Zone OS CRM LLC ("KaribaOS", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit kariba-os.co and subscribe to or operate a workspace on the KaribaOS B2B SaaS platform.
1. Information We Collect
- Personal & Account Data: Name, email address, shipping/billing address, and telephone number voluntarily provided during account registration, checkout, or concierge inquiries.
- Technical & Security Telemetry: IP address, browser user-agent, cryptographic clickwrap hashes (ESIGN / UETA audit seals), and anti-fraud country signals used to protect merchant and consumer accounts.
- Non-Custodial Financial Data: Neither KaribaOS nor KaribaOS stores raw credit card numbers or CVV codes. All payment credentials are tokenized directly by PCI-DSS Level 1 processors (Stripe, PayPal, or authorized regional gateways).
2. How We Use Your Information
- Create and authenticate your account and enforce zero-trust workspace isolation.
- Process orders, Print-on-Demand fulfillment, and direct non-custodial settlements.
- Send transactional order confirmations, shipping updates, and security verification codes.
- Comply with statutory tax retention (4-year tax hold), anti-fraud, and IP/DMCA obligations.
3. Controller / Processor Relationship
For B2B SaaS brand owners subscribing on kariba-os.co, Zone OS CRM LLC acts as Data Controller for your SaaS subscription account and Data Processor for your storefront workspace infrastructure. Each independent storefront merchant acts as the sole Merchant of Record and Data Controller for its own retail shoppers.
4. Statutory Data Subject Rights (GDPR, UK GDPR, CCPA/CPRA, LGPD, Guyana DPA 2023)
Depending on your jurisdiction, you have the right to request portable export or erasure of your personal data via our automated 3-Point Verification & 6-Digit Email OTP Privacy Portal (/api/compliance/dsar):
- Brazil (LGPD): 15-day statutory response window.
- EU / EEA / UK (GDPR) & Guyana (DPA 2023): 30-day statutory response window.
- United States (CCPA / CPRA): 45-day statutory response window.
- Tax Retention Carve-Out: When erasure is requested on a completed commercial order, operational PII is tombstoned immediately while non-personally-identifiable financial ledger totals are isolated in an encrypted, client-inaccessible 4-year tax hold archive as required by law.
Contact & Privacy Officer
For privacy questions or Data Subject Access Requests concerning KaribaOS, contact: legal@zone-os.co.
Zone OS CRM LLC, Essex County, New Jersey, USA