SECTION 1: INTRODUCTION AND SCOPE
1.1 About this Privacy Policy
This Privacy Policy explains how KORX TECHNOLOGIES LLC, doing business as KORX (“KORX,” “we,” “us,” or “our”), collects, uses, discloses, retains, and protects Personal Information in connection with the KORX Platform. It also explains the privacy choices and rights that may be available to you. For purposes of this Privacy Policy, “Personal Information” means information that identifies, relates to, describes, or could reasonably be linked to an individual or household.
1.2 Who this Privacy Policy Applies To
This Privacy Policy applies to Personal Information relating to:
• Visitors;
• registered Users;
• Subscribers;
• Service Requesters;
• Service Providers;
• Business Users;
• Account Administrators;
• purchasers of KORX Paid Services; and
• other individuals who interact with KORX or whose Personal Information is processed through the Platform. Capitalized terms not defined in this Privacy Policy have the meanings assigned to them in the KORX Terms of Use.
1.3 Services Covered by this Privacy Policy
This Privacy Policy applies to Personal Information processed through:
• the KORX website;
• any KORX mobile application that links to this Privacy Policy;
• role-specific Accounts and Profiles;
• optional telephone and email confirmation, per-role Contact Method uniqueness, and Account-ownership resolution;
• Service Request creation, publication, display, and administration;
• private processing of exact Pickup, Origin, Destination, and Stop addresses;
• the Provider-Visible Projection of a Service Request;
• County registration, County Lifecycle measurement, geographic eligibility, and related notices;
• search, discovery, and approved filtering features;
• Share My Request, Share My Contact, and other approved Contact Access Features;
• optional identity verification for participating Service Providers through Didit, KORX's selected primary identity-verification provider, when the feature is enabled;
• Provider Membership, the First-Time Provider Membership Trial, advertising, and other Paid Services supplied directly by KORX;
• ratings, feedback, Platform reports, and related moderation;
• optional In-App, Email, SMS, and other approved notification channels;
• communications sent directly to KORX; and
• other Platform features that link to this Privacy Policy. A separate or supplemental privacy notice may apply to a specific feature where KORX expressly provides one.
1.4 KORX's Operating Model
KORX operates a digital listings, information, and contact-access Platform. Through the Platform:
• Service Requesters may create Service Requests and privately enter exact Pickup, Origin, Destination, and Stop addresses;
• KORX may process those exact addresses to determine the applicable Pickup / Origin County and calculate approved approximate distance and time information;
• KORX may publish or display only an approved Provider-Visible Projection of an eligible Service Request;
• Users may discover and evaluate eligible Service Requests and Service Provider Profiles;
• a Service Requester may use Share My Request to provide one selected eligible Service Provider at a time with access to the Provider-Visible Projection of one eligible Service Request;
• an eligible Service Provider may use Share My Contact, through a fresh request-specific authorization, to disclose only the selected verified Service Provider contact method or methods to the Service Requester associated with that specific Service Request, subject to the five-active-Interested-Provider limit; and
• Users independently decide whether to communicate, exchange additional precise meeting or access information, or enter into an arrangement outside the Platform. Exact Service Request addresses remain part of the private internal Service Request record. They are not made available to a Service Provider or the public through any Platform or User-directed feature. KORX also does not make the Service Requester's telephone number, email address, Account Gender, Home / Residence County associated with the Account, or other private Account or contact information available to a Service Provider through any Platform or User-directed feature. KORX does not:
• dispatch or assign Service Providers;
• select a Service Provider or Service Requester for another User;
• accept, book, or confirm a User-provided Service;
• set or negotiate prices between Users;
• monitor transportation routes or trips;
• provide continuous or background location tracking;
• determine whether a User-provided Service occurred;
• process payment for User-provided Services; or
• become a party to a Service Agreement between Users. KORX may charge Fees for Provider Membership, advertising, and other digital products or services supplied directly by KORX.
1.5 Communications and Activities Outside the Platform
After a Service Requester accesses contact information voluntarily shared by a Service Provider, communications between the Users occur independently outside the Platform. KORX does not ordinarily collect, monitor, record, or control:
• telephone calls between Users;
• direct text messages;
• direct emails;
• communications through external messaging services;
• precise meeting, entry, access, or Service-performance instructions exchanged directly between Users outside the Platform;
• negotiations between Users;
• payments for User-provided Services; or
• Service Agreements formed outside the Platform.
This Section does not apply to exact Pickup, Origin, Destination, or Stop addresses that a Service Requester enters through an authorized private Platform field. KORX processes that information as described in this Privacy Policy, but it is not included in the Provider-Visible Projection. This Privacy Policy does not govern how independent Users or Third-Party Services process information outside KORX's control. However, it applies if outside communications or other information are later submitted to KORX for support, a complaint, fraud prevention, safety review, legal process, or another legitimate Platform purpose.
1.6 Geographic Scope
As of this Privacy Policy's Effective Date, KORX is intended for use within the United States, New Jersey is the Platform's Authorized Service Area, and all twenty-one (21) New Jersey Counties are included in KORX's configured County-registration structure. Eligible Service Requesters and Service Providers may register in a configured New Jersey County while that County remains in the Building stage. Registration does not itself authorize publication of a Service Request. Service Request posting availability is determined separately for each County under the County Lifecycle and according to the Pickup / Origin County of the applicable Service Request. Once a County enters the Requester Posting Open stage, a later organic decline in Qualifying Provider Accounts or Qualifying Service Requests does not return that County to the Building stage or automatically close posting. KORX may separately restrict or suspend access to the Platform or a geographic feature where reasonably necessary for legal, security, fraud-prevention, safety, technical, maintenance, or operational reasons. Such a restriction is separate from the County Lifecycle and does not, by itself, reset or reverse the County's recorded lifecycle stage. Public portions of the Platform may remain accessible from outside an Authorized Service Area, but such access does not make geographically restricted features available outside an authorized area.
1.7 Acknowledgment of this Privacy Notice
By using the Platform after this Privacy Policy has been made available to you, you acknowledge that you have had an opportunity to review it. This Privacy Policy is a notice describing KORX’s privacy practices. It does not, by itself, constitute consent to processing that requires separate affirmative consent under Applicable Law. Where separate consent is required, KORX will request that consent through an appropriate notice or control.
1.8 Relationship to Other Documents
This Privacy Policy should be read together with:
• the KORX Terms of Use;
• CT-004 - KORX Platform Rules;
• any other Platform Policy expressly approved, published, and incorporated by KORX;
• feature-specific privacy notices;
• the KORX Cookie and Tracking Technologies Notice, if and when KORX publishes that notice;
• CT-005 — KORX Subscription, Billing, Cancellation & Refund Policy, where a KORX Paid Service is involved;
• CT-006 — KORX Copyright & DMCA Notice, if and when KORX approves and publishes that notice; and
• any Additional Terms applicable to a particular feature. The Terms of Use govern use of the Platform and the contractual relationship between KORX and its Users. CT-004 - KORX Platform Rules is the governing Platform Policy for User conduct, User Content, Listings, prohibited uses, reporting, safety-related Platform rules, and Platform enforcement. This Privacy Policy governs KORX's processing of Personal Information. If another KORX document describes the collection, use, disclosure, retention, or protection of Personal Information inconsistently with this Privacy Policy, this Privacy Policy controls with respect to that privacy matter, except where Applicable Law requires otherwise. Where Applicable Law provides a privacy right or protection that cannot legally be limited, that law will control.
SECTION 2: PERSONAL INFORMATION WE COLLECT
2.1 Information We Collect
The Personal Information KORX collects depends on how you use the Platform, the type of Account you maintain, and the features you choose to use. KORX may collect the categories of information described below.
2.2 Account and Profile Information
When you create or maintain an Account or Profile, KORX may collect:
• your name or approved public display name;
• email address and telephone number;
• the verification state of each telephone number and email address, verification timestamps, masked challenge destination, challenge outcome, and related security and audit metadata;
• records used to enforce one telephone number and one email address per Account role, resolve competing claims to an unverified Contact Method, detach a method from an unverified same-role Account after successful proof of control, and notify the prior Account;
• for a participating Service Provider, the Account and legal-name version to which a Didit check relates, the provider and session reference, verification result/status, relevant timestamps, consent record/version, invalidation reason, deletion status, and minimum necessary audit metadata;
• a limited verification record. KORX does not store government identity-document images, selfies, liveness recordings, biometric templates, full document numbers, or full Didit response payloads. Didit processes the disclosed source information for the optional check;
• authentication and Account-recovery information;
• the role-specific Account identifier, Account type, role, lifecycle status, and settings;
• where supported by KORX's identity system, records identifying the relationship between separate role- specific Accounts that use the same authorized email address or telephone number;
• Profile photograph;
• State, City, and ZIP Code;
• one selected Home / Residence County;
• Service Area Counties for Service Providers, where applicable;
• Service descriptions;
• general availability;
• business affiliation;
• vehicle information, including Vehicle Make, Model, Year, Vehicle Type, Passenger Capacity, and approved vehicle photographs, where applicable;
• notification preferences;
• Provider Membership, First-Time Provider Membership Trial, advertising, and other Paid Service status;
• Account Gender, where provided;
• the age confirmation applicable to the selected Account role; and
• other information you choose or are required to include in your Account or Profile.
Account Gender and Home / Residence County are private Account fields. They are not automatically included in a public Profile or Provider-facing Service Requester summary. In particular, a Service Requester's Account Gender is not displayed to a Service Provider through a Service Request, Share My Request, or Share My Contact. Account Gender, where offered, is optional and is used solely to record the User's self-identified gender in the User's private Account settings and allow the User to view, correct, or delete that entry. KORX does not use Account Gender for public display, Service Provider matching, filtering, ranking, eligibility, or Preferred Provider Gender. Where Applicable Law treats Account Gender as sensitive Personal Information or requires consent for its collection or use, KORX will request any required consent separately. Account Gender is separate from Preferred Provider Gender. Preferred Provider Gender, if selected by a Service Requester, is an optional, request-specific informational preference. It is not an eligibility requirement, ranking factor, or verification of any User's gender. Some other approved Profile information may be publicly visible or available to other Users as explained in Section 4. KORX may also maintain records of affirmative Account-related acknowledgments, consents, and acceptance actions, including:
• Terms of Use acceptance;
• Privacy Policy acknowledgment;
• CT-004 - KORX Platform Rules acknowledgment or acceptance, where required;
• confirmation that a natural person creating, controlling, administering, or using a Service Requester Account is at least eighteen (18) years of age;
• confirmation that a natural person creating, controlling, administering, or using a Service Provider Account is at least twenty-one (21) years of age;
• role-specific Platform acknowledgments;
• Provider compliance acknowledgments; and
• applicable notification, sensitive-data, recurring-payment, or marketing-consent choices. These records may include the Account ID and role, applicable document or policy version, acknowledgment or consent type, date and time, acceptance method, and reasonable technical audit context such as IP address or browser or Device information.
2.3 Business Account Information
If you create or manage a Business Account, KORX may collect:
• legal or trade name;
• business contact information;
• business address;
• website;
• company description, logo, or photographs;
• business-registration information, where collected for Account administration;
• names, role information, age confirmation where applicable, and contact details of authorized Account Administrators;
• billing information; and
• other information reasonably necessary to administer the Business Account. Information collected for billing, Account administration, identity, authorization, or security is not automatically displayed publicly. A Business User acting as a Service Requester and as a Service Provider must use separate role-specific Accounts. The information, permissions, history, ratings, entitlements, enforcement status, and deletion status associated with each Account remain separate, even where KORX's identity system permits the same authorized email address or telephone number to be associated with both Accounts. Within each role, KORX permits a telephone number and an email address to be associated with only one Account. The same method may be associated with one Service Requester Account and one separate Service Provider Account where permitted, but it may not create two Accounts in the same role. A natural person who creates, controls, administers, or uses a Business Service Provider Account must satisfy the minimum age applicable to a Service Provider Account.
