Privacy Policy

Effective Date: 20 July 2026

Introduction / Scope

Karrot Canada Corp. (“Company” or “we”) respects your privacy and is committed to protecting it by complying with this privacy policy. This Policy sets out the types of information we may collect when you use the Karrot mobile application (“App”) or karrotmarket.com/ca or karrotmarket.com or other sites of ours (the “Service Sites”).

A. Information You Provide to Us

When you download, register with, or use the App or access, use or visit the Service Sites, or otherwise interact with us, you may provide the following types of information:

You post and transmit User Contributions to others at your own risk. We cannot control the actions of third parties with whom you may choose to share your User Contributions. Therefore, we are not able to guarantee that your User Contributions will not be viewed or accessed by unauthorized third parties.

Registration and authentication information. When you register or sign in using your email address, we collect your email address and use it to send you a one-time verification code to confirm your identity. We do not require or store a password.

B. Automatic Information Collection

When you download, access, or use the App or the Service Sites, we may automatically collect:

C. Cookies and Similar Tracking Technologies

We use cookies and similar online tracking technologies (such as pixel tags and web beacons) to: analyze and track usage of the App and Service Sites; conduct marketing and advertising; measure the effectiveness of promotional campaigns; improve performance, security, and functionality; and fulfill the purposes otherwise described in this Policy.

These technologies also allow us to collect information such as browser type, time spent on the Service Sites and App, pages visited, language preferences, unique identifiers, content you view, click on, or share, screen gestures or actions, interactions with Karrot and other Karrot users, and other traffic data.

If you do not want information collected through the use of cookies, you may control certain cookies through settings in your web browser and on your device. Additionally, most browsers allow you to automatically decline cookies or be given the choice of declining or accepting a particular cookie (or cookies) from a particular website. If, however, you do not accept cookies, you may experience some inconvenience in your use of the Service Sites and App.

D. Third Party Information Collection

When you use Karrot or its content, certain third parties may collect information about you or your device, including by using cookies and similar technologies. These third parties may include: analytics companies; ad networks, social media providers, or advertising providers; generative AI service providers, which we use to support customer service responses, translation, content moderation and fraud detection; security companies that monitor for fraud, abuse, or unauthorized access, and who verify the identities of users of Karrot; identity verification services that we use to confirm your identity (which may include the collection of sensitive personal information, like biometric data); and mobile carriers or wireless service providers, in connection with identity verification and fraud prevention. In the United States, you authorize your wireless carrier to use or disclose information about your account and your wireless device, if available, to Karrot or its service provider for the duration of your business relationship, solely to help them identify you or your wireless device and to prevent fraud. In Canada, you authorize your mobile carrier to disclose your mobile account details for the purpose of verifying your identity.

E. Information We Receive From Third-Party Sign-In Providers

When you register for or log in to Karrot using a supported third-party sign-in service (such as Apple, Google, or Facebook), we receive certain information from that provider. This may include your name, your email address (which, for Sign in with Apple, may be a private relay address), your profile picture, and a unique user identifier assigned by that provider. The information we receive depends on your privacy settings with that provider. We use this information to create and authenticate your account, and for the other purposes described in this Policy. We request only the minimum information necessary for that purpose. We do not sell this information, and we do not use it for advertising except as described in this Policy or with your consent.

Identity Verification and Biometric Information

For certain features, we use a third-party identity verification provider to confirm that you are who you say you are. If you choose to complete identity verification, the provider will ask you to submit an image of a government-issued identification document and a photograph of your face, and will compare the two. This process involves the collection of a biometric identifier — a scan of your facial geometry — by our identity verification provider. We will ask for your consent before this process begins, and we will tell you the purpose of the collection and how long the information will be retained. Karrot does not receive or store the biometric identifier. It is collected, used and destroyed by our identity verification provider, Persona, in accordance with its privacy policy and its written retention and destruction schedule, available at https://withpersona.com/legal/privacy-policy/. The biometric identifier is used to verify your identity and to detect and prevent fraud. Persona may also use it to improve its own platform, as described in its privacy policy. It is not sold, and it is not used for advertising. Identity verification is required only for certain activities, such as receiving payouts, higher-value transactions, and resolving disputes. You may decline identity verification, although you may then be unable to use the features that require it.

How We Use Your Information

We use each of the above categories of information that we collect about you, including any personal information: to verify accounts and your activity; to provide you with the App and Services Sites, their contents, and other Company services, including to personalize your experiences and to offer you recommendations; to provide you with information, products or services that you request from us, including to provide customer support, which may be supported by our AI tools; to fulfill the purposes for which you provided it; to determine your “neighbourhood” market (which is generally a maximum of a 50 KM radius surrounding your location) and the local bulletin board that you can post and transact on; to carry out our obligations and enforce our rights in any contracts with you; to notify you when App updates are available; to improve Karrot, our products and services, including by using content you provide when you interact with Karrot (including User Contributions) to train our AI models that power these interactive features; to store information about your preferences and customize Karrot according to your individual interests; to detect and remedy violations of our terms or policies; to respond to user inquiries; to combat harmful conduct and detect and prevent fraud (including by verifying your identity), suspicious activity, spam and other bad experiences; to maintain the integrity of our App and Services Sites, and promote safety and security; for online and offline marketing purposes, including to deliver content and advertisements to you specific to your location and to measure the effectiveness of the advertising we serve; to allow you to participate in interactive features; for any other purpose with your consent; and as otherwise required or permitted by law.

