Legal

Privacy Policy for Kepo

How we handle information for Kepo.

Privacy Notice

Last updated: June 9, 2026

This Privacy Notice explains how Nansha Digital, as the publisher of Kepo ("Kepo," "we," "us," or "our"), collects, uses, stores, discloses, and otherwise processes information when you use our services ("Services"). This includes when you download or use the Kepo mobile application, use another application that links to this notice, or interact with us through support, sales, marketing, events, or related communications.

Please read this notice carefully. It explains your privacy choices and rights. If you do not agree with the practices described here, please do not use the Services. Questions can be sent to [email protected].

Summary of Key Points

  • We may process personal information depending on how you use the Services, the features you choose, and the information you provide.
  • We do not process sensitive personal information.
  • We do not collect, retain, or store face data. Photos submitted for searches are sent directly to a third-party image search provider and are not stored by Kepo.
  • We may receive limited information from third-party providers that help us operate and deliver the Services.
  • We process information to provide, maintain, improve, secure, and administer the Services, communicate with you, prevent fraud, comply with legal obligations, and process information with your consent where required.
  • We share information only in the situations described in this notice and with specific categories of service providers or third parties.
  • Your rights depend on your location and applicable privacy laws.
  • You can exercise privacy rights by contacting us at [email protected].

Table of Contents

1. What Information Do We Collect?

Personal Information You Provide

In short: we collect personal information that you choose to give us.

You may provide personal information when you request information about Kepo, contact us, use features within the Services, participate in Service activities, or otherwise communicate with us.

Sensitive information: we do not process sensitive personal information.

Payment data: if you make a purchase, payment information needed to complete the transaction may be collected and processed. Payment data may include details such as your payment instrument number and related security code. Payment processing is handled by Apple Inc. You can review Apple's privacy information at https://www.apple.com/legal/privacy/en-ww/.

All personal information you provide should be accurate, complete, and up to date. Please notify us if your information changes.

Application Data

When you use the Kepo application, we may collect or access the following information if you choose to grant permission:

  • Mobile device data, such as device ID, model, manufacturer, operating system, system configuration, application identifiers, browser type and version, hardware model, internet service provider, mobile carrier, IP address or proxy server, phone network, mobile platform, unique device ID, and information about app features you use.
  • Mobile device access permissions, such as camera, storage, and other device features needed for app functionality. You can change these permissions in your device settings.
  • Push notification permission, which may allow us to send account-related or feature-related notifications. You can turn these notifications off in your device settings.

This information is mainly used to keep the application secure and operational, troubleshoot issues, and support internal analytics and reporting.

Information Collected Automatically

In short: certain technical information is collected automatically when you visit, use, or navigate the Services.

This information does not directly identify you by name or contact details, but it may include device and usage information such as IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, approximate location, dates and times of use, and other technical details.

The information we collect may include:

  • Log and usage data, such as service, diagnostic, usage, and performance information collected when you access or use the Services. This may include IP address, device details, browser type and settings, date and time stamps, pages or files viewed, searches, selected features, system activity, crash reports, and hardware settings.
  • Device data, such as information about the computer, phone, tablet, or other device used to access the Services. Depending on the device, this may include IP address or proxy server, device and application identifiers, location, browser type, hardware model, internet service provider, mobile carrier, operating system, and system configuration.

When you run a search, the photo you submit is transmitted directly to Tech Solutions - Belize, a third-party image search service, so it can identify visually similar images from publicly available sources. Kepo does not store, retain, or separately process the submitted photo. The third-party image search provider handles the photo under its own privacy policy.

This process is similar in function to reverse image search services such as Google Images.

Kepo does not create or keep records of uploaded photos, does not use those photos for advertising or analytics, and does not connect submitted photos to your identity.

3. How Do We Process Your Information?

In short: we process information to operate, improve, protect, and administer the Services, communicate with you, prevent fraud, comply with law, and process information for other purposes when we have your consent.

Depending on how you interact with the Services, we may process information to:

  • understand usage patterns and improve how the Services work;
  • maintain, troubleshoot, and secure the Services;
  • communicate with you about support, account, or Service-related matters;
  • prevent misuse, fraud, security incidents, or harmful activity;
  • comply with applicable laws and legal processes;
  • protect a person's vital interests when necessary, such as in situations involving potential harm.

In short: we process personal information only when we believe there is a valid legal basis under applicable law, such as consent, contractual necessity, legitimate interests, legal obligations, or vital interests.