2.4 Service Requests, Share My Request, and Share My Contact Information
When you create, publish, search for, view, save, share, or otherwise interact with a Service Request, KORX may collect:
• the type and description of the requested Service;
• requested dates, scheduled times, and stated waiting time;
• exact Pickup, Origin, Destination, and Stop addresses entered through designated private fields;
• unit, floor, access, entry, or meeting information entered in a private field, where the Platform expressly requests that information;
• derived City, County, State, and ZIP Code information for route points;
• the order of Pickup, Origin, Destination, and Stop locations;
• the Pickup / Origin County determined from the applicable exact address;
• approved approximate distance and time calculations;
• passengers, luggage, notes, and other approved request details;
• Budget, where optionally entered by the Service Requester;
• Preferred Provider Gender, where optionally selected;
• vehicle, equipment, accessibility, and other Service requirements;
• photographs or other permitted Content;
• Service Request status, cancellation status, publication history, and relevant scheduling history;
• search and discovery preferences;
• Service Request views, saves, or Favorites, where recorded; and
• activity involving Share My Request, Share My Contact, or another approved Contact Access Feature. For purposes of this Privacy Policy, “Exact Service Location Information” means the exact Pickup, Origin, Destination, and Stop addresses and related unit, access, coordinate, map-pin, or precise meeting-location information contained in the private internal Service Request record. KORX may process exact Service Request addresses, including through an authorized mapping or geocoding provider, to normalize the location, determine the applicable Pickup / Origin County, and calculate approved approximate distance and time information. Exact street addresses, unit or apartment numbers, precise coordinates, exact map pins, access codes, entry instructions, and precise meeting locations remain part of the private internal Service Request record. In User- facing Platform interfaces, they are available only to the Service Requester through an authorized private view. KORX and its authorized vendors or processors may access or process them only as reasonably necessary for Service Request administration, mapping or geocoding, calculation and recordkeeping, support, Platform-related complaint handling, security, fraud prevention, legal compliance, or protection of rights or safety. Other limited disclosures to professional advisers, governmental or legal recipients, or corporate-transaction participants are governed by Section 3.8. KORX does not disclose Exact Service Location Information to a Service Provider or the public. Any compelled disclosure is limited to valid legal process and Applicable Law. Any approved Service Provider-facing or public view is limited to the Provider-Visible Projection. Depending on the applicable feature and visibility setting, that projection may include:
• City, County, State, and ZIP Code for approved route points;
• the approved order of Pickup, Origin, Destination, and Stops;
• approved approximate distance and time;
• scheduled time and stated waiting time;
• Budget, where provided;
• Preferred Provider Gender, where provided; and
• other approved non-location, non-private Service Request fields. For Service Provider-facing or public views, geographic fields are limited to the listed City, County, State, and ZIP Code and approved approximate distance and time. The approved route-point order may be shown separately as
sequencing information, but it does not include an exact address, coordinate, map pin, place identifier, or other precise location field. The Provider-Visible Projection does not include the Service Requester's exact addresses, precise coordinates, exact map pins, access instructions, telephone number, email address, Account Gender, Home / Residence County associated with the Account, private Account City or ZIP Code, or other restricted Account or contact information. Share My Request When a Service Requester uses Share My Request, KORX may process:
• the Service Requester Account;
• the selected Service Provider Account;
• the applicable Service Request;
• the Provider-Visible Projection made available;
• the date and time of the share;
• whether the share is active, withdrawn, expired, consumed, or otherwise ended;
• whether access occurred before withdrawal, where recorded; and
• any later re-share event. Share My Request may provide one selected eligible Service Provider at a time with proactive access to the Provider-Visible Projection of one eligible Upcoming Service Request. It is not a broadcast and does not provide access to the complete internal Service Request record. A Service Provider who has already successfully used Share My Contact for that Service Request is not eligible to receive a new proactive Share My Request for the same Request. A withdrawal ends future proactive access under that share but cannot recall information already viewed, copied, or independently retained. A later share with another eligible Service Provider is recorded as a new event. Share My Contact When a Service Provider uses Share My Contact, KORX may process:
• the Service Provider Account;
• the Service Requester Account;
• the applicable Service Request;
• the telephone number and/or email address selected by the Service Provider for that disclosure;
• whether each selected contact method was verified at the time of disclosure;
• the active Interested Provider count, Response Limit Reached state, removal from Interested Providers, and the identity of the User who initiated the removal;
• the historical status preventing a removed Service Provider from re-sharing or automatically re-entering the same Service Request;
• any saved Contact Sharing Preference used to preselect an available method;
• the fresh, affirmative, request-specific authorization;
• the date and time of the authorization and disclosure;
• any optional Your Price or Provider Note;
• applicable eligibility, Provider Membership, and First-Time Provider Membership Trial status; and
• records concerning an optional In-App, Email, or SMS notification, including the applicable preference, dispatch, delivery, failure, or suppression status, where recorded. A saved Contact Sharing Preference may preselect an available contact method but does not itself authorize disclosure. Each Service Request requires a new final authorization, and the Service Provider must select at least one supported method before completing the disclosure. The Service Requester receives only the contact method or methods selected for that Service Provider and Service Request pair. KORX does not automatically add an unselected method from other Account information. Any successfully disclosed contact information, Your Price, and Provider Note form a historical disclosure snapshot. The completed disclosure cannot be retracted or recalled, and a later change to the Service Provider's Account or Profile does not rewrite that historical snapshot. A Share My Request or Share My Contact record does not establish that the Users communicated, formed a Service Agreement, made a payment, or that a User-provided Service occurred.
2.5 Photographs, Uploaded Content, and Metadata
KORX may collect photographs, images, documents, or other media that you choose or are permitted to upload, including:
• Profile photographs;
• vehicle or equipment photographs;
• company logos or images;
• Service Request photographs; and
• attachments submitted to KORX for an authorized Platform-support, security, legal, or enforcement purpose. Uploaded files may contain technical metadata, including file name, file type, date, Device information, or embedded location information. KORX may process or remove such metadata where reasonably necessary for security, display, privacy, or operation of an approved feature. Embedded precise-location metadata or other restricted metadata does not become Public Content merely because the related file is uploaded. KORX does not display or make embedded precise-location metadata or other restricted file metadata available to a Service Provider or the public. A User's deliberate entry of information into
an approved public or Provider-visible field is governed by the field-specific disclosures in this Privacy Policy, but the uploaded file's hidden metadata remains restricted. The collection or display of User-submitted information does not mean that KORX has independently verified the accuracy, identity, qualification, license, insurance, or other status represented by that information.
2.6 Provider Membership, Trial, Billing, and Payment Information
When you enroll in Provider Membership, begin a First-Time Provider Membership Trial, purchase Provider Profile Advertising or Request Advertising, or purchase another Paid Service supplied directly by KORX, KORX or its payment processor may collect:
• billing name and contact information;
• billing address;
• the Subscription, advertising product, or other Paid Service selected;
• the price and billing interval disclosed at enrollment or purchase;
• the date and time of enrollment, purchase, Trial commencement, renewal, cancellation, expiration, conversion, reactivation, or other status change;
• records showing whether a First-Time Provider Membership Trial is available, active, expired, canceled, converted, or previously consumed;
• the applicable recurring-payment disclosure and the User's affirmative authorization or consent;
• automatic-renewal status and paid-through date;
• transaction and receipt identifiers;
• payment method type;
• limited card information, such as card brand and last four digits;
• payment, refund, failed-payment, or chargeback status; and
• information reasonably necessary to administer the transaction or Paid Service. The County Membership Notice Period is a County-wide operational period and is not an individual Subscription trial. KORX may maintain the County stage and eligibility records necessary to determine whether Provider Membership or an active First-Time Provider Membership Trial is required for a particular Share My Contact action. The First-Time Provider Membership Trial is specific to the Service Provider Account and begins only after the Service Provider affirmatively enrolls, reviews the recurring price and renewal terms, provides or authorizes an approved payment method, completes any required recurring-payment authorization, and affirmatively starts the Trial. Complete payment-card information is collected directly by KORX's payment processor. KORX does not directly store complete payment-card numbers or card security codes.
2.7 Communications, Ratings, Feedback, Safety Signals, and Platform Reports
When you communicate directly with KORX, KORX may collect your name and contact information, Account information, the content of your communication, attachments, support or billing inquiries, privacy or legal requests, feedback, and records of KORX's response. Where a rating feature is available, KORX may collect:
• the selected star rating;
• selected rating categories;
• written feedback or explanations;
• the rater and rated Account identifiers and roles;
• the related Service Request and Share My Contact event identifiers;
• the successful Share My Contact date and time;
• the scheduled start, calculated scheduled end, stated waiting time, cancellation status, and last valid schedule used to determine rating eligibility;
• the User's affirmative confirmation that a genuine interaction occurred;
• the rating-opportunity opening and expiration times;
• the rating submission date and time;
• validity, moderation, exclusion, reinstatement, and internal-review status; and
• restricted Safety category or other internal review signals. A rating opportunity may be made available only after the applicable eligibility conditions are satisfied. The rating-eligibility time is the later of the first successful Share My Contact event for the applicable User pair and Service Request and the calculated scheduled end of the Service Request. If an eligible Service Request is canceled after Share My Contact, KORX may use the last valid schedule recorded before cancellation. An eligible rating opportunity remains open for ten (10) calendar days calculated using the America/New_York time zone. Cancellation does not by itself prove or disprove that a genuine interaction occurred. A submitted rating also does not establish that a User-provided Service was booked, paid for, performed, or completed. Individual star ratings, categories, original comments, explanations, identities attached to a rating record, Service Request identifiers, Share My Contact event identifiers, Safety indicators, and internal moderation information are private. They are not displayed to the rated User or the public. KORX may display an aggregate rating only after the applicable User has received at least ten (10) valid ratings from Users in the opposite Platform role. When displayed, the arithmetic average, rounded to one decimal place, and the number of valid ratings are displayed together. KORX may, where reasonably appropriate for support, safety, fraud prevention, or Platform enforcement, prepare and privately share with an affected User a separate KORX-authored, neutral, redacted summary. Such a summary
is not the original feedback and must not disclose individual stars, raw categories, original comments, the submitting User's identity, a Service Request identifier, or other restricted information. Selection of a Safety category creates a restricted internal review signal only. It is not proof that a violation or emergency occurred, is not an emergency-reporting service, and does not by itself create an automatic Account restriction, ranking change, or other enforcement action. KORX may also receive reports concerning Account access, KORX billing or payment, technical problems, security, fraud, Content or Platform misuse, or similar Platform-operation matters. If a person submits, retracts, or responds to a copyright complaint or related legal notice, KORX may collect the claimant's, authorized agent's, or affected User's identity and contact information; signatures; identification of the work and material; URLs or Platform identifiers; required statements and consents; allegations, explanations, court-action information, attachments, and evidence; and related correspondence, delivery, review, action, and case records. Until CT-006 is approved and published, a submission through a general contact route is not represented as delivery to a registered Designated Agent or as a statutory DMCA Notice or Counter-Notice. As of this Privacy Policy's Effective Date, KORX does not operate a User-to-User dispute-resolution workflow concerning the underlying Service relationship and does not adjudicate disagreements concerning a Service Agreement between Users.
2.8 Technical, Device, and Location Information
When you access or use the Platform, KORX and its authorized vendors or processors may automatically collect technical information, including:
• Internet Protocol address;
• browser and Device type;
• operating system;
• language and regional settings;
• Device or application identifiers;
• referring and exit pages;
• dates and times of access;
• pages, Profiles, Listings, or features viewed;
• searches, filters, buttons, or links used;
• login and authentication activity;
• notification, Share My Request, or Share My Contact activity;
• error and crash reports;
• security logs; and
• fraud-prevention indicators. As of this Privacy Policy's Effective Date, KORX does not request or collect continuous or background precise Device geolocation, does not provide live location tracking, and does not build a history of actual Device movements, trips taken, or routes actually traveled. Exact Pickup, Origin, Destination, and Stop addresses entered by a Service Requester through designated private fields are Service Request information supplied directly by the User; they are not continuous or background Device geolocation. KORX and its authorized vendors or processors may normalize or geocode an exact Service Request address and may derive coordinates, place identifiers, City, County, State, ZIP Code, route-point order, Pickup / Origin County, and approximate distance and time information as reasonably necessary to provide an approved Platform feature. Exact addresses, precise coordinates, place identifiers, and exact map pins are not included in the Provider-Visible Projection and are not made available to a Service Provider or the public through any Platform or User-directed feature. Approximate distance and time calculations are informational only. They do not constitute continuous tracking, route selection, navigation control, dispatch, trip monitoring, or a record that a User-provided Service occurred.
2.9 Cookies and Similar Technologies
KORX and its authorized vendors or processors may use cookies, local storage, pixels, software development kits, and similar technologies to:
• maintain login sessions;
• authenticate Accounts;
• protect security;
• remember preferences;
• operate Platform features;
• measure performance;
• understand Platform use;
• deliver requested notifications;
• prevent fraud; and
• support approved advertising or promotional features. Some technologies may be necessary for the Platform to function. Optional technologies may be subject to User choice where required by Applicable Law.
If and when KORX approves and publishes CT-003, the KORX Cookie and Tracking Technologies Notice, that notice will provide additional details concerning the technologies then in use and the choices available to Users.
2.10 Information From Other Sources
KORX may receive Personal Information from:
• payment processors;
• authentication providers;
• hosting and security providers;
• mapping, address-validation, geocoding, County-identification, and approximate distance or time providers;
• Email, SMS, In-App notification, analytics, or communication providers;
• app stores or billing channels actually used for an approved feature;
• public business or governmental records;
• other Users submitting authorized information, reports, or complaints; and
• other lawful sources. The information received depends on the relevant feature and the services performed by the source. A User who provides information concerning another person must have a lawful basis and appropriate authority to do so.