Consent. Where we rely on your consent, we ask for it separately for each purpose, in plain language, at the time we collect your information. In particular, your consent to receive marketing communications is requested separately from, and is not a condition of, creating a Karrot account, and you may withdraw it at any time.

Automated Decisions

When you register, sign in, or use certain features, we use automated processing to detect and prevent fraud, abuse and unauthorised access. These checks may use the device and software information described above, technical and network information including your IP address, the registration and verification details associated with your account (such as your phone number, email address, or third-party account identifier), and information about recent activity associated with your account or device. Based only on this automated processing, we may decline, limit or suspend your registration or sign-in, or require you to complete additional verification. For security reasons, we may limit the level of detail we provide about the criteria we apply, as disclosing them would reduce their effectiveness against fraud and abuse. These decisions relate only to registration, sign-in and access to the Service, and to the prevention of fraud and abuse. We do not use automated processing to make decisions about your eligibility for financial or lending services, housing, insurance, employment, education or healthcare. If we make such a decision about you, we will inform you. You may ask to be told the principal factors that led to the decision; to access and to correct the personal information we used to make it; and to submit observations to a member of our team who is able to review the decision. To do so, contact our team at help@karrotmarket.com. We will respond within the time required by applicable law.

Sharing of Personal Information

We may transfer or disclose (as applicable) each of the above categories of personal information that we collect for the purposes described in this Policy to the following categories of recipients: to our subsidiaries and affiliates; to service providers who process personal information on behalf of us for the operation of our business, including Company affiliates; according to applicable law, to a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Karrot Canada Corp.’s assets; and to other entities: for any other purpose we disclose when you provide the information with your consent; to comply with any court order, law, or legal process, including to respond to any government or regulatory request; to enforce our rights arising from any contracts between you and us; if we believe disclosure is necessary or appropriate to protect the rights, property, or safety of Karrot Canada Corp., its affiliates, our customers, or others (this includes exchanging information with other companies and organizations for fraud prevention and credit risk reduction); and as otherwise required or permitted by law.

Mobile information and SMS opt-in consent will not be shared, sold, or transferred to third parties or affiliates for marketing or promotional purposes.

Personalised Advertising

We may disclose limited personal information to advertising partners so that they can show you more relevant advertising on Karrot and on other services. The information shared for this purpose may include a hashed (one-way, irreversible) version of your email address, and the interest categories associated with your account. These partners may use this information only to deliver and measure advertising for Karrot, and not for their own independent purposes. We do not share your name, your telephone number, or the content of your messages. You may opt out of this sharing at any time in Settings. Residents of Québec are not included in this programme, and their personal information is not shared under this section.

Transferring Your Personal Information and Foreign Transfers

We may transfer personal information that we collect or that you provide us to contractors, service providers, and other third parties we use to support Karrot, our business, our other services, and our operations (such as payment card processors, technical support providers, hosting services providers, and other AI service providers, data storage and processing service providers, and analytics providers that assist us with Karrot improvement and optimization).

We may process, store, and transfer your personal information in and to other jurisdictions with different privacy laws that may or may not be as comprehensive as those in your country or region of residence. In these circumstances, the governments, courts, law enforcement, or regulatory agencies of such other jurisdictions may be able to access your personal information.

Personal information of our North American users is stored in Canada. Certain service providers — for example, providers of authentication, analytics, security and identity verification services — may process limited personal information in the United States. Where personal information is processed outside your province or country of residence, we take steps to ensure that it receives a comparable level of protection through contractual and organisational safeguards.

Your Rights and Choices

A. Choices About How We Use and Disclose Your Information

Location Information. In order to deliver our services, the App may collect and use real-time information about your device’s location. If you block the use of location information, the App may be inaccessible or not function properly.

Promotional Offers from the Company. If you have opted in to receive certain emails and/or push notifications from us but no longer wish for us to use your contact information to promote our own or third parties’ products or services, you can opt-out by sending us an email stating your request to help@karrotmarket.com or by opting out of receiving promotional push notifications in the App. If we have sent you a promotional email, you may unsubscribe by clicking the unsubscribe link we have included in the email. You can also always opt out by logging into the App and adjusting your user preferences in your account profile.

B. Accessing and Correcting your Personal Information

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes. By law you may have the right to request access to and to correct the personal information that we hold about you in certain jurisdictions. You can review and change your personal information by logging into your account and visiting your account profile page. You may also send us an email at privacy@karrotmarket.com to request access to, correct, or delete any personal information that you have provided to us. We will accommodate your requests to the extent required by applicable law. We may request specific information from you to help us confirm your identity to fulfill your request.

