Privacy Policy

Krti is a payment method for merchants in Kuwait, and the Krti app is where shoppers manage their payments, saved cards and offers. This policy explains what personal data we collect through the Krti app, Krti checkout, krti.com and the merchant console, why we collect it, who we share it with, and the choices you have. Questions: [email protected].

What we collect

Your phone number. You sign in with your mobile number and a one-time code we send by SMS. Your phone number is your Krti account.

Profile details you choose to add. Your name, email address, date of birth, gender, preferred language and notification preferences. All of these are optional.

Payments and orders. When you pay a merchant with Krti we keep the order: the merchant, the amount, the items and delivery details the merchant sends us, the offer applied and the payment result. The merchant may also send your name, email and mobile number with the order.

Saved cards. If you save a card, the card number is entered on a secure form and stored by our payment processor, MyFatoorah, which gives us a token in its place. Krti keeps only the token, the card brand, the last four digits and the expiry date. We never see or store your full card number or CVV.

Device information. The app sends an installation identifier, the platform (Android or iOS), the device model, the operating system and app versions, the device language and a push notification token, so we can keep you signed in on that device and send you notifications.

Crash reports. If the app crashes, Firebase Crashlytics (Google) receives a crash report: the device model, operating system, app version and the state of the app when it crashed. We use it only to fix bugs.

Technical data. Our servers log the IP address, time and request of each call for security, fraud prevention and troubleshooting. Krti checkout uses Google Analytics to measure how the payment page is used.

Merchant inquiries. What you send through the “Become a merchant” form: your name, store name, phone number, email, website, sales range and message.

The app does not access your contacts, photos, location, microphone or camera. If you lock the app with Face ID, a fingerprint or your device passcode, the check happens on your device; Krti never receives biometric data.

How we use it

• To sign you in, keep your account secure and stop misuse such as repeated code requests.
• To process your payments, apply offers, handle refunds and show you your orders and savings.
• To save the cards you choose to save, so you can pay with them in one tap.
• To send you notifications about your payments and, if you turn them on, summaries of your savings. You can turn them off in the app or in your device settings.
• To show you offers from Krti merchants.
• To fix bugs, improve the app and meet our legal, accounting and anti-fraud obligations.

We do not sell your personal data, and we do not share it with third parties for their advertising.

Who we share it with

• The merchant you pay receives the order and payment details needed to fulfil your order.
• MyFatoorah, our payment processor, and the banks and card networks it works with process your payments and store your saved cards.
• Our SMS provider delivers your one-time sign-in codes.
• Google Firebase delivers push notifications, provides app configuration and receives crash reports. Google Analytics measures use of the checkout page.
• Amazon Web Services hosts our servers and databases in the European Union (Frankfurt), and Cloudflare protects our websites and API.
• Authorities, when the law or a court requires it, or to protect our users and Krti from fraud.

These providers process your data only on our instructions and only for the purposes above.

Security

All traffic to Krti is encrypted (HTTPS). Data is stored encrypted on servers with restricted access, and the app keeps its sign-in tokens in your device’s secure storage. Payments are processed by MyFatoorah; Krti never sees or stores full card numbers.

How long we keep it

We keep your account data while your account is open. Payment and order records are kept for as long as accounting, tax and anti-fraud rules require, even after your account is deleted. Server logs and crash reports are kept for a limited time and then deleted.

Deleting your account and data

You can ask us to delete your Krti account and its personal data at any time: email [email protected] with the subject “Delete my account” and the phone number of your account. We confirm the request with that number, then within 30 days delete your profile, saved cards (and their tokens at MyFatoorah), devices and sign-in sessions. Payment and order records that the law requires us to keep are kept, unlinked from your profile, for the period required.

In the app you can also delete a saved card, sign out of a device and clear your profile details at any time.

Your choices and rights

You can see and correct your profile in the app, turn notifications on or off, and ask for a copy of your personal data or for its deletion by emailing [email protected].

Children

Krti is not intended for anyone under 18, and we do not knowingly collect data from children.

Changes to this policy

When we change this policy we update the date at the top of this page. For significant changes we also tell you in the app before they take effect.

Contact

Krti, Kuwait City, Kuwait: [email protected].