2.11 Required and Optional Information
Some Personal Information is required to:
• create, authenticate, recover, or secure a role-specific Account;
• confirm the age requirement applicable to the selected Account role;
• publish an eligible Profile or Service Request;
• determine the applicable County and County Lifecycle eligibility;
• calculate approved approximate distance and time information;
• complete Share My Request or Share My Contact;
• enroll in Provider Membership or a First-Time Provider Membership Trial;
• purchase a KORX Paid Service; or
• comply with legal, fraud-prevention, safety, or security requirements. To create or publish a Service Request, KORX may require the Service Requester to enter the applicable exact Pickup, Origin, Destination, and Stop addresses in designated private fields. Providing those addresses permits
KORX to process them for the disclosed Platform purposes but does not authorize their disclosure to a Service Provider or the public. Budget and Preferred Provider Gender are optional Service Request fields. Preferred Provider Gender is informational only and is not used to hide, exclude, suppress, rank, rank down, or determine the eligibility of an otherwise eligible Service Provider. To complete Share My Contact, the Service Provider must select at least one supported method—a telephone number, an email address, or both—and must provide a fresh, request-specific authorization. A saved preference may preselect a method but does not itself authorize disclosure. In-App, Email, and SMS notifications concerning Share My Contact are optional, settings-dependent, and subject to operational availability. No such channel or successful delivery is guaranteed. Failure or absence of a notification does not reverse or invalidate a completed contact disclosure. This optionality does not apply to legal, security, billing, Account, fraud-prevention, or other necessary notices that KORX may provide as permitted or required by Applicable Law. Other information is optional. You may decline to provide optional information, but failure to provide information reasonably necessary for a requested feature may prevent KORX from providing that feature. Users should not place exact addresses, telephone numbers, email addresses, access codes, or other private or sensitive information in a field intended to be displayed publicly or to Service Providers. Users should not submit other sensitive or unnecessary Personal Information unless KORX specifically requests it for a legitimate and disclosed purpose.
2.12 County Lifecycle and Eligibility Information
To administer geographic availability and the Provider Membership requirement, KORX may generate, collect, use, and maintain:
• the list of configured Counties and Authorized Service Areas;
• a User's selected Home / Residence County;
• whether a Service Provider Account satisfies the criteria for a Qualifying Provider Account;
• the County in which a Qualifying Provider Account is counted;
• the Pickup / Origin County derived for a Service Request;
• whether a Service Request satisfies the criteria for a Qualifying Service Request;
• the original successful publication date and time of a Qualifying Service Request;
• County-level Qualifying Provider Account and Qualifying Service Request threshold counts;
• rolling thirty (30)-calendar-day calculation records;
• the County's Building, Requester Posting Open, County Membership Notice Period, or Membership Active stage;
• the date and time of a County-stage transition;
• the commencement and scheduled expiration of the County Membership Notice Period;
• the Provider Membership or First-Time Provider Membership Trial eligibility result for a particular Share My Contact action; and
• any separate legal, security, fraud-prevention, safety, technical, maintenance, or operational restriction affecting Platform availability. Each Qualifying Provider Account is counted no more than once according to its selected Home / Residence County and only while it has at least one verified telephone number or verified email address and is not suspended or restricted. Verification of either method is sufficient. If the Account loses or replaces its only verified method before the County first opens, KORX removes it from the count until another method is verified. Service Area County selections do not increase the count. A selected Home / Residence County and Contact Method verification do not mean KORX independently verified residence. A Qualifying Service Request count is based on the applicable Pickup / Origin County and the recorded publication event. Every otherwise valid published Request may count whether or not the Service Requester has verified a telephone number or email address. A counted Service Request does not establish that a User-provided Service was booked, paid for, performed, or completed. A later organic decrease in Qualifying Provider Accounts or Qualifying Service Requests does not reset or reverse a recorded County Lifecycle stage. A separate legal, security, fraud-prevention, safety, technical, maintenance, or operational restriction does not, by itself, reset the County's recorded lifecycle stage.
SECTION 3: HOW WE USE AND DISCLOSE PERSONAL INFORMATION
3.1 How We Use Personal Information
KORX may use Personal Information to:
• create, authenticate, secure, and administer Accounts;
• verify control of telephone numbers and email addresses when a User chooses or is required for a selected feature to complete verification;
• enforce per-role Contact Method uniqueness and resolve ownership of a method initially associated with an unverified Account;
• administer the optional, no-charge Didit identity-verification feature for participating Service Providers and display or remove its limited “Identity Verified” or “ID Verified” status;
• maintain Accounts, Profiles, Service Request Listings, private Service Request records, and approved Provider-Visible Projections;
• privately process exact Pickup, Origin, Destination, and Stop addresses and related map information to identify the applicable Pickup / Origin County and calculate approximate distance and time;
• create, display, and transmit an approved Provider-Visible Projection without disclosing exact route addresses or other restricted Service Requester information;
• administer Share My Request, including selected-recipient access, withdrawal, consumption, and re- sharing events;
• administer Share My Contact, including request-specific authorization, selected contact methods, optional Your Price and Provider Note fields, disclosure records, and optional event notifications;
• administer County registration, County threshold counts, County Lifecycle stages, Provider Membership requirements, and First-Time Provider Membership Trial eligibility;
• administer Provider Membership, Provider Profile Advertising, Request Advertising, and other Paid Services supplied by KORX;
• administer ratings, private written feedback, aggregate rating displays, and restricted Safety-related review signals;
• communicate with Users and administer their notification preferences;
• respond to support requests, Platform-related complaints and reports, privacy requests, and appeals or enforcement-related communications;
• protect Users and the Platform;
• prevent fraud, misuse, scraping, spam, and unauthorized access;
• analyze and improve Platform performance;
• comply with Applicable Law; and
• establish, exercise, or defend legal rights. KORX uses Personal Information only for purposes reasonably related to operating, securing, administering, and improving the Platform or for another purpose permitted by Applicable Law. KORX's processing of exact Service Request addresses for County identification and approximate distance and time calculations does not include continuous or background Device geolocation, live location tracking, monitoring of a trip in progress, creation of a trip or route-history record, or selection or control of the route actually followed by Users.
3.2 Accounts, Profiles, and Listings
KORX may use Account, Profile, and Listing information to:
• register and authenticate Users;
• display permitted Profile and Listing information;
• organize Listings by category, date, general displayed location, availability, or other relevant criteria;
• provide User-selected search or discovery functions;
• administer public and restricted visibility settings;
• prevent misleading, fraudulent, unlawful, or duplicate Listings; and
• enforce the Terms of Use and CT-004 - KORX Platform Rules. Information designated for public display may be viewed by Visitors or other Users as described in Section 4. Where a Service Requester selects a Preferred Provider Gender, KORX uses that information only as an optional, informational, request-specific preference. It does not hide, exclude, suppress, rank, rank down, recommend, or make an otherwise eligible Service Provider or Service Request ineligible based on gender, and it does not guarantee that a Service Provider of the preferred gender will be available or will respond. KORX uses the selected Home / Residence County of each Qualifying Provider Account to calculate the applicable County count. Each Account is counted once only while it has at least one verified telephone number or verified email address and is not suspended or restricted. If its only verified method is lost or replaced before the County first opens, KORX removes the Account from the count until another method is verified. Service Area Counties do not increase the count. After a County opens, later count changes do not close or reverse it. KORX uses the Pickup / Origin County of each Qualifying Service Request to calculate whether the County has reached ten (10) Qualifying Service Requests within a rolling thirty (30)- calendar-day period. An otherwise valid published Request counts without regard to whether the Service Requester's telephone number or email address is verified. A Request that is invalid, fraudulent, failed, or a manipulative duplicate does not count because it is not a Qualifying Service Request, not because the Requester is unverified. KORX uses those counts, related timestamps, and recorded County stages to administer the County Lifecycle, including the Building, Requester Posting Open, County Membership Notice Period, and Membership Active stages. A later decline in Qualifying Provider Accounts or Qualifying Service Requests does not reset or reverse a County's recorded lifecycle stage. A separate legal, security, fraud-prevention, technical, or operational restriction may affect feature availability without changing the County's recorded lifecycle stage.
For Service Providers, Service Area Counties are maintained separately from Home / Residence County and may be used for approved discovery and notification-targeting functions. Selection of a Home / Residence County does not constitute KORX verification of residence.
3.3 Share My Request and Share My Contact
KORX may use Service Request, Service Provider contact, eligibility, and sharing-event information to:
• allow a Service Requester to share one eligible Upcoming Service Request with one selected eligible Service Provider at a time through Share My Request;
• provide the selected Service Provider with only the applicable Provider-Visible Projection and not the complete internal Service Request record;
• confirm that Share My Request is not being used as a broadcast and that no more than one proactive Share My Request grant is active for the same Service Request at the same time;
• prevent a new proactive Share My Request grant to a Service Provider who has already successfully used Share My Contact for the same Service Request;
• process a permitted Share My Request withdrawal before the selected Service Provider successfully uses Share My Contact;
• record a later permitted re-sharing action as a new event without deleting the earlier share or withdrawal record;
• confirm applicable Account, Service Request, County Lifecycle, Provider Membership, First-Time Provider Membership Trial, security, and other eligibility requirements;
• allow an eligible Service Provider to select at least one currently supported and verified contact method for voluntary disclosure to the Service Requester associated with a specific Service Request;
• obtain a fresh, affirmative, request-specific Share My Contact authorization;
• pause the Share My Contact flow if a selected method is unverified, conduct the applicable confirmation challenge, and return the Provider to the same request-specific flow only after successful verification;
• enforce no more than five active Interested Providers for a Service Request and display “Response Limit Reached” when the limit is full;
• allow the Service Requester to use “Remove from Interested Providers” to free one position for another eligible Provider while preserving the prior disclosure history;
• prevent a removed Provider from re-sharing or automatically re-entering the same Service Request;
• provide only the selected verified contact method or methods to that Service Requester;
• transmit an optional Your Price or Provider Note where the Service Provider chooses to submit one;
• create and preserve a historical record of the completed disclosure;
• administer optional Share My Contact notifications according to the Service Requester's enabled settings and available functionality;
• prevent unauthorized, excessive, automated, fraudulent, or abusive use; and
• enforce the Terms of Use and CT-004 - KORX Platform Rules. As of this Privacy Policy's Effective Date, the Share My Contact methods made available by KORX are a telephone number and email address. WhatsApp, an external website or contact link, and an unspecified other contact method are not available Share My Contact methods. A saved Contact Sharing Preference may preselect a method for convenience but does not itself authorize disclosure. KORX does not complete a Share My Contact disclosure until the Service Provider gives the required request-specific authorization. KORX does not use Share My Request or Share My Contact to disclose the Service Requester's telephone number, email address, exact Pickup, Origin, Destination, or Stop addresses, precise coordinates, exact map pins, access instructions, Account Gender, Home / Residence County, or other restricted Account information to the Service Provider. A withdrawal, edit, or later change cannot recall information already viewed, copied, disclosed, or independently retained. A completed Share My Contact event forms a historical disclosure snapshot and cannot be retracted through a later Profile, preference, or contact-information change. A Share My Request or Share My Contact event does not establish that the Users communicated, formed a Service Agreement, made a payment, or that a User-provided Service occurred.
3.4 County Access, Provider Membership, Trials, and Paid Services
KORX may use County Lifecycle, Provider Membership, First-Time Provider Membership Trial, billing, authorization, and transaction information to:
• determine whether Share My Contact is available for a Service Request without Provider Membership based on the Request's controlling Pickup / Origin County;
• distinguish the County Membership Notice Period from the separate, one-time First-Time Provider Membership Trial associated with an eligible Service Provider Account;
• determine whether a Service Provider Account has previously started, used, canceled, converted from, or otherwise consumed its First-Time Provider Membership Trial;
• confirm affirmative Provider Membership enrollment, payment-method authorization, and recurring- billing consent before starting the First-Time Provider Membership Trial;
• administer automatic conversion from the Trial to paid monthly Provider Membership where the Service Provider has provided the required authorization and does not timely cancel;
• process Provider Membership, Provider Profile Advertising, Request Advertising, and other Paid Services supplied by KORX;
• activate, maintain, suspend, cancel, resume, reactivate, or expire the applicable Paid Service;
• administer renewals and cancellations;
• issue billing notices, transaction histories, receipts, refund records, or credits;
• prevent payment and promotional abuse;
• respond to chargebacks or billing disputes; and
• maintain appropriate accounting, tax, audit, and legal records. The County Membership Notice Period begins automatically for an eligible County and does not require individual enrollment or payment information. It is not an individual Subscription trial and does not consume the Service Provider Account's First-Time Provider Membership Trial. The First-Time Provider Membership Trial does not begin automatically when a User registers, when a County opens for Requester Posting, when a County enters its County Membership Notice Period, or merely because the User views a checkout screen. It begins only after the required affirmative enrollment, payment-method authorization, recurring-billing consent, and successful Trial activation. KORX will not start or consume the First-Time Provider Membership Trial solely for a Share My Contact action controlled by a County that is still in Building, Requester Posting Open, or its County Membership Notice Period, because Provider Membership is not then required for that County. The Trial may apply concurrently across that Service Provider Account while one County remains in its Notice Period only where the Service Provider affirmatively enrolls to satisfy the Provider Membership requirement for an otherwise eligible Share My Contact action controlled by a different County that is already Membership Active. If the applicable County Membership Notice Period has already expired before the Service Provider enrolls, the Provider does not receive that expired County-wide period retroactively. The Provider may receive only the separate First-Time Provider Membership Trial, if the Service Provider Account remains eligible and has not previously consumed it. Payment information processed for KORX Paid Services is separate from any price, fare, reimbursement, tip, or payment independently exchanged between Users for a User-provided Service.