EU and UK Users

If you are in the European Union, European Economic Area, or United Kingdom, we may rely on the following legal bases under the GDPR or UK GDPR:

  • Consent, when you have allowed us to process your personal information for a specific purpose. You may withdraw consent at any time.
  • Legitimate interests, when processing is reasonably necessary for our business interests and those interests do not override your rights and freedoms. For example, we may analyze how the Services are used so we can improve them and support user engagement.
  • Legal obligations, when processing is necessary to comply with law, cooperate with authorities, exercise or defend legal rights, or disclose information as evidence in legal proceedings.
  • Vital interests, when processing is necessary to protect your vital interests or those of another person.

Canadian Users

If you are in Canada, we may process your information when you give express consent or when consent can reasonably be implied. You may withdraw consent at any time.

In limited circumstances, Canadian law may allow processing without consent, including when:

  • collection is clearly in an individual's interest and consent cannot be obtained in time;
  • processing is needed for investigations, fraud detection, or fraud prevention;
  • processing relates to a business transaction and legal conditions are met;
  • information appears in a witness statement needed to assess, process, or settle an insurance claim;
  • processing is needed to identify injured, ill, or deceased persons or communicate with next of kin;
  • there are reasonable grounds to believe an individual has been, is, or may become a victim of financial abuse;
  • seeking consent could compromise the availability or accuracy of information needed to investigate a breach of agreement or violation of Canadian or provincial law;
  • disclosure is required by subpoena, warrant, court order, or court rules;
  • the information was produced by an individual in the course of employment, business, or professional activity and collection is consistent with its original purpose;
  • collection is only for journalistic, artistic, or literary purposes;
  • the information is publicly available and specified by regulation.

5. When and With Whom Do We Share Personal Information?

In short: we may share information in specific situations described below and with certain categories of third parties.

We may share information with vendors, consultants, contractors, service providers, or agents that perform services for us or on our behalf and need access to the information to perform that work.

Categories of third parties may include:

  • Image search service provider: Tech Solutions - Belize receives the photo you submit directly when you perform an image search. Kepo does not store the photo. The provider's handling of submitted photos is governed by its own privacy policy.
  • Cloud hosting services.
  • Analytics services, which do not receive photo data.
  • Payment processing services, including Apple's App Store payment systems.

We may also share or transfer information during negotiations or completion of a merger, financing, acquisition, sale of company assets, or transfer of all or part of our business.

6. Is Your Information Transferred Internationally?

In short: your information may be transferred, stored, or processed outside your country.

Our servers are located in the United States. If you access the Services from another country, your information may be transferred to, stored in, and processed in the United States or other countries where we or our service providers operate.

If you are in the EEA, UK, or Switzerland, those countries may not provide the same level of data protection as your home country. Where required, we take measures designed to protect personal information in line with this notice and applicable law.

For relevant international transfers, we may use safeguards such as the European Commission's Standard Contractual Clauses between our group companies or with third-party providers. Additional details may be provided upon request.

7. How Long Do We Keep Your Information?

In short: we keep personal information only as long as needed for the purposes described in this notice, unless a longer period is required or allowed by law.

We retain personal information only for the time necessary to fulfill the purposes in this notice, unless tax, accounting, legal, or other requirements require or permit longer retention. No purpose described in this notice is intended to require us to keep personal information for more than one day.

Photo data: Kepo does not store or retain photos submitted for searches. Photos are transmitted directly to the third-party image search service, and Kepo has no further involvement after that transmission. The provider's retention and deletion practices are governed by its own privacy policy.

When we no longer have an ongoing legitimate business need to process personal information, we will delete or anonymize it. If deletion or anonymization is not immediately possible, such as when information is stored in backup archives, we will securely store it and isolate it from further processing until deletion is possible.

8. Do We Collect Information From Minors?

In short: we do not knowingly collect data from or market to children under 17 years old.

We do not knowingly solicit personal information from or market to children under 17. By using the Services, you confirm that you are at least 17 years old or that you are the parent or guardian of a minor dependent and consent to that minor's use of the Services.

If we learn that personal information from a user under 17 has been collected, we will deactivate the relevant account and take reasonable steps to delete the information from our records. If you believe we may have collected information from a child under 17, contact us at [email protected].

Users are also prohibited from uploading photos of minors under 18 years old for searches.

9. What Are Your Privacy Rights?

In short: in some regions, including the EEA, UK, and Canada, you may have rights that give you greater access to and control over your personal information.

Depending on applicable law, your rights may include:

  • requesting access to and a copy of your personal information;
  • requesting correction or deletion of personal information;
  • asking us to restrict certain processing activities;
  • requesting data portability where available;
  • objecting to certain processing activities;
  • withdrawing consent when processing is based on consent.

You can make a request using the contact details in this notice. We will review and respond to requests in accordance with applicable data protection laws.

