How we handle your information

The custom-order form

When you use our custom order form, we collect what you type in — your name, email, product interest, quantity, and project details — plus any files you choose to upload, like a logo or QR code. We use it all for one thing — replying to you about your request. Submissions and uploaded files are delivered to us and may be stored by Netlify Forms, the service that powers the form.

Analytics

We use privacy-friendly, cookieless analytics to understand aggregate site traffic — things like which pages are visited and how often people click through to our Etsy shop. It does not use cookies, and it does not build personal profiles of visitors.

What we don't do

We do not sell personal data. We do not run ad-tracking pixels.

Payments

If you order directly from us, payments may be processed by third-party providers such as Square, Stripe, or Etsy. Payment details go to the processor — Kayem.co does not see or store full card numbers.

Checkout happens on Etsy

Purchases are completed on Etsy, which is its own store with its own policies. Anything you do there — payment, shipping details, messages — is covered by Etsy's terms and privacy policy, not ours.

Tag Service Privacy Notice

Version tag-privacy-v1

This notice covers the Kayem backpack tag service: the public page a finder reaches by scanning a tag, the setup pages where you configure a tag, and the notification emails the service sends you.

1. What we mean by "private"

Private here means that your contact details and your private tag label are not shown to the person who scans the tag. They send a message without learning who you are or how to reach you.

It does not mean the message is hidden from us. Kayem and the service providers listed in section 6 process the message in order to deliver it to you. Messages are not encrypted end to end, and we do not describe the service as anonymous or as guaranteed private.

2. What a finder submits

On the public page a finder can submit:

• a report type, such as that they found the backpack, left it somewhere safe, or saw it somewhere;
• an optional location description that they type themselves, in their own words;
• an optional short note.

They also complete a human-verification check. We use what they submit to prepare and send your notification.

3. Location

The service does not ask for, request permission for, or read automatic device location or GPS from anyone, and the tag itself contains no GPS or radio beacon. The only location information in the service is whatever a finder chooses to type, which is their own description rather than a measured position. That description is included in the notification we send you and is not stored in our database afterwards.

4. What is delivered to you, and what we keep

There is a difference between the content we deliver and the record we keep.

The words a finder writes are not stored in our database after we attempt delivery. They do remain in the notification email in your mailbox, and in the email provider's systems for as long as that provider keeps them.

5. What the service stores

Claim codes

The claim code printed on a tag is created when the tag is made, and the code itself is never stored. What we store is a one-way hash of it, which lets us recognise a code that is presented to us without being able to reproduce the code from our records. A hash is not an anonymous value: anyone holding the printed card can still check it against our stored hash. It identifies the card, not you.

A code row is never deleted by the service. It stays in one of four states:

• Active — not yet used. A tag has at most one active code at a time.
• Redeemed — used to claim a tag. This is permanent, and it is what stops the same printed code being used again.
• Expired — past its expiry date but not used. It can no longer be redeemed. Expiry does not remove the record.
• Revoked — deliberately cancelled, because a replacement was issued or because another code claimed the tag first. Also permanent.

Until a code is redeemed, its stored hash is not linked to any account. Once it is redeemed we also record which account redeemed it; that link is removed when the account is closed, while the hash and the fact of redemption remain.

We do not request or collect the finder's email address, and we do not store the finder's network address. Before a message is accepted we convert that address into a one-way keyed identifier used only for rate limiting, and it is that identifier we keep, not the address.

6. Service providers

The service runs on providers that process information on our behalf. Each receives only what its job requires, and each keeps its own logs and backups under its own policies, which we do not control.

The tag service sends only two kinds of email, and both are transactional: the one-time sign-in code you ask for, and a notification when someone uses your tag's public page. It does not send marketing email, and your address is not used for anything else by this service.

7. How long we keep notification records

We keep notification records only as long as we need them for abuse prevention and for troubleshooting delivery.

Kayem removes this limited notification metadata periodically, as part of its retention process. We want to be accurate about how that happens: nothing in the service removes these records automatically, and no deletion happens at exactly 30 days. Removal is a manual step carried out by Kayem, using a tool that keeps the most recent 30 days of records, so records can remain for longer than 30 days before they are removed. We will state an enforced period here only once automatic removal is actually in place.

8. Please keep sensitive information out of the service

• Do not enter a child's full name, school, home address, age, daily schedule or route, medical information, or photograph, in a private label or anywhere else.
• Do not use the service to record health information. It is not a medical service and offers no protections suitable for health data.
• We ask finders not to include sensitive personal information in a message. Anything a finder writes is delivered to you by email.
• Accounts are held only by people aged 18 or older. No field in the service is intended to describe a child. If you believe a child's personal information has been entered, contact us and we will remove it.