3.5 Security and Fraud Prevention
KORX may use Personal Information to:
• protect Accounts from unauthorized access;
• confirm Account ownership where reasonably necessary;
• detect suspicious or fraudulent activity;
• prevent impersonation, fraud, scraping, duplicate-Account abuse, or misuse;
• protect KORX payment transactions;
• investigate suspected violations of the Terms of Use or CT-004 - KORX Platform Rules; and
• protect the security and integrity of the Platform. Where KORX maintains a limited link between separate Service Requester and Service Provider Accounts for an authorized security, fraud-prevention, billing, legal, or enforcement purpose, that linkage does not merge the Accounts or automatically apply an action taken on one Account to the other. Any enforcement action affecting the other Account must have an independent basis under the Terms of Use, CT-004 - KORX Platform Rules, or Applicable Law. This Privacy Policy describes only the related processing of Personal Information and records. Account-security and fraud-prevention activities do not create a general verification status. Separately, KORX may display “Verified” beside a telephone number or email address after successful confirmation of control, and may display “Identity Verified” or “ID Verified” for a participating Service Provider only after a successful result from the approved external identity-verification provider. These labels have the limited meanings stated in this Privacy Policy.
3.6 Communications, Support, Ratings, Safety Signals, and Platform Reports
KORX may use information submitted directly to KORX to:
• respond to Account or support requests;
• administer Accounts, Provider Membership, and KORX Paid Services;
• investigate technical or security issues;
• process cancellation or refund requests relating to KORX Paid Services;
• address fraud, Content misuse, or other suspected violations of the Terms of Use or CT-004 - KORX Platform Rules;
• process privacy or legal requests;
• respond to legal notices; and
• maintain appropriate operational or legal records.
KORX may also receive, evaluate, preserve, and respond to copyright and other legal complaints and, if and when CT-006 becomes effective, administer the notice, counter-notice, retraction, forwarding, restoration, court-action, and repeat-infringer procedures described there. KORX may use ratings, rating categories, private written feedback, and related information for rating administration, support, safety review, fraud prevention, handling Platform-related complaints, and enforcement under the Terms of Use or CT-004 - KORX Platform Rules. Individual stars, raw categories, original comments, the submitting User's identity, and related internal review information remain restricted as described in Sections 2.7 and 4.9. If KORX determines that a communication to the affected User is reasonably appropriate, KORX may prepare a separate, neutral, redacted summary authored by KORX. KORX will not provide the affected User with the original written feedback, either in whole or as a purported redacted copy. Selection of a Safety category creates a restricted internal review signal. It is not proof that a violation or emergency occurred, is not an emergency-reporting method, and does not by itself create an automatic Account restriction, rating adjustment, ranking change, or other enforcement action. As of this Privacy Policy's Effective Date, KORX does not use this support process to adjudicate disputes concerning the terms, price, payment, performance, quality, or outcome of a User-provided Service or Service Agreement between Users. This Section does not authorize KORX to monitor communications occurring independently between Users outside the Platform.
3.7 Notifications, Analytics, and Advertising
KORX may use Personal Information and technical information to:
• send legal, security, Account, billing, fraud-prevention, and other necessary non-promotional notices;
• deliver optional Listing, County-availability, rating-reminder, and other feature notifications according to applicable User settings;
• notify a Service Requester of a successful Share My Contact event through one or more enabled In-App, Email, or SMS channels;
• administer In-App, Email, and SMS notification preferences and record notification creation, dispatch, suppression, failure, or delivery status where available;
• prevent duplicate or abusive notifications;
• measure Platform performance;
• identify technical errors or crashes;
• understand how Users interact with the Platform;
• improve features and accessibility;
• administer Provider Profile Advertising, Request Advertising, or sponsored Content; and
• measure general impressions or interactions. In-App, Email, and SMS notifications concerning a Share My Contact event are optional, settings-dependent, and subject to operational availability. No such channel is mandatory or guaranteed. A notification's absence, delay, suppression, failure, nonreceipt, or failure to be opened does not invalidate or reverse the underlying authorized Share My Contact disclosure. Preferences applicable to optional or event-specific notifications do not prevent KORX from providing legal, security, Account, billing, fraud-prevention, or other necessary non-promotional notices where permitted or required by Applicable Law. Optional Listing and feature notifications are informational only and do not constitute matching, dispatch, assignment, recommendation, acceptance, booking, or confirmation of a Service. Additional information concerning cookies, analytics, and advertising appears in Section 5.
3.8 How We Disclose Personal Information
KORX may disclose Personal Information to the following categories of recipients: Visitors and Other Users Information may be disclosed through approved public Service Provider Profiles, limited Service Requester summaries, Provider-Visible Projections, public Listings, aggregate rating information, or other features selected or authorized by the User. Public or Provider-visible information does not include exact Service Request addresses, private Account Gender, private Account-location information, private contact information, or raw rating and feedback records. Selected Service Providers Receiving Share My Request Information Where an eligible Service Requester uses Share My Request, KORX may make only the applicable Provider-Visible Projection available to one selected eligible Service Provider at a time. KORX does not disclose the complete internal Service Request record, exact route addresses, or the Service Requester's private contact or Account information through Share My Request. Service Requesters Receiving Provider-Shared Contact Information Where an eligible Service Provider affirmatively completes Share My Contact, KORX may disclose only the verified telephone number and/or verified email address selected by that Service Provider to the Service Requester associated with the applicable Service Request. KORX does not disclose an unverified method or fill a missing selection from other Account
information. Where submitted, KORX may also disclose the optional Your Price and Provider Note associated with that event. A Request is limited to five active Interested Providers, subject to the Requester's removal control described in this Privacy Policy. Vendors and Contractors KORX may provide information to vendors and contractors that perform services such as:
• hosting and storage;
• Account authentication; telephone and email confirmation;
• mapping, address validation, geocoding, County identification, and approximate distance or time calculation;
• payment processing;
• In-App, Email, and SMS notification delivery;
• analytics and error reporting;
• security and fraud prevention;
• User-support systems;
• optional Service Provider identity verification through Didit, including government identity-document verification, passive liveness, face matching, and device/IP analysis, with a limited verification record returned to KORX; and
• other technical or operational functions. KORX limits disclosures to information reasonably necessary for the authorized services those recipients perform. A mapping or geocoding provider may process an exact Service Request address where reasonably necessary to perform an approved calculation, but that processing does not make the address available to a Service Provider or the public. For the optional identity check, KORX determines its purpose and permitted use; Didit processes verification information on KORX's behalf and also describes certain limited independent processing in its own notices. KORX does not transfer its privacy responsibilities merely by using Didit. KORX's instructions require separate affirmative consent, the disclosed four-check workflow, minimized local records, and prompt deletion of session evidence after the necessary result is safely recorded and any pending review is resolved. Additional details appear in Section 7.6 below.
Professional Advisers KORX may disclose information to attorneys, accountants, insurers, auditors, cybersecurity advisers, and other professional advisers where reasonably necessary. Governmental and Legal Recipients KORX may disclose information where reasonably necessary to:
• comply with Applicable Law;
• respond to valid legal process;
• protect rights, safety, property, or security;
• investigate suspected unlawful activity; or
• establish, exercise, or defend legal claims. Copyright Claimants, Affected Users, and Authorized Agents Where reasonably necessary to administer a copyright or related legal process, KORX may provide a complaint, notice, counter-notice, retraction, or relevant portions—including submitted names, addresses, telephone numbers, email addresses, signatures, statements, allegations, and evidence—to the claimant, affected User, their authorized agents, a service provider, a court, or another legally authorized recipient, as permitted or required by Applicable Law. Such legal submissions should not be expected to remain confidential. Corporate Transaction Participants Information may be disclosed in connection with a proposed or completed merger, financing, acquisition, restructuring, sale of assets, or similar corporate transaction, subject to Applicable Law and appropriate confidentiality or data-protection measures where required. User-Directed Recipients KORX may disclose information where the affected User requests, directs, or authorizes the disclosure, subject to the feature-specific limitations stated in this Privacy Policy. A general User direction or Profile preference does not expand Share My Request or Share My Contact beyond their approved disclosure boundaries. Depending on the recipient and authorized purpose, the categories of Personal Information disclosed may include Account and contact information, Profile and Listing information, limited Service Request information, Subscription and transaction information, technical and Device information, and communications, reports, or support information described in Section 2. Exact Service Request addresses and other restricted information may be disclosed only to an authorized vendor or contractor, professional adviser, governmental or legal recipient, or corporate-transaction participant where reasonably necessary for the recipient's authorized purpose and subject to Applicable Law and appropriate safeguards. KORX does not disclose exact Service Request
addresses or other restricted Service Request location information to a Service Provider or the public through the Platform or any User-directed feature.
3.9 Public, Restricted, and User-Authorized Disclosures
Information included in approved public Service Provider Profiles, Provider-Visible Projections, Listings, photographs, aggregate rating information, or other Public Content may be viewed, copied, cached, indexed, captured, or independently retained by others. Users should not place sensitive, confidential, exact-location, or unnecessary Personal Information in any field designated for public or Provider-visible display. A Service Requester's Account Gender, full name, private telephone number, private email address, Home / Residence County, Account City or ZIP Code, and exact Pickup, Origin, Destination, or Stop addresses are not part of the Provider-Visible Projection. Share My Request makes a limited Provider-Visible Projection available to one selected eligible Service Provider at a time. It does not authorize disclosure of the complete internal Service Request record. Restricted Service Provider contact information is disclosed only when the Service Provider completes a fresh, affirmative, request-specific Share My Contact authorization. The Service Requester receives only the verified telephone number and/or verified email address selected by the Service Provider, together with an optional Your Price or Provider Note where submitted. Removing a Provider from Interested Providers changes future active-list status but does not recall a prior disclosure. A completed disclosure cannot be recalled from a recipient who has already viewed, copied, or independently retained it. Withdrawal of an active Share My Request grant or a later change to a Provider Profile, contact method, or preference applies prospectively and does not rewrite a prior disclosure record. KORX does not disclose a Service Requester's private telephone number, email address, exact route addresses, or other restricted Account information to a Service Provider through Share My Request or Share My Contact. Copyright complaints, notices, counter-notices, and related legal submissions are restricted legal records rather than Public Content, but KORX may disclose them or relevant portions to the participants and recipients described in Section 3.8 when reasonably necessary and permitted or required by Applicable Law. Further information concerning Profiles, Listings, visibility, Share My Request, and Share My Contact appears in Section 4.
3.10 Sale, Sharing, and Targeted Advertising
As of this Privacy Policy's Effective Date, KORX does not sell Personal Information, share Personal Information for cross-context behavioral advertising, or process Personal Information for targeted advertising, as those terms are defined under Applicable Law. In particular, KORX does not sell, offer for sale, or license Sensitive Data, including Exact Service Location Information that constitutes Precise Geolocation Data, as those terms are defined by Applicable Law. User-directed disclosures through Share My Request and Share My Contact are limited disclosures used to provide features requested by the applicable User. They are not described by KORX as a sale of Personal Information, subject to any different classification required by Applicable Law. KORX may display contextual advertising, sponsored Content, Provider Profile Advertising, or Request Advertising based on information such as the current page, Service category, approved Profile or Service Request information, or City, County, State, or ZIP Code information approved for display. KORX will periodically review its advertising, analytics, and vendor practices for consistency with this statement. If KORX materially changes these practices, KORX will update this Privacy Policy and provide any notice, consent mechanism, or opt-out right required by Applicable Law before the change becomes effective.
3.11 Aggregated and Deidentified Information
KORX may create and use aggregated or deidentified information for analytics, security, fraud prevention, Platform improvement, performance measurement, business planning, and research concerning Platform use. KORX will take reasonable measures designed to prevent deidentified information from being associated with an identified or identifiable individual. KORX will maintain and use such information in deidentified form and will not attempt to reidentify it, except where permitted by Applicable Law to test the effectiveness of deidentification measures. Where KORX discloses deidentified information, KORX will require the recipient to maintain it in deidentified form and not attempt to reidentify it.
3.12 Uses Not Permitted Under the Current Operating Model
As of this Privacy Policy's Effective Date, KORX does not use Personal Information to:
• dispatch or assign Service Requesters to Service Providers or Service Providers to Service Requesters;
• book, accept, or confirm a User-provided Service;
• select, direct, require, monitor, or control the route actually followed by Users;
• provide continuous or background Device geolocation or live trip tracking;
• create a history of trips or routes actually traveled;
• set, approve, or negotiate the final price of a User-provided Service;
• determine solely from a Share My Request, Share My Contact, rating, or cancellation event that a User- provided Service occurred;
• process payments between Users for User-provided Services; or
• monitor communications occurring independently between Users outside the Platform. KORX may privately process exact Pickup, Origin, Destination, and Stop addresses to identify the applicable Pickup / Origin County and calculate informational estimates of distance and time. That limited processing is not dispatch, navigation control, route selection, live tracking, or supervision of a User-provided Service. Any materially different future use will require an update to this Privacy Policy and any notice, choice, consent, or other measure required by Applicable Law.
SECTION 4: PUBLIC PROFILES, LISTINGS, AND CONTACT ACCESS
4.1 Public and Restricted Information
Some information submitted through the Platform may be:
• publicly visible;
• available only to registered Users;
• available only to registered or otherwise eligible Users based on role, feature, or Platform requirements;
• disclosed only with the affected User’s authorization; or
• retained only for Account administration, billing, security, support, or legal compliance. The collection of Personal Information by KORX does not mean that all such information will be displayed publicly or made available to every User.