If you are in the EEA or UK and believe we are processing your personal information unlawfully, you may complain to your local data protection authority. Contact details are available at https://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm.

If you are in Switzerland, contact details for the data protection authority are available at https://www.edoeb.admin.ch/edoeb/en/home.html.

Withdrawing consent: if we process your information based on consent, you may withdraw that consent at any time by contacting us. Withdrawal does not affect processing that occurred before withdrawal, and it does not affect processing based on lawful grounds other than consent where applicable.

Questions about privacy rights can be sent to [email protected].

10. Controls for Do-Not-Track Features

Most web browsers and some mobile operating systems or mobile applications offer a Do-Not-Track ("DNT") feature that signals a preference not to have online browsing activity monitored or collected.

No uniform technology standard for recognizing and honoring DNT signals has been finalized. For that reason, we do not currently respond to DNT browser signals or similar automated signals. If a standard is adopted in the future that we are required to follow, we will describe that practice in an updated version of this notice.

11. Do United States Residents Have Specific Privacy Rights?

In short: residents of certain United States jurisdictions may have specific rights regarding personal information.

California Shine the Light

California Civil Code Section 1798.83, known as the "Shine the Light" law, allows California residents to request, once per year and free of charge, information about categories of personal information we disclosed to third parties for direct marketing purposes and the names and addresses of those third parties for the preceding calendar year.

If you are a California resident and want to make this request, contact us using the information below.

If you are under 18, live in California, and have a registered account with the Services, you may request removal of unwanted data that you publicly post on the Services. To request removal, contact us and include the email address linked to your account and a statement that you reside in California. We will work to ensure the data is not publicly displayed, but it may not be fully removed from all systems, such as backups.

CCPA Privacy Notice for California Residents

This section applies only to California residents. Under the California Consumer Privacy Act (CCPA), California residents may have the rights described below.

Under California regulations, a resident includes:

  • every individual in California for more than a temporary or transitory purpose;
  • every individual domiciled in California who is outside California for a temporary or transitory purpose.

All other individuals are treated as non-residents.

If this definition applies to you, we will comply with applicable rights and obligations regarding your personal information.

California residents may have the right to:

  • request deletion of personal information, subject to exceptions allowed by law;
  • know whether we collect and use personal information;
  • know the categories of personal information collected;
  • know the purposes for which collected personal information is used;
  • know whether we sell or share personal information with third parties;
  • know the categories of personal information sold, shared, or disclosed for a business purpose;
  • know the categories of third parties receiving personal information;
  • know the business or commercial purposes for collecting, selling, or sharing personal information;
  • request the specific pieces of personal information collected about them;
  • be free from discrimination for exercising privacy rights;
  • limit use and disclosure of sensitive personal information, although we do not process sensitive personal information.

We are not required to provide or delete de-identified information in response to a consumer request, or to re-identify data to verify a consumer request.

Verification

When we receive a request, we may need to verify that you are the person associated with the information in our systems. Verification may require us to ask for information that can be matched with information previously provided, or to contact you through a communication method already provided to us.

We use information provided in a request only to verify identity or authority. Where possible, we avoid requesting extra information. If extra information is needed for verification, security, or fraud prevention, we will delete it after verification is complete.

Other California Privacy Rights

You may also have the right to:

  • object to processing of your personal information;
  • request correction of inaccurate or outdated personal information;
  • ask us to restrict certain processing;
  • designate an authorized agent to make a CCPA request on your behalf, subject to proof of authorization;
  • request to opt out of future selling or sharing of personal information to third parties.

If we receive an opt-out request, we will act as soon as reasonably possible and no later than fifteen (15) days from submission.

To exercise these rights, contact us at [email protected]. If you have a complaint about how we handle your data, we would like to hear from you.

Colorado Residents

This section applies only to Colorado residents. Under the Colorado Privacy Act (CPA), you may have the following rights, subject to legal limits:

  • the right to know whether we process your personal data;
  • the right to access your personal data;
  • the right to correct inaccuracies;
  • the right to request deletion;
  • the right to obtain a copy of personal data you previously shared with us;
  • the right to opt out of processing for targeted advertising, sale of personal data, or profiling that produces legal or similarly significant effects.

To exercise these rights, email [email protected].

If we decline your request and you want to appeal, email us at [email protected]. Within forty-five (45) days of receiving an appeal, we will inform you in writing about any action taken or not taken and explain the reasons for our decision.

