KAM Recycling ("we", "us", or "our") operates the KAM Recycling mobile application (the "App") and the associated web platform. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights regarding that data.
By using the App you agree to the practices described in this policy.
1. Who We Are
KAM Recycling is a catalytic converter recycling platform connecting field agents with recycling buyers. Our services allow users to browse a catalyst catalog, price catalysts based on live precious metal rates, and submit sell requests.
For data protection enquiries contact us at: [email protected]
2. Data We Collect
| Data | Why we collect it | Required? |
|---|---|---|
| Email address | Account login and identification | Yes |
| Password | Account authentication (stored as a one-way hash — never readable) | Yes |
| First and last name | User profile and sell request records | No |
| Phone number | Contact details attached to sell requests | No |
| Currency preference | Display metal prices in your preferred currency | No |
| Cart contents and sell request history | Core app functionality — manage and track your sell requests | Yes (to use the service) |
| Device identifier | Your account is bound to one device. The identifier lets us block a second device from signing in with the same credentials. | Yes |
| Notification token | If you allow notifications, Apple or Google gives the App a token for your phone and we store it against your account so we can send you a message. It identifies the installation, not you, and it changes on its own. Deny notifications, or sign out, and we delete it. Everything we would have sent still appears in the App. | No |
| Usage events | We record eight actions inside the App: sign-in, failed sign-in, blocked device, search, search with no result, catalyst view, cart addition and sell request. Each row stores the action, your account and your account tier at that moment. Searches that returned nothing tell us which converters to add to the catalogue. | Yes |
| IP address and approximate location | Stored with each usage event. The country, region and city are read from the IP by a database held on our own servers, so the address is never sent to an outside service. | Yes |
We do not collect GPS or precise location, advertising IDs, browsing history outside the App, contacts, photos, or any biometric data. The location we hold is approximate, at city level at best, and is read from your IP address rather than from your device.
3. How We Use Your Data
- Create and manage your account
- Process sell requests and communicate pricing to you
- Display role-based catalyst prices appropriate to your account tier
- Allow KAM staff to review and quote your submitted requests
- Respond to support enquiries
- Measure how the App is used, so we can price the converters people actually search for and see where sign-ins fail
We do not sell, rent, or share your personal data with third parties for marketing purposes.
4. Legal Basis for Processing (GDPR)
- Contract performance — processing your name, email, phone and transaction history is necessary to provide the service you signed up for.
- Legitimate interests — keeping logs to maintain security and prevent fraud, binding an account to a single device, and measuring usage of our own service. We use no third-party analytics and build no advertising profile, so this processing has a limited effect on you. You may object to it at any time using the contact address below.
- Consent — optional profile fields (name, phone, currency) which you can change or remove at any time.
5. Data Storage and Security
- Data is stored on secure servers within the European Union.
- All communication between the App and our servers is encrypted using HTTPS/TLS.
- Passwords are hashed using bcrypt and are never stored in plain text.
- API authentication uses short-lived bearer tokens stored in the device's encrypted secure storage.
- Access to personal data is restricted to authorised KAM staff only.
6. Data Retention
We retain your account data for as long as your account is active. Sell request records are retained for a minimum of 3 years for business accounting purposes. If you delete your account from Profile → Delete account, we erase you straight away: your name, email address, phone number, password and device identifier are removed, your sessions end, and any cart you had not yet submitted goes with them. Your past sell requests stay, because accounting and tax law require them, but the phone number on them is removed and they no longer carry anything that identifies you. Usage events lose your account reference, your email address and your IP address at the same moment.
Usage events, including the IP address and the location read from it, are deleted after 365 days. A scheduled job runs every night and removes everything past that limit.
7. Your Rights
Under GDPR you have the right to:
- Access — request a copy of the data we hold about you
- Rectification — correct inaccurate data via the Profile screen in the App
- Erasure — delete your account at any time via Profile → Delete account (requires password confirmation)
- Portability — request your data in a machine-readable format
- Objection — object to processing based on legitimate interests
- Restriction — request that we limit processing of your data
To exercise any of these rights contact us at [email protected]. We will respond within 30 days.
8. Cookies, Local Storage and Analytics
The mobile App does not use cookies. It uses the device's encrypted secure storage (iOS Keychain / Android Keystore) solely to persist your login session token. No tracking cookies or third-party analytics SDKs are used.
Our analytics are our own. The App carries no analytics library; the events described in section 2 are written by our API as it answers the App's requests, and they stay in our database. Nothing is shared with Google, Meta, an advertising network or a data broker, and we do not combine your data with data from other companies. This is why the App shows no tracking consent prompt: there is no tracking to consent to.
9. Third-Party Services
The App fetches live precious metal spot prices (Palladium, Platinum, Rhodium) from an external pricing API. No personal data is transmitted to this service — only the metal symbol and currency are sent as query parameters.
Three services handle data on our behalf. Each is a processor acting on our instructions, and none of them is allowed to use what it sees for its own purposes:
- Firebase Cloud Messaging (Google) delivers notifications to your phone. It receives the notification token and the text of the message. We use it as a delivery channel only: the App contains no Google analytics or advertising component, which is why it still shows no tracking consent prompt.
- Resend sends our email, the message that tells you your account is approved and the ones about your sell requests. It receives your email address and the content of the message, and stores it inside the European Union.
- Sentry records technical errors from our servers so we can fix them. It receives the kind of error and where in the code it happened, and its data is held inside the European Union. Our settings keep account details out of these reports.
10. Children
The App is intended for business use by adults (18+). We do not knowingly collect data from anyone under the age of 18. If you believe a minor has created an account please contact us immediately.
11. Changes to This Policy
We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of the App after changes constitutes acceptance of the revised policy.
12. Contact
For any questions or requests regarding your privacy:
- Email: [email protected]
- Website: kamrecycling.gr