4.2 Service Provider Profiles and Service Requester Summaries
KORX may permit Service Providers to maintain Profiles that are publicly visible or otherwise available through approved Platform features. A Service Provider Profile may display information permitted by KORX, such as:
• First Name and Last Initial or other approved display information;
• an approved Profile photograph;
• business name or logo, where applicable;
• selected Service Area Counties or another approved general service area;
• descriptions of independently offered Services;
• approved vehicle information, including Vehicle Make, Model, Year, Vehicle Type, Passenger Capacity, and Vehicle Photo;
• general availability;
• the aggregate rating average and valid-rating count where the public-rating threshold in Section 4.9 has been met; and
• other information expressly approved for Profile display;
• a “Verified” label beside a telephone number or email address only on an authorized surface that displays that method and only while its confirmation remains current; and
• an optional “Identity Verified” or “ID Verified” badge for a Service Provider only after a successful external-provider result, with a disclosure that it confirms identity only and does not verify a driver's license, vehicle, insurance, background, qualifications, or legal eligibility to provide Services. A Service Provider's full legal name, Account Gender, Home / Residence County, private Account City or ZIP Code, telephone number, email address, exact location, complete payment information, security information, and nonselected contact methods are not public merely because KORX collects or verifies them. Any verification label is limited to the specific status it describes and does not convert the underlying private value into Public Content. Under the current Platform design, Service Requesters do not have a standalone public Profile available for Service Providers to browse. KORX may instead display a limited Service Requester summary only in connection with a particular eligible Service Request. That summary may include:
• First Name and Last Initial;
• an approved Profile photograph, where applicable;
• Member Since information;
• Requests Posted count; and
• the aggregate rating average and valid-rating count where the public-rating threshold in Section 4.9 has been met. The Service Requester's Account Gender is private and must not be included in the Service Requester summary. A Preferred Provider Gender selected for a particular Service Request is a separate optional, informational request field. It is not the Service Requester's Account Gender and does not identify the Service Requester's gender. It is not used to filter, exclude, suppress, rank, or guarantee a Service Provider.
KORX does not disclose through the Requester summary the Service Requester's full name, telephone number, email address, birth date, Account Gender, Home / Residence County, residential or Account address, private Account City, or private Account ZIP Code. City, County, State, and ZIP Code displayed as part of a Service Request describe the applicable requested-service location and are distinct from the Service Requester's private Account or residential-location information.
4.3 Exact Service Addresses and Provider-Visible Service Request Information
To submit an eligible Service Request, the Service Requester must enter the detailed Pickup or Origin address and the detailed Destination and Stop addresses applicable to the Request in the private address fields provided by KORX. KORX may store and privately process those addresses and related map information to:
• validate or standardize an entered address;
• identify the controlling Pickup / Origin County;
• calculate approximate distance and time;
• apply the applicable County Lifecycle and Provider Membership rules; and
• administer the Service Request and related Platform records. The Service Requester may view the exact entered addresses through the Service Requester's authorized private view. Any approved Service Provider-facing or public view is limited to an approved Provider-Visible Projection. Depending on the approved Request type, feature, and visibility setting, that projection may include:
• the type and description of the requested Service;
• requested date, schedule, and general time information;
• stated waiting time;
• passengers, luggage, notes, or other approved non-location, non-private Request details;
• Budget (Optional);
• Preferred Provider Gender (Optional and informational only);
• vehicle, equipment, accessibility, or other Service requirements;
• approved photographs or other permitted Content;
• City, County, State, and ZIP Code for Pickup, Origin, Destination, and Stop points;
• the approved order of route points; and
• approximate distance and time calculated from the privately submitted detailed addresses. All Service Provider-facing or public geographic fields are limited to the listed City, County, State, and ZIP Code and approved approximate distance and time. The approved route-point order may be shown separately as
sequencing information, but it does not include an exact address, coordinate, map pin, place identifier, or other precise location field. KORX excludes Exact Service Location Information from Service Provider-facing and public views even if a User places it in a description, note, photograph, or other field not designated for private location information. KORX may block, suppress, redact, or remove such content. Users must enter Exact Service Location Information only in the designated private fields. The Provider-Visible Projection does not include:
• an exact street address;
• a building, unit, apartment, suite, or floor number;
• precise coordinates or an exact map pin;
• an access code, entry instruction, exact meeting point, or other precise access detail;
• the Service Requester's Home / Residence County or private Account City or ZIP Code;
• the Service Requester's Account Gender;
• the Service Requester's telephone number or email address; or
• the complete internal Service Request record. Exact route addresses are not disclosed to a Service Provider through a Listing, Share My Request, or Share My Contact. Users are responsible for exchanging any exact meeting, access, or service-performance details they choose to exchange independently outside KORX after contact has been established. KORX's address processing does not include continuous or background Device geolocation, live trip tracking, monitoring of a route actually followed, or creation of trip or route-history records.
4.4 Public Availability and Search Engines
Public Service Provider Profiles, Listings, Provider-Visible Projections made publicly accessible, and other Public Content may be viewed by Visitors and other Users. Public Content may also be:
• indexed or cached by search engines;
• copied or saved by other persons;
• displayed through link previews;
• photographed or captured by screenshot; or
• retained by external services. Users should not include sensitive, confidential, exact-location, or unnecessary Personal Information in public or Provider-visible fields. Exact Pickup, Origin, Destination, and Stop addresses; unit information; precise coordinates; exact map pins; private access instructions; Account Gender; private Account-location fields; raw ratings; original feedback; and
restricted contact information are not Public Content merely because KORX collects them. KORX does not make those restricted fields publicly accessible or expose them for public search-engine indexing. Service Provider Profiles may be indexed by public search engines where KORX permits. KORX may use technical measures designed to discourage public search-engine indexing of Service Request Listings and limited Service Requester information. KORX cannot guarantee that an external service will not index, cache, copy, or retain information that was actually made publicly accessible.
4.5 County Lifecycle and Share My Contact Eligibility
Viewing a public Profile, Provider-Visible Projection, or Service Request Listing does not automatically include access to restricted contact information or permission to use Share My Contact. Eligible Service Requesters and Service Providers may register while a configured New Jersey County remains in the Building stage. Registration does not itself open Service Request posting or activate Share My Contact. KORX evaluates the following lifecycle separately for each configured County: (a) Building. A County remains in Building while it has fewer than thirty (30) Qualifying Provider Accounts counted according to the Service Provider Account's selected Home / Residence County. Service Request posting controlled by that County is not yet available. Because no eligible Service Request controlled by that County may yet be posted, Share My Contact is not available for that County. (b) Requester Posting Open. When the County first reaches thirty (30) Qualifying Provider Accounts, Service Request posting opens for that County. An otherwise eligible Service Provider may use Share My Contact for an eligible Service Request controlled by that County without paid Provider Membership. (c) County Membership Notice Period. After Requester Posting has opened, the first occurrence of at least ten (10) Qualifying Service Requests controlled by the County being posted during a rolling thirty (30)-calendar-day period begins one thirty (30)-calendar-day County Membership Notice Period. During that County-wide period, an otherwise eligible Service Provider may continue to use Share My Contact for an eligible Service Request controlled by that County without paid Provider Membership. (d) Membership Active. When the County Membership Notice Period expires, the County becomes Membership Active. An otherwise eligible Service Provider must then have either an active paid Provider Membership or an applicable active First-Time Provider Membership Trial to use Share My Contact for a Service Request controlled by that County. The controlling County is the Pickup County for a One Way Request and the Origin County for a Round Trip or Multi-Destination Request. The Service Provider's Home / Residence County, selected Service Area Counties, Destination Counties, and Stop Counties do not control whether Provider Membership is required for a particular Share My Contact action.
The County Membership Notice Period is County-wide and is not an individual Subscription trial, purchase, credit, or promotional offer. It begins automatically, requires no individual enrollment or payment method, and does not consume the Service Provider Account's First-Time Provider Membership Trial. A Provider who registers or becomes eligible after the Notice Period begins receives only its unexpired remainder; the period is not restarted or extended for that Provider. The First-Time Provider Membership Trial is a separate, one-time thirty (30)-calendar-day Account trial. It begins only after the Service Provider completes the required affirmative Provider Membership enrollment, payment- method authorization, recurring-billing consent, and successful Trial activation. It does not begin automatically because the Provider registers, because a County opens for Requester Posting, because a County enters its County Membership Notice Period, or merely because the Provider views a checkout screen. KORX does not start or consume the First-Time Provider Membership Trial solely for an action controlled by a County in Building, Requester Posting Open, or the County Membership Notice Period. It may run concurrently with one County's Notice Period only where the Service Provider affirmatively enrolls because a different Service Request is controlled by a County that is already Membership Active and the Trial is needed to satisfy that Request's Provider Membership requirement. If the County Membership Notice Period has expired before the Service Provider enrolls, the Provider does not receive that expired County-wide period retroactively and may receive only the separate First-Time Provider Membership Trial, if the Service Provider Account remains eligible and has not previously consumed it. Provider Membership and the First-Time Provider Membership Trial apply across the applicable Service Provider Account and do not extend to a separate Service Requester Account. They are not purchased or assigned separately for each County. County progression is one-way. Once Service Request posting has opened for a County, a later decline in Qualifying Provider Account or Qualifying Service Request counts does not automatically close posting, return the County to Building, or pause, restart, reset, or extend its County Membership Notice Period. A separate legal, security, fraud-prevention, safety, technical, maintenance, or operational restriction may affect feature availability without resetting or reversing the County's recorded lifecycle stage. Share My Contact eligibility may also depend on:
• Account role and status;
• the status and eligibility of the applicable Service Request;
• the controlling Pickup / Origin County;
• Provider Membership or First-Time Provider Membership Trial status where required;
• applicable Share My Request status;
• usage limits;
• security or fraud-prevention considerations;
• the Terms of Use and CT-004 - KORX Platform Rules; and
• Applicable Law. KORX may restrict or deny Share My Contact where it reasonably believes the feature is being used for scraping, spam, harassment, fraud, unauthorized collection, or another prohibited purpose.
4.6 Request-Specific Authorization for Share My Contact
KORX discloses a Service Provider's selected contact method or methods only when that Service Provider provides a fresh, affirmative authorization for the specific Service Request and the specific Service Requester associated with that Request. Before each disclosure, the Service Provider must:
• review the applicable Service Request and intended Service Requester recipient;
• select at least one currently supported contact method;
• confirm that each selected method is accurate, lawful, and authorized for disclosure; and
• affirmatively complete the request-specific Share My Contact action. As of this Privacy Policy's Effective Date, the available Share My Contact methods are:
• telephone number; and
• email address. WhatsApp, an external website or contact link, generic business contact information not selected through the feature, and an unspecified other contact method are not current Share My Contact methods. A saved Contact Sharing Preference may preselect an available method for convenience, but saving a preference, opening Share My Contact, viewing a Service Request, receiving Share My Request, or adding a Request to Favorites does not itself authorize or complete disclosure. The Service Requester receives only the contact method or methods selected for that specific Service Provider and Service Request pair. KORX does not supplement a missing selection with another telephone number, email address, or contact value stored elsewhere in the Service Provider Account. Where the feature permits, the Service Provider may also submit an optional Your Price and an optional Provider Note. Those fields are informational and request-specific. They are not a KORX-approved quote, fare, invoice, payment request, or guarantee. A successful Share My Contact action creates a historical disclosure snapshot consisting of the selected contact information and any optional Your Price or Provider Note submitted with the event. The Service Provider cannot retract that completed disclosure, and a later change to the Provider's Profile, contact information, or saved preference does not rewrite the historical snapshot. KORX may notify the associated Service Requester through one or more enabled In-App, Email, or SMS channels. Each channel is optional, settings-dependent, and subject to operational availability. KORX does not guarantee
notification creation or sending time, delivery, receipt, or opening. The absence, delay, suppression, failure, or nonreceipt of a notification does not invalidate or reverse the completed Share My Contact disclosure. The optional-notification rule applies to Share My Contact event notifications. It does not make legal, security, Account, billing, fraud-prevention, or other necessary non-promotional notices optional where KORX may lawfully provide them. KORX does not disclose the Service Requester's telephone number, email address, exact Pickup, Origin, Destination, or Stop addresses, precise coordinates, exact map pins, Account Gender, Home / Residence County, or other private Account information to the Service Provider through Share My Contact or Share My Request. Authorization to share a Service Provider's contact information does not constitute:
• acceptance of a Service Request;
• selection, recommendation, dispatch, or assignment of a Service Provider by KORX;
• confirmation of availability;
• agreement concerning price;
• booking or reservation;
• formation of a Service Agreement;
• payment for or performance of a User-provided Service; or
• consent to unrelated marketing.
4.7 Share My Request and Share My Contact Audit Records
KORX may maintain request-specific audit records concerning Share My Request and Share My Contact activity. For Share My Request, records may include:
• the Service Requester Account;
• the selected Service Provider Account;
• the applicable Service Request;
• the Provider-Visible Projection or the version of that projection made available;
• the date and time the share was created;
• whether another proactive Share My Request grant was active for the same Service Request;
• whether the selected Service Provider had already successfully used Share My Contact for that Service Request;
• a permitted withdrawal event and its timestamp;
• a later permitted re-sharing event;
• whether a successful Share My Contact event consumed the active grant; and
• reasonable technical, security, eligibility, and fraud-prevention information.
