Privacy Policy

Karmith ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website karmith.com or make a purchase.

This policy is designed to comply with the General Data Protection Regulation (GDPR) for users in the European Economic Area (EEA) and the California Consumer Privacy Act (CCPA) for California residents. By using our website, you acknowledge that you have read and understood this Privacy Policy.

The data controller responsible for your personal data is:

For privacy enquiries, email hello@karmith.com with the subject line "Privacy Request".

3.1 Information You Provide Directly

• Account & Contact: Name, email address, phone number, shipping/billing address.
• Payment: We do not store your full payment credentials. Payment data is processed directly by the payment provider shown at checkout. We retain only limited transaction details required for order records, fraud prevention, and refunds.
• Birth Chart Data: If you use our crystal discovery tool, you may provide your birth date and time. This is used solely to generate your chart and recommend products. We do not use this data for profiling or automated decision-making with legal consequences.
• Communications: Any information you provide when contacting customer support or leaving reviews.

3.2 Information Collected Automatically

• Device & Browser: IP address, browser type and version, operating system, device type, screen resolution, language preference.
• Usage Data: Pages visited, time spent on pages, referral source, click-through data, products viewed, cart activity.
• Cookies & Tracking: See Section 6 for details.

3.3 Information from Third Parties

• Payment Processors: Transaction confirmation, fraud prevention signals.
• Analytics Providers: Aggregated demographic and interest data (anonymized where possible).

Under GDPR Article 6, we process your personal data on the following legal bases:

• Contractual Necessity (Art. 6(1)(b)): Processing your order, shipping, and payment is necessary to fulfill our contract with you.
• Legitimate Interests (Art. 6(1)(f)): Website analytics, fraud prevention, and customer service improvements. We balance our interests against your privacy rights.
• Consent (Art. 6(1)(a)): Marketing emails, personalized advertising (Google Analytics, Facebook Pixel), and non-essential cookies. You can withdraw consent at any time via our Cookie Preferences or by emailing us.
• Legal Obligation (Art. 6(1)(c)): Tax record-keeping, accounting, and compliance with consumer protection laws.

We use cookies and similar technologies to enhance your browsing experience. You can manage your preferences through our Cookie Consent Banner.

For a complete list of cookies, see our Cookie Policy.

We share your data only with trusted service providers necessary to operate our business. We do not sell your personal information to third parties for monetary consideration (CCPA 搂 1798.140(ad)).

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Order & Transaction Data: 7 years (tax and accounting legal requirements).
• Account Information: As long as your account is active. Deleted within 30 days of account closure upon request.
• Marketing Data: Until you withdraw consent or unsubscribe. Unsubscribe links are included in every marketing email.
• Analytics Data: 26 months (Google Analytics default), then anonymized or deleted.
• Customer Support Records: 3 years after the last interaction.
• Birth Chart Data: Stored only if you create an account. Deleted upon account deletion request.

We implement appropriate technical and organizational measures to protect your data:

• Encryption: Data transmitted between your browser and our website is protected using HTTPS. Payment credentials are handled by the payment provider shown at checkout using its security controls.
• Access Control: Role-based access restrictions. Only authorized personnel can access customer data.
• Data Minimization: We collect only the data necessary for the stated purposes.
• Regular Audits: We review our data handling practices regularly.

Despite our efforts, no internet transmission or electronic storage is 100% secure. We cannot guarantee absolute security.

Your data may be transferred to and processed in countries outside your residence, including countries where our hosting, payment, analytics, and customer-service providers operate.

For transfers from the EEA, UK, or Switzerland to the US, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission, where required.
• Third-party providers' participation in frameworks such as the EU-US Data Privacy Framework (where applicable).

You may request a copy of the SCCs by contacting us at privacy@karmith.com.

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights regarding your personal data:

To exercise any of these rights, email privacy@karmith.com. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority (e.g., the ICO in the UK or your national DPA in the EU).

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

12.1 Right to Know

You have the right to request that we disclose:

• The categories of personal information we have collected about you.
• The categories of sources from which the personal information is collected.
• The business or commercial purpose for collecting or selling personal information.
• The categories of third parties with whom we share personal information.
• The specific pieces of personal information we have collected about you.

12.2 Right to Delete

You have the right to request deletion of your personal information, subject to certain exceptions (e.g., completing a transaction, detecting security incidents, complying with legal obligations).

12.3 Right to Correct (CPRA)

You have the right to request correction of inaccurate personal information.

12.4 Right to Opt-Out of Sale / Sharing

We do not sell your personal information. We do not disclose your personal information to third parties for monetary or other valuable consideration. We also do not "share" your personal information for cross-context behavioral advertising (as defined under CPRA). Therefore, no opt-out mechanism is required.

12.5 Right to Limit Use of Sensitive Personal Information (CPRA)

We do not collect sensitive personal information as defined under CPRA (e.g., Social Security numbers, precise geolocation, racial/ethnic origin, biometric data). Birth dates provided for chart readings are not used for profiling or discrimination.

12.6 Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. This means we will not deny you goods or services, charge you different prices, or provide a different level of service solely because you exercised your privacy rights.

12.7 How to Exercise Your CCPA Rights

To exercise your CCPA rights, you may:

• Email us at privacy@karmith.com with "CCPA Request" in the subject line.
• Call us at [Phone Number 鈥?to be added].

We will verify your identity before processing your request. You may designate an authorized agent to make a request on your behalf by providing written authorization and proof of identity.

Over the past 12 months, we have collected the following categories of personal information from consumers:

We do not collect: Protected Classification Characteristics, Biometric Information, Precise Geolocation, or Sensitive Personal Information (as defined under CPRA).

Our website is not intended for children under the age of 13 (or 16 in the EU/EEA). We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at privacy@karmith.com. We will delete such information promptly upon verification.

Some browsers transmit "Do Not Track" (DNT) signals. We currently do not respond to DNT signals because there is no consistent industry standard for interpreting them. However, you can manage your tracking preferences through our Cookie Consent Banner or your browser settings.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or business operations. When we make material changes, we will:

• Post the updated policy on this page with a revised "Last updated" date.
• Notify registered users via email if the changes are material.
• Update the Cookie Consent Banner to re-seek consent where required.

We encourage you to review this page periodically.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We will make every effort to respond to your inquiry within 30 days. For urgent matters, please include "Urgent" in the subject line.