1.1. Definitions. For the purposes of this Policy:

• "Personal Data" means any information that identifies or could reasonably identify an individual.
• "Sensitive Personal Data" means information that is afforded special protection under applicable law, such as government identifiers, biometric data, or precise geolocation.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.
• "Business" means a User that searches for, books, or pays for modeling services.
• "Model" means a User that offers modeling services through the Platform.
• "Service Providers" means third parties that process Personal Data on KAAT's behalf to support the Platform.
• "User Content" means any photos, videos, text, messages, or other materials submitted to the Platform by Users.

2.1. Scope. This Policy applies to all Users of the Platform, regardless of location, and governs the collection and processing of Personal Data in connection with the Platform.

2.2. Third-Party Services. The Platform may include links to third-party websites or services. KAAT is not responsible for the privacy practices of third parties. We encourage you to review their privacy policies before providing information.

2.3. Relationship to Terms. This Policy is incorporated by reference into our Terms of Service. Capitalized terms not defined in this Policy have the meanings set forth in the Terms.

We use Personal Data to operate, improve, and protect the Platform, including to:

• Provide Services: Create and manage accounts and profiles, authenticate users, support Google and Apple sign-in, enable search and matching, facilitate bookings, favorites, reviews, analytics, and messaging.
• Process Payments and Payouts: Facilitate payment method setup, payment authorizations, captures, refunds, payout onboarding, payout releases, and related financial operations through payment processors and payout providers.
• Verify Identity and Support Trust & Safety: Conduct verification, fraud prevention, KYC, message moderation, account security checks, and safety or policy investigations.
• Communicate: Send booking confirmations, payment updates, security alerts, verification updates, support responses, transactional emails, in-app notices, and push notifications.
• Personalize and Improve the Platform: Analyze usage to improve performance and user experience, surface relevant profiles, support location-aware features, and enhance booking, search, and discovery workflows.
• Support Reviews, Reports, and Disputes: Process ratings, reviews, report submissions, issue reports, disputes, refunds, and enforcement actions.
• Marketing Use of Uploaded Photos and Information: Use, reproduce, and display photos and information you upload to the Platform for KAAT’s marketing, advertising, and promotional purposes (including on the Platform, social media, press materials, and paid campaigns), subject to your rights and choices in Article 10.
• Comply With Law: Meet legal, regulatory, tax, accounting, and compliance obligations and enforce our Terms and policies.
• Create Aggregated Insights: Generate aggregated, statistical, or de-identified information for internal reporting, safety analysis, and product improvement.

Where required by applicable law, KAAT relies on the following legal bases:

• Contractual Necessity: To provide the Platform, create and manage accounts, enable bookings and communications, and process transactions and payouts.
• Consent: When you consent to a specific processing activity, such as marketing communications, push notifications, optional geolocation access, or optional profile information.
• Legitimate Interests: To improve the Platform, personalize discovery features, prevent fraud, moderate communications, maintain platform safety, support analytics, and secure the Platform.
• Legal Obligation: To comply with regulatory, tax, accounting, anti-fraud, KYC, sanctions-screening, law-enforcement, or other legal requirements.

We disclose Personal Data only as described below:

• With Other Users: We share profile, portfolio, pricing, location, availability, review, booking, and messaging information with other Users as needed to enable discovery, bookings, and communications on the Platform.
• With Service Providers: We share data with vendors that support hosting, cloud storage, authentication, communications, messaging, media handling, notifications, analytics, payments, payouts, identity verification, fraud prevention, and customer support.
• With Integrated Providers: We share information with payment, verification, authentication, mapping, and notification providers that help us operate the Platform, such as Stripe, Apple (Sign in with Apple and Apple Pay), Didit, Google, Apple Maps, and Firebase or similar providers we may use from time to time.
• For Safety and Legal Reasons: We may disclose information to investigate misuse, enforce our policies, respond to legal requests, comply with law, or protect the rights, property, and safety of KAAT, Users, or the public.
• Professional Advisors and Corporate Transactions: We may share information with auditors, legal counsel, insurers, investors, acquirers, or counterparties in connection with financing, audits, claims, reorganizations, mergers, acquisitions, or asset sales.
• With Your Direction or Consent: We may share information when you ask us to do so or otherwise provide explicit permission.

KAAT operates globally. Your Personal Data may be transferred to, stored in, or processed in jurisdictions outside your country of residence, including the United Arab Emirates and other countries where our Service Providers operate.

We implement appropriate safeguards to protect cross-border transfers, such as contractual protections and security measures. By using the Platform, you acknowledge and consent to these transfers.

We retain Personal Data for as long as your account remains active or as needed to provide the Platform. Different categories of information may be retained for different periods depending on the nature of the data and the purpose of processing.

For example, we may retain account and profile data while your account is active; booking, payment, payout, tax, review, report, dispute, moderation, and verification records for longer periods where required for compliance, fraud prevention, audits, chargebacks, refunds, or legal defense; and support communications for as long as needed to address your request and maintain business records.

When retention is no longer necessary, we delete, anonymize, or de-identify Personal Data in accordance with applicable law and our internal policies. Residual copies may remain in backups for a limited period before deletion.

We maintain administrative, technical, and physical safeguards designed to protect Personal Data. These safeguards include access controls, credential and session protections, encryption where appropriate, separation of duties, vendor controls, and monitoring for suspicious activity.

No system is completely secure. You acknowledge that we cannot guarantee absolute security and that you are responsible for maintaining the confidentiality of your account credentials.

We use cookies and similar technologies to operate the Platform, maintain authentication sessions, remember preferences, support security features, store limited user-interface state, analyze performance, and improve the user journey. We may also use browser storage such as local storage or session storage for temporary settings and feature walkthroughs.

Some features may not function properly if you disable cookies. We do not currently respond to browser "Do Not Track" signals.

12.1. Service Communications. We may send you transactional messages regarding your account, bookings, security alerts, and policy updates. You cannot opt out of these messages without closing your account.

12.2. Push and In-App Notifications. If you enable notifications, we may use your device token and related technical data to send push or in-app notifications about bookings, messages, verification, payments, reviews, reminders, and other account activity. You can manage these permissions through your browser, device, or account settings where available.

12.3. Marketing Communications. Where permitted by law, we may send promotional messages. You may opt out at any time by following the unsubscribe instructions or adjusting your account settings where available.

We may use automated tools and profiling techniques to detect fraud, support verification workflows, moderate messages, identify prohibited content or personal information shared in chat, improve search and discovery relevance, prioritize support, and measure reliability or safety signals.

Where automated tools contribute to decisions that could materially affect a User, KAAT seeks to apply appropriate human oversight, especially for moderation, enforcement, fraud, verification, or account actions.

If you believe an automated decision has impacted you, you may contact us to request review.

The Platform is not intended for individuals under 18 years of age. We do not knowingly collect Personal Data from children. If we learn that a child has provided Personal Data, we will delete it promptly.

We may update this Policy from time to time. We will post the updated version on the Platform and update the "Last Updated" date above. Material changes may be communicated via email or in-app notice.

Your continued use of the Platform after changes take effect constitutes acceptance of the revised Policy.