KORX permits no more than one proactive Share My Request grant to be active for the same Service Request at the same time. Share My Request is not a broadcast. A Service Provider who has already successfully used Share My Contact for a Service Request is not eligible to receive a new proactive Share My Request for that same Service Request. The Service Requester may withdraw an active Share My Request before the selected Service Provider successfully uses Share My Contact. Withdrawal ends the selected Provider's proactive access grant but cannot recall information already viewed, copied, captured, or independently retained. If the Service Request remains eligible after withdrawal, a later share with a different eligible Service Provider is recorded as a new event and does not delete or replace the earlier share or withdrawal. A successful Share My Contact by the selected Service Provider consumes the related active Share My Request grant. After that event, the Service Requester cannot withdraw that grant or retract information already disclosed. For Share My Contact, records may include:
• the Service Provider Account;
• the Service Requester Account;
• the applicable Service Request;
• the date and time of the event;
• the contact method or methods selected and disclosed by the Service Provider;
• the disclosure snapshot or a secure reference to it;
• the Your Price or Provider Note, where submitted, or a secure reference to the stored information;
• the controlling Pickup / Origin County and recorded County Lifecycle stage;
• applicable Provider Membership, First-Time Provider Membership Trial, or other eligibility status;
• the related Share My Request record, where applicable;
• available notification creation, dispatch, suppression, failure, or delivery-status information; and
• reasonable technical, security, and fraud-prevention information. KORX may use these records to administer the applicable feature, preserve disclosure and authorization history, protect Users and the Platform, prevent misuse, investigate Platform-related complaints or suspected violations, and enforce the Terms of Use and CT-004 - KORX Platform Rules. Withdrawal, cancellation, Profile editing, contact-information editing, or a later Account change does not automatically delete or rewrite a prior audit record. KORX retains such records only under the criteria-based retention rules in Section 6.1 and for the purposes described in Section 6.3, as permitted or required by Applicable Law. These records do not establish communication, an offer or acceptance, booking, assignment, dispatch, formation of a Service Agreement, payment, or performance of a User-provided Service.
4.8 Use of Provider Contact Information by Service Requesters
A Service Requester who receives contact information voluntarily shared by a Service Provider through Share My Contact may use that information only for purposes reasonably related to the applicable Service Request and authorized interaction. The Service Requester must not use the information for unrelated marketing, harassment, fraud, unauthorized publication, sale, scraping, database creation, surveillance, or another unlawful or prohibited purpose. KORX may restrict Contact Access, suspend features, or take other appropriate enforcement action against an Account where credible information indicates misuse of Provider contact information.
4.9 Ratings and Private Feedback
A successful Share My Contact event may create one potential rating opportunity for each permitted rating direction between the applicable Service Requester and Service Provider. Creation of a potential rating opportunity does not itself create a rating and does not prove that a Service was accepted, performed, completed, or paid for, or that a genuine interaction occurred. A User may submit a rating only after:
• a successful Share My Contact event exists for the applicable Service Requester, Service Provider, and Service Request;
• the applicable rating-eligibility time has been reached;
• the User affirmatively confirms that a genuine interaction occurred; and
• all other eligibility requirements are satisfied. The rating-eligibility time is the later of:
• the time at which Share My Contact was first successfully completed for the applicable User pair and Service Request; and
• the calculated scheduled end of the Service Request, determined from the scheduled start time plus KORX's then-current estimated travel time for all route legs and the stated total waiting time. If an otherwise eligible Service Request is canceled after a successful Share My Contact event, KORX may use the last valid schedule and duration recorded before cancellation to determine rating eligibility. Cancellation alone neither proves nor disproves a genuine interaction and does not automatically create or eliminate a rating opportunity. Each eligible rating opportunity remains open for ten (10) calendar days calculated using the America/New_York time zone. The deadline is specific to the applicable Service Request, rated User, and rating direction. A later view, reminder, retry, repeat Contact Access attempt, or Share My Request event does not restart or extend the deadline.
A User may rate one, multiple, or none of the eligible Users associated with a Service Request, but may submit no more than one final rating for the same Service Request, rater, rated User, and direction. No rating is created unless the User affirmatively selects a star value, completes any required fields, confirms a genuine interaction, and successfully submits the rating. Once successfully submitted, a rating is final from the submitting User's perspective and cannot be edited or deleted through ordinary User controls. KORX may separately moderate, exclude, or reinstate a rating where permitted or required under the Terms of Use, CT-004 - KORX Platform Rules, or Applicable Law. KORX may preserve or delete a rating in accordance with this Privacy Policy, the applicable retention criteria, Applicable Law, or an enforcement decision made under the Terms of Use or CT-004 - KORX Platform Rules. For purposes of the public-rating threshold, a “valid rating” is a successfully submitted rating that satisfied the eligibility and submission requirements in this Section and has not been excluded under the Terms of Use, CT-004 - KORX Platform Rules, or Applicable Law. A rating that is later excluded no longer counts toward the public- rating threshold unless it is reinstated. Individual star ratings, selected categories, original comments, explanations, identities attached to a rating record, Service Request identifiers, Share My Contact event identifiers, Safety indicators, and internal moderation information are restricted information. They are not displayed to the rated User or the public. KORX may display aggregate rating information only when the User has received at least ten (10) valid ratings from Users in the opposite Platform role. When displayed, the arithmetic mean rounded to one decimal place and the number of valid ratings must appear together. Both remain hidden while fewer than ten valid ratings exist and may be hidden again if moderation reduces the valid count below ten. KORX may use restricted rating and feedback information for rating administration, support, safety review, fraud prevention, handling Platform-related complaints, and enforcement. Where reasonably appropriate, KORX may prepare and privately provide the affected User with a separate KORX-authored, neutral, redacted summary. A KORX-authored summary is not the original review and must not disclose an individual star value, raw rating category, original comment, submitting User identity, Service Request identifier, Share My Contact event identifier, Safety indicator, or other restricted information. KORX does not privately disclose the original written feedback in whole or provide a purported redacted copy of the original feedback. Selection of a Safety category creates a restricted internal review signal only. It is not proof that a violation or emergency occurred, is not an emergency-reporting method, and does not by itself create an Account restriction, ranking change, rating adjustment, or other automatic enforcement action. A User facing immediate danger should contact 911 or the appropriate emergency authority. Submission or receipt of an individual rating does not automatically notify the rated User and does not by itself cause an Account restriction, ranking change, or other enforcement action. A rating does not constitute KORX endorsement, certification, or a determination that a User-provided Service occurred.
KORX does not guarantee the accuracy, completeness, fairness, or representativeness of User-submitted ratings or feedback. KORX will not exclude an otherwise compliant rating solely because it is negative.
4.10 Editing, Withdrawal, Removal, and Historical Records
Users may be able to edit or remove eligible Profile, Service Request, and Listing information through available Platform controls, subject to the applicable Request status, feature rules, record-integrity requirements, and Applicable Law. An eligible edit may change future Platform display or processing but does not automatically:
• recall information already viewed, copied, cached, captured, or independently retained;
• rewrite an earlier Provider-Visible Projection;
• rewrite a completed Share My Contact disclosure snapshot;
• delete an earlier Share My Request, withdrawal, re-sharing, or Share My Contact audit record;
• alter an earlier rating-eligibility calculation or submitted rating record; or
• reverse an earlier payment, Subscription, Trial, advertising, or billing event. A Service Requester may withdraw an active Share My Request grant only before the selected Service Provider successfully uses Share My Contact. Withdrawal ends the active grant but cannot recall information already viewed or retained. After successful Share My Contact, the related grant is consumed and the completed disclosure cannot be retracted. KORX may retain information and limited copies where reasonably necessary for:
• security and fraud prevention;
• billing, accounting, tax, and transaction administration;
• disclosure, consent, and acceptance evidence;
• rating integrity;
• complaints, investigations, appeals, and enforcement;
• legal compliance and the establishment, exercise, or defense of legal claims;
• backup, recovery, and system integrity; or
• another retention purpose described in Section 6. Removal from current Platform display may not result in immediate removal from search engines, cached pages, screenshots, archived copies, backup systems, or information independently retained by another person.
SECTION 5: COOKIES, NOTIFICATIONS, ANALYTICS, AND ADVERTISING
5.1 Cookies and Similar Technologies
KORX and its authorized vendors may use cookies, local storage, pixels, Device identifiers, software development kits, and similar technologies to:
• operate and secure the Platform;
• authenticate Accounts and maintain login sessions;
• remember User settings and preferences;
• support Contact Access Features;
• deliver requested notifications;
• measure and improve Platform performance;
• identify errors, fraud, or misuse; and
• administer approved advertising or promotional features. Some technologies are necessary for the Platform to function. Other technologies may be optional and subject to User choice where required by Applicable Law.
5.2 Information Collected Through These Technologies
Depending on how you use the Platform, cookies and similar technologies may collect information such as:
• Internet Protocol address;
• browser, Device, and operating-system information;
• language and regional settings;
• Device or application identifiers;
• approximate location derived from technical information such as an IP address;
• pages, Profiles, Listings, or features viewed;
• searches, filters, buttons, and links used;
• login and authentication activity;
• Share My Request, Share My Contact, and other Contact Access activity;
• notification delivery and interaction information;
• session and performance information;
• error and crash reports; and
• security or fraud-prevention indicators. Approximate location derived from an IP address or similar technical information is distinct from the exact Pickup, Origin, Destination, and Stop addresses affirmatively entered by a Service Requester in designated private
Service Request fields. Those exact addresses are collected and used as described in Sections 2.4, 3.1, 4.3, and 7.6, not as continuous or background Device tracking.
5.3 Notifications and User Preferences
As of this Privacy Policy's Effective Date, KORX notification channels may include In-App notifications, Email, and SMS. For a Share My Contact event, each notification channel is optional and depends on the Service Requester's settings, availability of the applicable channel, and relevant technical conditions. No In-App, Email, or SMS notification concerning a Share My Contact event is mandatory or guaranteed. A Share My Contact disclosure is treated as completed when KORX makes the contact method or methods affirmatively selected by the Service Provider available to the Service Requester associated with the applicable Service Request. The absence, delay, failure, nonreceipt, or nonopening of an In-App, Email, or SMS notification does not reverse, revoke, or invalidate the completed disclosure. KORX may separately send communications reasonably necessary for Account registration and administration, authentication and security, Provider Membership and billing, legal or Platform notices, privacy matters, support, and protection of the Platform. Those necessary communications are separate from optional Share My Contact, Listing, product, feature, or promotional notifications. Where offered, Users may manage optional Service Request, Share My Request, Share My Contact, rating- reminder, Listing, product, feature, Email, and SMS notification preferences. Rating reminders, like other optional feature notifications, are not guaranteed and do not extend or restart an applicable rating deadline. Promotional or marketing SMS requires a separate affirmative opt-in. Consent to marketing SMS is not a condition of Account registration, Provider Membership, posting a Service Request, or ordinary use of KORX. Users may opt out of optional marketing SMS using the method provided by KORX without closing their Account or disabling unrelated Platform features. KORX may retain records of notification-channel settings, notification creation, dispatch, suppression, delivery, or failure status where available, marketing-SMS opt-in or opt-out status, and timestamps of material preference or consent changes.
5.4 Analytics and Performance
KORX may use analytics and diagnostic technologies to:
• understand how the Platform is used;
• measure feature performance;
• identify technical problems;
• diagnose errors or crashes;
• improve navigation and accessibility;
• prevent fraud or automated abuse; and
• develop or improve Platform functionality. Where reasonably practicable, KORX may use aggregated, deidentified, or reduced information for these purposes.
5.5 Advertising and Paid Visibility
KORX may offer:
• Provider Profile Advertising;
• Request Advertising;
• sponsored Content; or
• other approved paid-visibility features. KORX may use general information, such as Service category, Provider Profile or Service Request information approved for display, and City, County, State, or ZIP Code information approved for display, to display or administer such Content. KORX does not publicly display an exact Pickup, Origin, Destination, or Stop address, unit information, precise coordinates, an exact map pin, private access instructions, or another restricted part of the internal Service Request record through an advertising or promoted-content placement. The purchase of Provider Profile Advertising, Request Advertising, or another paid-visibility feature does not mean that KORX endorses, certifies, recommends, or guarantees the advertiser, User, Service Request, Provider Profile, or Service. Paid advertising does not purchase a higher list position, bypass applicable eligibility requirements, or cause KORX to rank one User over another solely because that User purchased advertising. If KORX begins to use technologies that constitute targeted advertising, sale, sharing, or another regulated activity under Applicable Law, KORX will first update the applicable notice and provide any privacy choice required by Applicable Law.
5.6 Third-Party Technologies
Authorized vendors may process limited information through cookies or similar technologies to provide services such as:
• hosting and security;
• Account authentication;
• analytics and performance measurement;
• error reporting;
• notification delivery;
• fraud prevention; or
• advertising administration. Some Third-Party Services may process information under their own privacy notices where they act independently rather than solely on behalf of KORX. KORX does not control the independent privacy practices of Third-Party Services.
