Privacy Policy

Effective Date: September 22, 2026

Who We Are

This Privacy Policy covers Kyeoto LLC’s website at kyeoto.com and HolidayShop, including the mobile app listed on Google Play as Holiday Shop Cash Register, under the developer name Holiday Shop Company, and the related school-sale websites and services that link to this policy (the “Services”).

Kyeoto LLC operates these Services under the Holiday Shop Company name. The Services are offered in the United States.

For privacy questions or requests, contact info@kyeoto.com or write to Kyeoto LLC, 145 Highland Ave., Kutztown, PA 19530.

Information We Handle

Depending on the features you use, we handle:

• Account and contact information: names, email addresses, phone numbers, account identifiers, login credentials, school affiliations, and assigned roles.
• School and delivery information: school and sale details, contact people, delivery addresses, shipment preferences, inventory records, and order information.
• Student and gift information: student names, teacher or grade information, gift certificate identifiers, purchased values, available balances, and use of certificates or student assistance. Adults may also enter student information in IOU requests.
• Transactions and payments: purchased items, quantities, prices, payment amounts and methods, payment references, receipt details, certificate applications, donations, refunds where applicable, and transaction timestamps. Card information entered during payment is transmitted to the payment service involved in the transaction. Our payment services include Authorize.net and, for supported contactless payments, Stripe. Payment processors also handle information under their own policies.
• Information you submit: messages to support, notes, comments, IOU instructions, and other information you choose to enter.
• Device and technical information: device or installation identifiers used to identify app sessions, IP addresses, browser or operating-system information, and service request or error information generated when the Services operate.

How We Use Information

We use information to provide accounts and authorized access; operate school sales; manage inventory, deliveries, and IOUs; issue and apply gift certificates and assistance; process and reconcile payments; provide receipts and transaction history; synchronize app records; respond to support requests; protect accounts and investigate errors or misuse; and meet applicable legal obligations.

Some information is needed to provide a requested service. Other fields, such as optional receipt contact details or IOU notes, are voluntary. Declining necessary information may prevent use of the corresponding feature.

Who Receives Information

Information is available to authorized school-sale organizers and team members as needed for their roles. We use service providers for hosting, payment processing, communications, and technical operation. These providers receive information needed to perform their services. Payment providers may also process information for their own legal, security, and payment-network obligations.

Receipt and gift certificate sharing features disclose the information displayed on the shared page to people with access to its link or QR code. Share these only with intended recipients.

We may disclose information when required by law or to investigate fraud, protect people and the Services, or establish or defend legal rights.

We do not sell or resell personal information. We do not use analytics or advertising trackers, and we do not use personal information for targeted advertising. We do not send promotional text messages. Emails we send relate to your account, transactions, support requests, or other activity with the Services.

Device Permissions and Local Storage

Where supported and enabled, contactless payment features may use device location and payment-device information to verify where payments are accepted and process payments securely. Required permissions are requested by the app or payment service when applicable.

The app requests camera access to scan gift certificate QR codes. You can manage this permission through your device settings. Denying camera access prevents scanning but does not grant us access to other device content.

The app stores operational records on your device to support fast lookups and operation during connectivity interruptions. Records awaiting upload are synchronized when the app can connect. Local storage and server records are separate; uninstalling the app is not an account-deletion request.

Website Cookies and Similar Storage

Our websites use cookies and similar storage where needed to maintain sessions, support sign-in, and operate requested features. Browser settings allow you to restrict or remove cookies, although some features may stop working.

We do not use analytics or advertising trackers on the Services.

Retention

Our standard retention period for sale-related personal information is 90 days after the sale ends. After that period, the covered information is deleted.

This 90-day period applies to the associated account, student and parent information, and transaction records. A verified deletion request may result in earlier deletion as described below.

Your Requests and Account Deletion

You may contact info@kyeoto.com to request access to, correction of, or deletion of your personal information. Your rights may depend on where you live and the context in which information is held. We may verify your identity before acting on a request.

To request deletion of your HolidayShop account and associated personal information, visit https://kyeoto.com/account-deletion. You do not need to reinstall the app or sign in to send a request. Deletion removes the account and associated personal information, subject to the specific retention exceptions described in this policy; merely disabling an account is not deletion.

We complete verified account-deletion requests within 30 days. If specific information must be retained for a legitimate legal or security reason, we explain the information retained, the reason, and the applicable retention period.

Students and Children

The Services are for adults only, including school organizers, volunteers, and purchasers. Students, minors, and children may not create or use accounts. Adults may provide limited student information to identify gift certificate recipients and fulfill school-sale requests. We use that information to deliver those services. A parent, guardian, or authorized school representative may contact us with questions or requests concerning a student’s information. If you believe a child has independently provided information or created an account, please contact us so we can investigate and address it.

Security

We use encrypted connections for data transmitted through the Services and access controls intended to limit access to authorized users and service providers. No system is completely secure. Do not send passwords or full payment card details in support messages or deletion requests.

Service Availability

We offer the Services only in the United States.

Policy Updates

We may update this policy as the Services or our practices change. We will post the revised policy here with its effective date and provide additional notice when required. Changes do not replace any consent required for a new use of information.