Platform through aggregated, anonymized usage analytics
• Prevent fraud, abuse, and unauthorized access to the Platform

We do not sell your personal data. We do not use your data for third-party advertising. We do not send marketing emails unless you explicitly opt in.

4. Legal Basis for Processing

We process your data on the following grounds:

• Contract performance: to deliver the services you have purchased or signed up for
• Legitimate interest: to improve our Platform, prevent fraud, and ensure security
• Consent: where required, such as for optional marketing communications
• Legal obligation: to comply with applicable laws and regulations in the UAE

5. Third-Party Service Providers

We use trusted third-party services to operate the Platform. These providers process data on our behalf and are contractually required to protect it. Categories of providers include:

• Authentication and database hosting: secure cloud infrastructure for storing your account and content data
• Payment processing: handles payment transactions — we never see or store your full payment details
• Email delivery: sends transactional emails on our behalf (verification codes, password resets)
• Application hosting: serves the Platform from global edge locations for fast performance
• Bot protection: verifies form submissions are from real users

We do not share your personal data with any third party beyond what is necessary to operate and secure the Platform.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide services. Specifically:

• Account data: retained while your account exists, deleted within 30 days of account deletion
• Purchase records: retained for 7 years to comply with financial record-keeping requirements
• Usage analytics: anonymized and aggregated — individual records are purged after 90 days
• Support emails: retained for up to 2 years, then deleted

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you
• Correction: request correction of inaccurate or incomplete data
• Deletion: request deletion of your personal data (subject to legal retention obligations)
• Portability: request your data in a structured, machine-readable format
• Objection: object to processing based on legitimate interest
• Withdrawal of consent: withdraw consent at any time where processing is consent-based

To exercise any of these rights, email us at hugues@topr.io. We will respond within 30 days. hugues@topr.io.

8. Cookies

We use the following types of cookies:

• Essential cookies: authentication session tokens required for the Platform to function — these cannot be disabled
• Preference cookies: remember your settings such as theme preference (light/dark mode)
• Analytics cookies: help us understand how the Platform is used in aggregate — no personal identification

We do not use advertising or tracking cookies. We do not participate in cross-site tracking or retargeting networks.

9. Data Security

We implement industry-standard security measures to protect your data:

• All data in transit is encrypted using TLS (HTTPS)
• Database access is restricted by row-level security policies — users can only access their own data
• Authentication sessions use secure, HTTP-only cookies that are not accessible to client-side scripts
• Passwords are hashed using industry-standard algorithms — we never store passwords in plain text
• Payment processing is handled entirely by a PCI DSS-compliant provider

While we take every reasonable precaution, no system is completely immune to security threats. In the event of a personal data breach, we will: (a) notify the UAE Data Office within 72 hours of becoming aware of the breach, where required under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021); (b) notify affected users without undue delay where the breach is likely to result in high risk to their rights and freedoms; and (c) take immediate steps to contain and remediate the breach.

10. International Transfers

Your data may be processed in locations outside the UAE, including the United States and the European Union, where our infrastructure providers operate. Such transfers are conducted pursuant to: (a) adequacy decisions issued by the UAE Data Office recognizing the destination country as providing adequate protection; (b) standard contractual clauses or equivalent contractual safeguards agreed with the receiving party; or (c) your explicit consent where required. The specific transfer mechanism applicable to each third-party processor is available upon request by emailing hugues@topr.io.

11. Children's Privacy

The Platform is not intended for anyone under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected data from someone under 18, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on the Platform. The last updated date at the top of this page reflects the most recent revision.

13. Data Protection Contact

Kairo Ventures has designated a data protection point of contact responsible for compliance with the UAE Personal Data Protection Law and other applicable data protection laws. For any privacy-related questions, data subject rights requests, or to request information about the transfer mechanisms applicable to your data, contact us at hugues@topr.io. We will respond within 30 days. If you are located in the EU/EEA and wish to contact an EU representative, please use the same address and mark your email "GDPR — EU Representative Request."

14. California Residents (CCPA/CPRA)

If you are a California resident, certain device signals collected by our bot protection service may constitute sharing of personal information under the California Consumer Privacy Act as amended by the California Privacy Rights Act. You may opt out of this sharing by emailing hugues@topr.io with subject "CCPA Opt-Out". We do not sell your personal information. You have the right to know what personal information we collect, request deletion, and opt out of sharing. We will not discriminate against you for exercising these rights.