Connecticut Residents

This section applies only to Connecticut residents. Under the Connecticut Data Privacy Act (CTDPA), you may have the following rights, subject to legal limits:

  • the right to know whether we process your personal data;
  • the right to access your personal data;
  • the right to correct inaccuracies;
  • the right to request deletion;
  • the right to obtain a copy of personal data you previously shared with us;
  • the right to opt out of processing for targeted advertising, sale of personal data, or profiling that produces legal or similarly significant effects.

To exercise these rights, email [email protected].

If we decline your request and you want to appeal, email us at [email protected]. Within sixty (60) days of receiving an appeal, we will inform you in writing about any action taken or not taken and explain the reasons for our decision.

Utah Residents

This section applies only to Utah residents. Under the Utah Consumer Privacy Act (UCPA), you may have the following rights, subject to legal limits:

  • the right to know whether we process your personal data;
  • the right to access your personal data;
  • the right to request deletion;
  • the right to obtain a copy of personal data you previously shared with us;
  • the right to opt out of processing for targeted advertising or sale of personal data.

To exercise these rights, email [email protected].

Virginia Residents

This section applies only to Virginia residents. Under the Virginia Consumer Data Protection Act (VCDPA), a "consumer" means a Virginia resident acting only in an individual or household context, and does not include a person acting in a commercial or employment context.

"Personal data" means information linked or reasonably linkable to an identified or identifiable natural person. It does not include de-identified data or publicly available information.

"Sale of personal data" means exchanging personal data for monetary consideration.

If these definitions apply to you, we will comply with applicable rights and obligations regarding your personal data.

Virginia residents may have the right to:

  • know whether we process personal data;
  • access personal data;
  • correct inaccuracies;
  • request deletion;
  • obtain a copy of personal data previously shared with us;
  • opt out of processing for targeted advertising, sale of personal data, or profiling that produces legal or similarly significant effects.

To exercise these rights, email [email protected].

If you use an authorized agent, we may deny the request if the agent does not provide proof of valid authorization.

We may ask for additional information reasonably necessary to verify you and your consumer request. If an authorized agent submits the request, we may need additional information to verify your identity before processing it.

We will respond without undue delay and, in any event, within forty-five (45) days after receiving the request. If reasonably necessary, we may extend the response period once by another forty-five (45) days. We will notify you of the extension and the reason within the first 45-day period.

If we decline your request, we will explain our decision. You may appeal by emailing [email protected]. Within sixty (60) days after receiving an appeal, we will inform you in writing of any action taken or not taken and explain the reason. If your appeal is denied, you may contact the Attorney General to submit a complaint.

12. Do Other Regions Have Specific Privacy Rights?

In short: you may have additional rights depending on your country or region.

Australia and New Zealand

We collect and process personal information in line with Australia's Privacy Act 1988 and New Zealand's Privacy Act 2020.

This notice is intended to satisfy notice requirements under those laws, including explaining what personal information we collect, where it comes from, why we collect it, and who may receive it.

If you do not provide personal information needed for an applicable purpose, it may affect our ability to:

  • provide products or services you request;
  • respond to or assist with your requests.

You may request access to or correction of your personal information at any time by contacting us using the details in this notice.

If you believe we are processing your personal information unlawfully, you may complain to the Office of the Australian Information Commissioner or the Office of the New Zealand Privacy Commissioner, as applicable.

Republic of South Africa

You may request access to or correction of your personal information at any time by contacting us using the details in this notice.

If you are not satisfied with how we handle a complaint about our processing of personal information, you may contact The Information Regulator (South Africa):

13. Third-Party Privacy Policy

We use third-party service providers to deliver parts of the Services. When you perform an image search, your photo is transmitted to Tech Solutions - Belize. That provider's privacy practices are governed by its own privacy policy.

We are not responsible for content returned by third-party services or for the accuracy of search results. We encourage you to review the privacy policies of any third-party services you use through the Services.

14. Do We Update This Notice?

In short: yes, we may update this notice when necessary to remain compliant with applicable laws or reflect changes to the Services.

We may revise this Privacy Notice from time to time. The updated version will show a new "Revised" or "Last updated" date and will become effective when made available.

If we make material changes, we may notify you by posting a prominent notice or by sending a direct notification. We encourage you to review this notice regularly so you understand how we protect your information.

15. How Can You Contact Us?

If you have questions or comments about this notice, email us at [email protected].

16. How Can You Review, Update, or Delete Your Data?

Depending on the laws that apply where you live, you may have the right to request access to the personal information we collect from you, ask us to correct it, or ask us to delete it.

To request review, correction, update, or deletion of your personal information, contact us at [email protected].

Questions about this document can be sent to Nansha Digital.

[email protected]

Need Help With Kepo?

Contact Nansha Digital for data handling questions, support, or feedback regarding Kepo.

Contact Us