C. Withdrawing Your Consent

We may collect, use, and disclose your personal information with your consent. How we obtain your consent, including whether it is express or implied, will depend on the circumstances and the sensitivity of the personal information in question, as well as applicable law. You may have the legal right to withdraw your consent to the collection, use, or disclosure of your personal information under certain circumstances. To request a withdrawal of your consent, contact us at privacy@karrotmarket.com. Please note that if you withdraw your consent we may not be able to provide you with a particular product or service.

Data portability. Where applicable law provides, you may request a copy of the personal information you have provided to us in a portable and readily usable format.

Data Security

The security of your personal information is very important to us. We use physical, electronic, and administrative measures designed to secure your personal information from loss, theft and from unauthorized access, use, and disclosure.

The safety and security of your information also depends on you. If you have been given (or have chosen) authorization to access your account or certain features within Karrot, you are responsible for keeping it confidential. We ask that you not to share your account or confidential information with anyone.

We have put in place procedures to deal with breaches of security safeguards and will notify you and any applicable regulator when we are legally required to do so.

Unfortunately, the transmission of information via the Internet and mobile platforms is not completely secure. Although we do our best to protect your personal information, we cannot guarantee the security of your personal information transmitted through Karrot. Any transmission of personal information is at your own risk.

We use reasonable administrative, technical and physical safeguards appropriate to the sensitivity of the information we hold.

Data Retention

Except as otherwise permitted or required by applicable law or regulation, we will only retain your personal information for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Under some circumstances we may anonymize or aggregate your personal information so that it can no longer be associated with you. We reserve the right to use such anonymous and de-identified data for any legitimate business purpose without further notice to you or your consent, as permitted by applicable law.

When you de-register, we delete your personal information, except where we are required or permitted to retain it under applicable law, or where it is necessary to prevent fraud and abuse. For example, we retain a limited record derived from the registration details associated with a deleted account, in order to prevent the immediate creation of a new account by users who have abused the Service. We retain such records only for as long as is necessary for that purpose.

Third-Party Websites and Services

We may provide links to third-party websites for your convenience and information. We may also make opportunities available to you to purchase, subscribe to, or use other products or services from third parties with different privacy practices. Those other websites, products, or services are governed by the privacy policies of the respective third party. This Policy does not extend to any websites, products, or services provided by third parties. We do not assume responsibility for the privacy practices of third parties not acting on our behalf and we encourage you to review all third-party privacy policies prior to using third-party websites, products, or services.

Children’s Privacy

Our App is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16.

If we become aware that we have collected personal information from a child under 13 in the United States, we will delete it.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. It is our policy to post any changes we make to this Privacy Policy on this page. Such changes will become effective thirty (30) days after posting. We may correct minor errors, such as spelling or formatting, without notice. Where a change is required urgently in order to address a security risk or to prevent harm or abuse, we will give you as much notice as is reasonably feasible. We include the date this Policy was last revised at the top of the page.

A change is substantial if it expands the categories of personal information we collect, introduces a new source from which we collect it, introduces a new purpose for using it, or reduces your rights. Where a change is substantial, we will give you notice at least thirty (30) days before it takes effect, and we will ask you to accept the updated policy before it applies to you.

Contact Information And Challenging Compliance

Privacy Officer, Karrot Canada Corp. · 119 Spadina Avenue, Suite 701, Toronto, ON M5V 2L1, Canada · privacy@karrotmarket.com

Supplemental Notice for Residents in Certain US States

This Supplemental Notice applies to consumers in states that have a state-level comprehensive privacy law that applies to us and addresses personal information we collect online and offline. As discussed above, certain third parties may process “sensitive data” as defined under applicable law. We do not knowingly process personal information of minors under the age of 16. Additionally, our disclosure of personal information, including your identifiers, internet usage information, and inferences collected through cookies and similar online tracking technologies, may be considered “targeted advertising” under applicable law.

You may have the following privacy rights, in each case to the extent set out in applicable law: the right to confirm whether we process personal information about you and request access to such personal information (including, if applicable, in a portable and readily usable format); the right to correct inaccuracies in certain personal information we may hold about you; the right to delete personal information we have collected about you; and the right to opt-out of “sale” of personal information to third parties, and/or the processing of personal information for “targeted advertising” purposes. You have a right to be free from discrimination based on your exercise of your privacy rights, and may have a right to appeal our decision not to process one of the above-listed privacy rights.

We do not process your personal information for purposes of profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

Certain decisions about account registration and access are made by automated means, as described under “Automated Decisions” above. You may request an explanation of such a decision and ask that it be reviewed by a member of our team. Categories collected via third-party sign-in. If you sign in using a supported third-party sign-in service (such as Apple, Google, or Facebook), we collect identifiers — including your name, your email address (which may be a private relay address), and a unique user identifier assigned by that provider — and, where you choose to provide it, your profile picture. The source of this information is the third-party sign-in provider you select. We do not sell this information. We do share personal information for cross-context behavioural advertising, as described under “Personalised Advertising” above. You have the right to opt out of this sharing, and you may do so at any time in Settings.