Privacy notice

KAAM is operated by Deshwal & Co, registered in England (company number [to confirm]), at [to confirm]. The same company operates Saral. For the information described here we are the controller: we decide what is collected and why. Our ICO registration number is [to confirm].

One exception worth naming. When a professional keeps their own clients in KAAM - people who never came through the marketplace - the professional decides what is held about them and we process it on their instruction. For those records they are the controller and we are their processor.

Contact for anything on this page: privacy@kaam.uk.

• Your account - name, email, password (stored hashed, never in a form we can read), sign-in records, and two-step verification enrolment if you turn it on.
• Your business, if you have one - trading and legal name, company number, the services you offer and where you cover.
• Verification evidence - insurance certificates, trade registrations, identity documents and the like, with the decision a KAAM reviewer made and when it expires.
• Jobs - what you described, the answers you gave, the address or area, photos and files, and the responses received.
• Messages between you and the other side of a job, and attachments sent with them.
• Arrangements and visits - recurring schedules, dates, prices and whether a visit happened.
• Properties you add, including compliance dates such as when a gas safety certificate is due.
• Billing - your plan, invoices and a reference to your payment method. We never see or store your card number or bank details; those are entered on Stripe’s or GoCardless’s own pages and stay with them.
• Support - what you asked us and what we answered.
• An audit trail - who did what, and when. See clause 8.

What we deliberately do not hold. Photographs you upload are rebuilt by your own browser before they are sent, which removes the hidden data a camera writes into a file - including the GPS coordinates of where the picture was taken. A photo of your kitchen therefore does not carry your address to the professionals who see it. We do not do behavioural advertising, we do not profile you for it, and we do not sell anything about you to anyone, ever.

Where we rely on legitimate interests you can object - see clause 9 - and we stop unless we have a reason that outweighs yours, which we will explain rather than assert.

• The other side of a job. A professional who can see your job sees what you wrote and the photos you added. Until you accept a response they see the area, not your exact address; the full address is released when there is an agreement to do the work.
• Other professionals see nothing of each other. No response is visible to a rival. That is enforced in the database, and it is tested on every change.
• KAAM staff, where reviewing verification evidence, answering support, or deciding something that was reported. Staff access is by named capability and every look is recorded.
• Our suppliers, each bound by a contract and listed at subprocessors.
• Authorities, where the law requires it or where someone is at risk of serious harm.

KAAM uses an AI model to help turn what you type into a clear job description, to suggest which service a job belongs to, and to answer support questions. Two things about that:

• Your content is not used to train anyone’s model. It is sent to be processed and the answer comes back.
• We keep a record of the cost and size of each call - never the text of it - so we can see what the feature costs without keeping a second copy of what you wrote.

No decision that affects you is made by a model alone. Verification, suspension and reports are decided by a person.

KAAM is hosted in the United Kingdom and the European Economic Area. A few suppliers process data outside it - which ones, and where, is in the subprocessor list. Where that happens we rely on UK adequacy or on the International Data Transfer Addendum to the standard contractual clauses, with the additional safeguards those require.

Every action that changes something - a job published, a response accepted, a verification approved, a photo removed - writes a row saying who did it and when. That record is what lets us answer a dispute honestly, show a regulator what happened, and tell you the truth when you ask what was done with your data.

When you ask us to delete your account, we delete your personal data as described above. The audit rows stay, with your name replaced by an identifier that no longer points at a person. The history of what happened survives; you do not remain identifiable in it.

Over your own data you can:

• See it - ask for a copy of what we hold and why.
• Correct it - most of it you can fix yourself in settings; ask us for the rest.
• Have it deleted - subject to what we must keep, which is listed in clause 7 rather than decided when you ask.
• Take it with you - your own data in a machine-readable file.
• Object, or ask us to restrict what we do with it, where we rely on legitimate interests.
• Withdraw consent to marketing, at any time, without it affecting anything else.

Ask at privacy@kaam.uk. We answer within one month, free of charge, and if we need longer for a complicated request we tell you why inside that month.

If we get it wrong you can complain to the Information Commissioner’s Office at ico.org.uk or 0303 123 1113. We would rather you told us first, at complaints@kaam.uk, but it is your choice and you do not have to.

Access is default-deny: every table starts closed and opens only to the people a named rule admits, so a bug in a page cannot leak what the database was never going to hand over. Files live in private storage and are served through links that expire. Staff access is by capability and is logged. Two-step verification is available to every account, and some actions ask you to prove it is you again even mid-session.

If there is ever a breach that is likely to put your rights at risk, we tell the ICO within 72 hours and tell you without undue delay - in plain terms, including what we do not yet know.

KAAM is for adults. You must be 18 or over to hold an account, and we do not knowingly collect anything about children. If you think we have, tell us at privacy@kaam.uk and we will remove it.

When we change something material we email affected accounts at least 30 days beforehand and update the date at the top. Smaller corrections are made as they arise.