5.7 Your Choices
Depending on the technology, the available Platform feature, and Applicable Law, you may be able to manage your preferences through:
• KORX Account settings;
• an available cookie or consent-management tool;
• browser or Device settings;
• KORX Account notification settings;
• Share My Contact notification preferences;
• unsubscribe links in optional emails;
• text-message opt-out instructions;
• advertising opt-out controls; or
• legally recognized privacy-preference signals. Share My Contact notification preferences apply prospectively. Disabling or changing an In-App, Email, or SMS preference does not reverse, recall, or invalidate a contact disclosure already completed through Share My Contact. A saved Contact Sharing Preference may preselect a supported method for convenience but does not authorize disclosure. Each Share My Contact event requires a fresh, affirmative, request-specific authorization by the Service Provider. Disabling optional technologies may affect certain preferences, analytics, notifications, or other Platform features. KORX may continue to use technologies reasonably necessary for Account authentication, security, fraud prevention, billing, eligibility administration, or operation of a requested feature, to the extent permitted by Applicable Law. A privacy choice may apply only to the browser, Device, application, role-specific Account, or feature through which it was submitted.
5.8 Additional Cookie Information
If and when KORX publishes CT-003 - KORX Cookie and Tracking Technologies Notice, it will supplement this Privacy Policy with information concerning the cookies and similar technologies actually used by KORX. The published notice may identify, as applicable:
• the technology or cookie;
• its provider;
• its purpose;
• whether it is necessary or optional;
• its duration; and
• available User controls. Until CT-003 is published, this Privacy Policy describes the relevant practices, and any cookie or consent controls actually made available through the Platform provide the applicable User choices. KORX may update its technologies and any related published notice as the Platform develops.
SECTION 6: DATA RETENTION, SECURITY, AND USER CHOICES
6.1 How Long We Retain Personal Information
KORX uses a criteria-based retention schedule and retains Personal Information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to:
• provide and administer the Platform;
• maintain Accounts, Profiles, Service Requests, Listings, and Paid Services;
• process Exact Service Location Information and administer applicable Service Requests;
• operate Share My Request and Share My Contact;
• document User selections, authorizations, disclosures, withdrawals, and related audit events;
• document Contact Method verification, per-role uniqueness, Account-ownership resolution, and optional identity-verification results;
• administer the five-active-Interested-Provider limit, Requester removals, and removed- Provider re-entry restrictions;
• administer County registration, County Lifecycle stages, Provider Membership requirements, County Membership Notice Periods, and First-Time Provider Membership Trials;
• administer ratings, written feedback, aggregate-rating thresholds, complaints, and restricted Safety- related review signals;
• protect security and prevent fraud, duplicate-Account abuse, and improper restoration of one-time eligibility;
• respond to support requests, Platform-related complaints, investigations, and legal claims;
• maintain billing, accounting, tax, refund, and chargeback records;
• comply with Applicable Law; and
• establish, exercise, or defend legal rights. Retention periods may vary depending on:
• the type, sensitivity, and amount of the information;
• the purpose for which it was collected or generated;
• whether the relevant Account, Service Request, Profile, Listing, Paid Service, or feature remains active;
• whether another User has already received or independently retained the information;
• security, fraud-prevention, eligibility-verification, and audit needs;
• contractual, accounting, tax, or legal requirements;
• applicable limitation periods; and
• whether the information is subject to a Platform-related complaint, investigation, legal claim, proceeding, or legal hold. Exact Service Location Information is retained only for as long as reasonably necessary for Service Request administration, calculation and recordkeeping, security, support, Platform-related complaint handling, fraud prevention, legal compliance, and the establishment, exercise, or defense of legal rights. KORX does not use a single retention period for all categories of Personal Information.
6.2 Accounts, Profiles, Service Requests, and Listings
KORX may retain Account information while the applicable Account remains active. Profile, Service Request, and Listing information may be retained while active, pending, or otherwise reasonably necessary for the applicable Platform feature. KORX may retain telephone/email verification states and minimum per-role uniqueness records while reasonably necessary to administer Accounts, protect method owners, prevent duplicate Accounts, and resolve disputes. For the optional Didit check, KORX retains only the limited result/reference, consent, legal-name version, timestamps, invalidation and deletion/audit records needed to operate the badge, handle support or privacy requests, and meet applicable obligations. The general retention criteria in this Section apply to that limited record; it is not a permanent copy of the identity evidence. A Service Requester Account and a Service Provider Account are separate role-specific Accounts. Where supported by KORX's identity system, the same authorized email address or telephone number may be associated with more than one role-specific Account. KORX may maintain limited internal linkage between those Accounts
for authentication, security, fraud prevention, billing, legal compliance, eligibility administration, and enforcement purposes. If an Account, Profile, Service Request, or Listing is suspended, expired, closed, withdrawn, or removed, KORX may retain limited internal records where reasonably necessary to:
• prevent fraud or unauthorized duplicate Accounts;
• prevent re-registration from improperly restoring a consumed First-Time Provider Membership Trial or other one-time eligibility;
• investigate prohibited conduct;
• respond to Platform-related complaints;
• maintain Share My Request, Share My Contact, and other Contact Access records;
• maintain County Lifecycle and Provider Membership eligibility history;
• preserve evidence;
• administer billing;
• enforce Platform requirements; or
• comply with Applicable Law. Removal from public or User-facing display does not necessarily result in immediate deletion from every KORX system.
6.3 Billing, Sharing, County Lifecycle, Trial, and Rating Records
KORX may retain Provider Membership, Provider Profile Advertising, Request Advertising, payment, and transaction records for accounting, tax, fraud-prevention, refund, chargeback, eligibility, audit, and legal purposes. KORX may retain Share My Request records, including the applicable Service Requester Account, selected Service Provider Account, linked Service Request, date and time, the Provider-Visible Projection made available, access or consumption status where recorded, and any permitted withdrawal or re-share event. KORX may retain Share My Contact records, including the applicable Service Provider Account, Service Requester Account, linked Service Request, date and time, the contact method or methods affirmatively selected and disclosed, any submitted Your Price or Provider Note, the request-specific authorization event, disclosure status, and related notification or audit information. KORX may also retain the verification state of each disclosed method at the time of sharing, active Interested Provider count, Response Limit Reached decisions, removal actor and timestamp, removed-Provider status, and records needed to prevent re-sharing or automatic re-entry for the same Request. KORX may retain County Lifecycle records, including:
• Qualifying Provider Account counts by selected Home / Residence County;
• Qualifying Service Request counts by Pickup / Origin County;
• the date a County first satisfies the applicable thirty-Provider threshold;
• the date Requester Posting becomes open;
• the date the applicable ten-Request threshold is first satisfied within a rolling thirty-calendar-day period;
• the start and end of the thirty-day County Membership Notice Period;
• the date the County becomes Membership Active; and
• any separate legal, security, fraud-prevention, safety, technical, maintenance, or operational restriction. KORX may preserve the recorded one-way County Lifecycle history after a County opens or enters a later stage. A later decline in Qualifying Provider Accounts or Qualifying Service Requests does not erase or reset that recorded history. KORX may retain First-Time Provider Membership Trial and recurring-membership records, including affirmative enrollment, payment-method authorization, recurring-billing consent, the Provider Membership eligibility condition for which activation was permitted, Trial start and end dates, cancellation, conversion, and Trial- consumed status. County Membership Notice Period records and First-Time Provider Membership Trial records are maintained as distinct eligibility records. If a Service Provider cancels during the First-Time Provider Membership Trial, KORX records the immediate end of Trial access and that the one-time Trial has been consumed. KORX may also retain rating and feedback records, including eligibility events, submission timestamps, rating- window information, private stars, categories, original written feedback, internal issue or Safety signals, validity and moderation status, aggregate-rating calculations, and public-threshold status. These records may be retained to administer eligibility and Platform rules; maintain an auditable history; prevent scraping, spam, harassment, fraud, re-registration abuse, or misuse; respond to Platform-related complaints, KORX billing disputes or chargebacks, and legal claims; protect Users and the Platform; and comply with Applicable Law.
6.4 Account Closure and Deletion
Users may request closure of an Account through the methods made available by KORX. If a User maintains separate Service Requester and Service Provider Accounts, closure or deletion of one role- specific Account does not automatically close or delete the other role-specific Account. A User requesting closure or deletion should identify whether the request concerns the Service Requester Account, the Service Provider Account, or both. Account closure may result in:
• loss of access to the affected role-specific Account;
• removal of active Profiles, Service Requests, and Listings associated with that Account from public or User-facing display;
• termination of future Share My Request, Share My Contact, or other Contact Access Features available to that Account;
• removal of optional preferences associated with that Account; and
• deletion or deidentification of information no longer required. Closing an Account does not automatically delete information that KORX may lawfully retain, including:
• transaction, Provider Membership, advertising, and billing records;
• Share My Request, Share My Contact, authorization, and disclosure records;
• County Lifecycle, eligibility, and First-Time Provider Membership Trial records;
• reports, Platform-related complaints, and enforcement records;
• private rating, written-feedback, aggregate-rating, and internal issue or Safety records;
• security and fraud-prevention records;
• legal records;
• limited cross-role identity-linkage records reasonably necessary for an authorized purpose; and
• information subject to a legal hold. Account closure does not retrieve, erase, or invalidate Personal Information already disclosed to and independently retained by another User through an authorized Share My Contact event or otherwise outside KORX's control. If a person later registers again, the new Account does not automatically restore, merge, or recreate prior Account history, ratings, entitlements, receipts, enforcement status, or First-Time Provider Membership Trial eligibility. KORX may retain the minimum records reasonably necessary to determine prior consumption of a one-time Trial or other eligibility and to prevent fraud or circumvention, subject to the criteria-based retention rules in Section 6.1. Privacy rights concerning deletion are described in Section 7.
6.5 Backups, Caches, Historical Disclosures, and External Copies
Personal Information removed from KORX's active systems may remain for a limited period in backup or disaster- recovery systems, technical logs, or systems operated by authorized vendors. Information retained only in backups will not ordinarily be restored to active use except where reasonably necessary for recovery, security, legal compliance, or another authorized purpose. Separately, copies may remain in search-engine results, archived pages, browsers, social-media services, or records independently retained by other Users or Third-Party Services. KORX does not control those external copies.
Once information disclosed through Share My Request or Share My Contact has been viewed, copied, downloaded, recorded, or otherwise independently retained by another User, KORX cannot recall or delete that User's copy. Withdrawal of a Share My Request before the selected Service Provider successfully completes the related Share My Contact event may prevent a later disclosure through that sharing event, but it does not recall information already viewed or retained. Any later re-share is a new event and may be recorded separately. A completed Share My Contact event forms a historical disclosure snapshot. A later Account, Profile, contact- method, preference, or deletion change does not rewrite or revoke that snapshot.
6.6 Security Measures
KORX uses reasonable administrative, technical, organizational, and physical safeguards designed to protect Personal Information, taking into account the nature and volume of the information and the relevant risks. No system can be guaranteed completely secure. This provision does not limit any responsibility that KORX cannot lawfully exclude or limit.
6.7 Payment Security
Payment-card processing is described in Section 2.6. Complete payment-card information is collected directly by KORX’s payment processor. KORX does not directly store complete payment-card numbers or card security codes. A payment provider’s independent processing may also be governed by its own privacy notice and terms.
6.8 Security Incidents
KORX investigates actual or suspected security incidents and takes reasonable containment, remediation, and record-preservation measures. Where required by Applicable Law, KORX will notify affected individuals, regulators, governmental authorities, or other required recipients of a qualifying data breach or other legally reportable security incident.
6.9 Your Account and Privacy Controls
Depending on the available feature, Users may:
• review or update Account, Profile, Service Request, Listing, contact, notification, and Paid Service information;
• manage available cookie preferences;
• manage a saved Contact Sharing Preference;
• withdraw a Share My Request before the selected Service Provider successfully completes the related Share My Contact event, where the applicable Platform control remains available;
• cancel future Provider Membership renewals;
• cancel or manage other eligible Paid Services; and
• request closure of a specified Service Requester Account, Service Provider Account, or both. A saved Contact Sharing Preference may preselect a supported method but does not itself authorize disclosure. Each Share My Contact event requires a fresh, affirmative, request-specific authorization by the Service Provider. A completed Share My Contact disclosure cannot be revoked through a preference change or Account control. Preference changes apply prospectively and do not retrieve information already disclosed to or independently retained by another User. Some information may not be editable or removable through ordinary Account controls where it is reasonably necessary for security, billing, eligibility administration, fraud prevention, complaint handling, enforcement, auditability, or legal compliance.
6.10 Communications and Notification Choices
Users may manage available In-App, Email, and SMS notification preferences through Account settings or the instructions provided in the applicable communication. Share My Contact notifications through In-App, Email, or SMS are optional, settings-dependent, and availability- dependent. No such notification channel is mandatory or guaranteed. Disabling a channel, failing to receive or open a notification, or a technical delivery failure does not reverse a Share My Contact disclosure already completed through the Platform. Users may opt out of optional marketing communications without closing their Account or disabling unrelated Platform functionality. Promotional or marketing SMS requires separate affirmative consent, and that consent may be withdrawn independently of ordinary Account access, Provider Membership, Service Request posting, Share My Request, Share My Contact, or unrelated Platform features. KORX may continue to send communications reasonably necessary for Account authentication, security, billing, Provider Membership, legal notices, privacy requests, support, or material Platform changes. These communications are separate from optional Share My Contact and marketing notifications. Changes to optional communication preferences apply prospectively.