9. What is stored in your browser

When you sign in, your session is stored in your browser's local storage so your account stays open between visits. Signing out clears it. The public page a finder sees stores nothing about the finder.

The same sign-in is shared by the other pages on kayem.co that use your Kayem account, so signing in or out on the tag setup page also signs you in or out there.

10. Your choices

• Change or clear a private label at any time in your account.
• Turn notifications off for a tag, which stops the public page accepting messages for it.
• Ask us to close your account, or to retire a tag, as described below. We use those words deliberately: section 11 explains what is removed and what is kept.

11. Closing an account, and what happens to the data

Email hello@kayem.co from the address on the account and tell us what you would like removed.

Four different things can happen to a record, and they are not the same:

• Deleted — the row is removed from our live database.
• De-identified — the row stays, but the values that identify you, and the words you wrote, are removed from it or overwritten.
• Retired — a tag record stays and keeps working as a record, but it is switched off: its public page stops responding and it has no account attached to it.
• Suspended — a tag is switched off by us because of abuse. We do not use suspension for a privacy request, so closing an account never marks a tag as abusive.

When you ask us to close an account:

• Verification. We will ask you to confirm the request from the account's email address, and we may ask you to confirm details we already hold, such as which tags are on the account. If we cannot reasonably satisfy ourselves that the request comes from the account holder, we will decline it, so that nobody else can remove your data.
• Deleted. Your sign-in account and its email address; the record linking you to each tag; and your terms and privacy acceptance records. One exception: a Kayem account can also be used for other Kayem services, such as a Kayem contact page. If yours is, we close only the tag service, leave the sign-in account in place for those services, and tell you so. You can ask us to close the whole account separately.
• De-identified. Your private tag labels and any other text you entered on a tag are cleared from the tag record. Our internal change log keeps its rows, but the account reference and everything you typed are removed from them, leaving only non-personal facts such as a status change.
• Retired. Each of your tags. The tag record itself is not deleted: its public page stops responding and behaves exactly like a page for a tag that does not exist, and it has no guardian. A retired tag cannot receive messages.
• A record that the account was closed. We keep one small row holding the internal identifier your account had, the fact that it was closed, and the date. It exists for a specific reason: a sign-in that was already issued to your browser stays valid for a while, so closing the account is not by itself enough to stop that sign-in being used to set up another tag afterwards. This row is what refuses it. It contains no address, no label and no message, it is kept even after your sign-in account itself is deleted, and it is used for nothing else.
• Kept, and why. Two further kinds of record remain. Security records: the hash of each claim code, and the fact and time of its redemption or revocation, so that a printed code that has already been used can never be used again. Operational records: the tag record itself, its status history, and the notification records described in sections 4 and 7, which are governed by retention rather than by your request. We also keep anything we must keep to meet a legal obligation.
• What "kept" means honestly. The security and operational records contain no account identifier and none of the words you wrote. (The account-closed record above is the one exception: it holds the internal identifier your account had, and nothing else.) They are not anonymous. A claim-code hash still corresponds to a specific printed card, and a tag record still identifies a specific physical tag; anyone holding that card or tag could recognise it. What is gone is the link to you.
• Providers. Our providers keep their own backups and delivery logs. A copy of what we held, including values we have removed from our live database, can remain in a provider's backups and in past notification emails for a period after we act, under that provider's policies rather than ours.
• What we remove from our live database, we cannot restore, and a retired tag cannot be brought back into service by you. We do not promise that every copy everywhere has been destroyed, because that is not something we can see or control.

12. Changes to this notice

Each version of this notice has an identifier, and the identifier in force when you accepted is recorded with your acceptance (tag-privacy-v1). That stored record is never rewritten: it keeps showing the version you actually accepted, even after we publish a later one.

If we make a material change we will publish it under a new identifier and ask you to accept the new version the next time you set up or activate a tag. Accepting a new version adds a new record; it does not replace the earlier one. A tag that is already active keeps working in the meantime, so a new version does not switch anything off.

13. Contacting Kayem

For privacy questions, deletion requests, or to report information that should not be in the service, email hello@kayem.co. The related terms are in the Tag Service Terms (tag-terms-v1).

Questions or deletion requests

Email us at hello@kayem.co with any privacy question, or to ask us to delete something you've sent us. We're happy to help.