6.11 User Responsibility for Security and Private Fields
Users should use strong and unique passwords, protect authentication codes, secure Devices used to access the Platform, keep Account contact information current, avoid sharing credentials, and promptly report suspected unauthorized access. Users should also use caution when disclosing Personal Information to other Users outside the Platform. Service Requesters should enter exact Pickup, Origin, Destination, and Stop information only in the private location fields designated by KORX. Users should not place an exact street address, unit number, precise coordinates, an exact map pin, private access instructions, telephone number, email address, or other restricted information in a publicly visible or Provider-visible title, description, note, image, or other free-text field.
SECTION 7: PRIVACY RIGHTS, CHILDREN, THIRD-PARTY SERVICES, CHANGES, AND CONTACT
7.1 Privacy Rights
Depending on your place of residence and Applicable Law, you may have the right to:
• confirm whether KORX processes your Personal Information;
• access Personal Information maintained by KORX;
• correct inaccurate Personal Information;
• request deletion of Personal Information;
• obtain a portable copy of certain Personal Information;
• withdraw consent where processing is based on consent;
• opt out of targeted advertising, the sale or sharing of Personal Information, or certain qualifying profiling; and
• appeal a decision concerning an eligible privacy request. These rights are subject to applicable legal limitations and exceptions. KORX may retain or decline to disclose information where reasonably necessary and legally permitted to:
• protect Account or Platform security;
• prevent or investigate fraud;
• protect another person’s privacy;
• comply with legal obligations;
• preserve legal claims or evidence;
• maintain billing, tax, or transaction records; or
• exercise another right or exception permitted by Applicable Law.
7.2 Submitting a Privacy Request
You may submit a privacy request by contacting KORX using the email address in Section 7.9 with the subject line "Privacy Request," or through another privacy-request method actually made available through the Platform. Your request should clearly describe:
• the right you wish to exercise;
• whether the request concerns a Service Requester Account, a Service Provider Account, or both;
• the Account, Service Request, Profile, Listing, disclosure event, or other information involved;
• your state of residence, where relevant; and
• information reasonably necessary to identify and process the request. Do not submit unnecessary sensitive information with your initial request. KORX will respond within the period required by Applicable Law.
7.3 Request Verification, Authorized Agents, and Appeals
KORX may take reasonable steps to verify:
• your identity;
• your authority over the relevant Account;
• the validity of the request; and
• the authority of any person acting on your behalf. Where permitted by Applicable Law, an authorized agent, Legal Guardian, or other legally authorized representative may submit a request for another person. KORX may require written authorization, confirmation from the affected individual, or other reasonable evidence of authority. Where Applicable Law provides a right to appeal, you may submit an appeal by replying to KORX’s decision or by contacting KORX using the email address in Section 7.9 with the subject line “Privacy Appeal.” The appeal should identify the original request and explain why you believe KORX’s decision should be reconsidered. KORX will respond within the period required by Applicable Law. If an appeal is denied, KORX will provide any information required by Applicable Law concerning how to contact the appropriate regulatory authority. KORX will not unlawfully discriminate against a person for exercising an applicable privacy right.
7.4 Consent and Opt-Out Choices
Where processing is based on optional consent, you may withdraw that consent using the method provided by KORX.
Withdrawal generally applies prospectively and does not affect processing lawfully completed before the withdrawal. In particular, withdrawal does not retrieve information already disclosed through a completed Share My Contact event or independently retained by another User. Where required by Applicable Law, KORX will honor valid requests to opt out of:
• targeted advertising;
• the sale or sharing of Personal Information, as those terms are defined by Applicable Law; or
• qualifying profiling that produces legal or similarly significant effects. For purposes of this Section, "sale" or "sharing" refers to a sale or sharing regulated as such under Applicable Law. It does not refer merely to a User-directed Share My Request or Share My Contact disclosure made to provide the requested Platform feature, unless Applicable Law requires a different treatment. KORX will honor valid opt-out preference signals recognized and required by Applicable Law. Opting out of regulated advertising activities does not necessarily prevent KORX from displaying contextual advertising, Provider Profile Advertising, Request Advertising, or other Content that does not use regulated targeted-advertising practices.
7.5 Children, Minors, and Role-Specific Minimum Ages
You must be at least eighteen (18) years old to create or maintain a Service Requester Account, post or manage a Service Request, receive Service Provider contact information through an eligible Share My Contact event, purchase a Paid Service offered to Service Requesters, or use another age-restricted Service Requester feature. You must be at least twenty-one (21) years old to create or maintain a Service Provider Account, publish or manage a Service Provider Profile or Listing, receive a Share My Request, use Share My Contact as a Service Provider, enroll in Provider Membership, purchase Provider Profile Advertising, or use another age-restricted Provider feature. A person who is at least eighteen (18) but under twenty-one (21) may be eligible for a Service Requester Account but is not eligible for a Service Provider Account or a Provider-only feature. Persons under eighteen (18) may access only the publicly available portions of the Platform that KORX permits them to view. The Platform is not directed to children under thirteen (13), and KORX does not knowingly collect Personal Information online from children under thirteen. If KORX learns that a person created or used an Account or age-restricted feature without satisfying the minimum age applicable to that role or feature, KORX may take action as permitted under the Terms of Use, CT-004 - KORX Platform Rules, or Applicable Law, including suspending or closing the affected Account or restricting the affected feature.
If KORX learns that it collected Personal Information online from a child under thirteen (13) without any consent required by Applicable Law, KORX will take reasonable steps to delete the information, subject to lawful security, fraud-prevention, and recordkeeping requirements. A Parent or Legal Guardian who believes that KORX collected Personal Information from a child may contact KORX using the information in Section 7.9. Parental permission does not override the Platform's minimum age requirement for the applicable Account role or feature.
7.6 Sensitive Personal Information and Exact Service Locations
KORX seeks to limit the collection and use of sensitive Personal Information to what is reasonably necessary for a specific and disclosed purpose. Where Applicable Law requires consent before KORX processes sensitive Personal Information, KORX will request that consent separately. When a Service Requester creates or updates a Service Request, KORX may specifically request exact Pickup, Origin, Destination, and Stop information through designated private location fields. This information may include a street address, unit information, precise coordinates or map-pin information, and private access instructions entered in the designated field. KORX processes and stores Exact Service Location Information for Service Request administration and related authorized purposes, including determining the applicable Pickup / Origin County and calculating approximate distance and time. KORX does not display an exact street address, unit number, precise coordinates, an exact map pin, or private access instructions to a Service Provider or to the public. A Service Provider may receive only the approved Provider-Visible Projection, which may include City, County, State, ZIP Code, route-point order, approximate distance and time, schedule or waiting-time information, Budget, Preferred Provider Gender, and other approved non-location, non-private Service Request information. All Service Provider-facing or public geographic fields are limited to the listed City, County, State, and ZIP Code and approved approximate distance and time. The approved route-point order may be shown separately as sequencing information, but it does not include an exact address, coordinate, map pin, place identifier, or other precise location field. The processing of Exact Service Location Information entered for a Service Request is separate from continuous or background Device geolocation. KORX does not use the Platform to continuously or passively track a User's precise Device location, provide live trip tracking, or maintain a monitored route or trip history. Unless specifically requested by KORX or an authorized vendor or processor for a disclosed purpose, Users should not submit sensitive information such as:
• Social Security numbers;
• complete payment-card numbers;
• financial-account credentials;
• government-identification documents;
• immigration documents;
• medical records;
• biometric information;
• precise location information outside KORX's designated private Service Location fields;
• information concerning children; or
• other sensitive information not requested by KORX. Where KORX processes sensitive Personal Information or Exact Service Location Information, KORX applies safeguards appropriate to the nature and sensitivity of the information, which may include restricted access, reduced collection and display, specialized providers, criteria-based retention, redaction, or secure deletion. Optional Didit identity verification and biometric consent Choosing this feature is voluntary and currently free to the Service Provider; KORX pays any applicable Didit cost. The launch workflow checks a government identity document, passive liveness, face matching, and device/IP information. Didit may extract document data and facial geometry or related biometric signals and may process images or video captured during the check. It is an identity check, not a criminal-background, driving-record, insurance, qualification, or work-eligibility check. Before you leave KORX for Didit, a separate, initially unchecked consent control identifies Didit, the information involved, and the verification purpose. The feature begins only after you affirmatively consent. Accepting the general Terms or Privacy Policy, continuing to browse, or receiving a Phone/Email Verified label does not supply that consent. You may choose Not Now and continue using otherwise available KORX features without an identity badge. The current feature is limited to Service Providers. Once enabled, it may be chosen after registration or from My Profile, whether the Home County is Building or Open. Account creation, viewing or dismissing the invitation, County opening, and Share My Contact do not themselves create a Didit session or send identity-verification information to Didit. Separate consent and an explicit Continue to Didit action are required. Identity documents and facial captures must be supplied only through the designated Didit verification flow, not by email, support attachments, ordinary Profile uploads, or public fields. A successful result becomes a badge only after KORX validates it against your Account and legal-name version. Other Users receive only the approved badge/disclosure and permitted date presentation, never the evidence, document details, technical risk signals, or internal reference. KORX does not store source identity images, selfies, liveness recordings, biometric templates, or full document numbers. Technical receipt of a Didit result may involve transient processing of a broader response: KORX
extracts only permitted fields, discards unnecessary fields, and prevents raw responses or media links from entering ordinary logs, analytics, support records, or backups. KORX instructs Didit to delete verification-session evidence promptly after the necessary final result is safely recorded, or after a pending review or resubmission is resolved. KORX configures a finite 30-day fallback retention window rather than unlimited retention, and disables retained biometric templates and face-search reuse. A session deletion is recorded as completed only after its outcome is confirmed. Failed deletion requests are retried and escalated. Where a documented legal obligation requires otherwise, KORX limits and records the exception; deletion is not represented as instantaneous erasure from every independent legal or security record or backup. KORX uses the available opt-out process for optional model-training and secondary processing of its verification data and records that instruction before enabling the feature. This does not purport to eliminate Didit's limited independent processing for security, legal obligations, audit records, or legal claims. Didit describes its processing and rights at https://didit.me/terms/verification-privacy-notice/ and https://didit.me/terms/privacy-policy/. Didit's standard processing region is the European Union; verification information may therefore be processed outside the United States, including by authorized providers under the applicable processing arrangements. KORX confirms the actual arrangement before enabling the feature and gives any additional notice or obtains consent required by applicable law. To withdraw verification consent or request access, correction, or deletion, use KORX's existing privacy/contact process. Withdrawal stops new optional verification processing and may remove the badge; it does not make earlier lawful processing unlawful. Where erasure applies, KORX sends an appropriate privacy-erasure instruction to Didit, addresses retained records under the applicable retention/rights rules, and records the confirmed outcome. Didit may also receive requests concerning its limited independent processing at privacy@didit.me. KORX does not promise that an already purged evidence file can be recovered for an appeal; a new, separately consented check may be needed.
7.7 Third-Party Services and External Links
KORX uses vendors and contractors for functions such as hosting, authentication, payment processing, communications, analytics, security, and support, as described in Section 3.8. Independent websites, applications, or services linked to the Platform process information under their own privacy notices and terms. KORX does not control their independent privacy, security, or retention practices.
7.8 Changes to this Privacy Policy
KORX may update this Privacy Policy to reflect changes in:
• Applicable Law;
• Platform features;
• data-processing practices;
• vendors or technologies;
• security or retention practices; or
• KORX operations. The Effective Date, Publication Date, Last Updated date, and Version shown at the beginning of this Privacy Policy identify the applicable version. Version 2.2 retains the planned effective and publication date of October 1, 2026 and was last updated September 5, 2026. This Didit revision is FINAL - APPROVED. It specifies the optional no-charge Provider identity check, identity/biometric processing, separate consent, minimized KORX records, session deletion, limited independent provider processing, and related rights. The prior contact-method, role-uniqueness, capacity/removal and County- count rules remain unchanged; the ten-Request threshold remains independent of Requester contact verification. Where required by Applicable Law, KORX will provide reasonable notice before a material change becomes effective. Notice may be provided through:
• Email;
• an Account or Platform notice;
• a notice displayed on the Privacy Policy page; or
• another legally recognized method. KORX may require affirmative acknowledgment or reacceptance of a materially updated Privacy Policy before a User continues to use an affected Account, feature, or data-processing activity. Where a material change requires separate consent or authorization, KORX will request that consent or authorization before beginning the affected processing. Continued use of the Platform after an updated policy becomes effective constitutes acknowledgment that the updated policy has been made available, to the extent permitted by Applicable Law. Continued use alone does not replace any affirmative reacceptance, consent, or authorization required by Applicable Law or by the applicable Platform flow.
7.9 Contact KORX
Questions, privacy requests, complaints, or concerns concerning this Privacy Policy or KORX’s handling of Personal Information may be directed to: KORX TECHNOLOGIES LLC Doing Business As: KORX 28 Spring St, Unit #696 Princeton, NJ 08542 United States Email: info@korxtech.com Website: https://www.korxtech.com When contacting KORX, please provide enough information to identify the matter, but do not include unnecessary sensitive Personal Information.