Privacy Policy

Effective date: September 21, 2026

1Introduction and Scope

This Privacy Policy explains how Kortado, Inc. ("Kortado," "we," "us," or "our") collects, uses, shares, and protects personal information when you use the Kortado Model Context Protocol ("MCP") server and connector (the "Service") through an AI assistant (an "AI Assistant"), and when you visit our website at kortado.com (the "Site").

Your conversations with an AI Assistant are handled by that AI Assistant’s provider under its own privacy policy, not this one. We receive only the information the AI Assistant sends to the Service to complete your request. We do not see your full conversation, and we do not receive data from other apps or connectors you use with your AI Assistant.

2Information We Collect

Information sent through the Service

When you ask your AI Assistant to use the Service, it may send us:

• Search details, such as event type, artist, keywords, location, and date range
• Event selections, such as the event, performance, seat section, and ticket quantity
• Purchaser details needed to complete an order, such as your name and email address
• Payment information, which is collected and processed by our payment processor. We do not store full payment card numbers.

Connection and technical information

• Authorization information, such as tokens or identifiers that link your AI Assistant connection to the Service
• Log data, such as request timestamps, the tools called, request metadata, error logs, and the IP address or identifier of the calling service
• Order records, such as confirmation numbers, order history, and transaction status.

Information from our website

When you visit the Site, we collect limited analytics information through Google Analytics, such as pages viewed, referring page, approximate location derived from IP address, browser and device type, and time of visit. Google Analytics sets cookies in your browser for this purpose. We use this only to understand how the Site is used. We do not use it for advertising, we do not sell or share it, and we do not combine it with information from the Service. You can opt out using Google’s browser add-on at tools.google.com/dlpage/gaoptout, or by blocking cookies in your browser; the Site works either way.

Information from others

We may receive information from Organizers, ticketing system providers, and payment processors, such as order status, admission status, and fraud-prevention signals.

3How We Use Information

We use personal information to:

• Search for events and return availability and pricing to your AI Assistant
• Process and fulfill ticket purchases and send order confirmations
• Provide customer support and respond to your requests
• Detect and prevent fraud, abuse, and violations of our Terms of Service
• Maintain, secure, debug, and improve the Service
• Comply with legal obligations and enforce our agreements; and
• Send you marketing messages, only where you have consented or where the law otherwise permits, with an option to opt out.

We do not use personal information received through the Service to train generalized AI models.

4How We Share Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share it only as follows:

• Organizers. When you buy tickets, we share your order and purchaser details with the venue, presenter, or institution hosting the event so they can fulfill your order, admit you, and contact you about the event (for example, about changes or cancellations). Organizers use this information under their own privacy policies, which may include sending you communications you can opt out of with them directly.
• Ticketing system providers that Organizers use to manage inventory and orders.
• Payment processors to process payments and prevent fraud.
• Service providers who host, secure, and support the Service under contractual confidentiality and data protection obligations.
• Your AI Assistant. Search results, event details, and order confirmations are returned to the AI Assistant you connected so it can respond to you. Once returned, that information is handled under the AI Assistant provider’s policy.
• Legal and safety. When required by law or legal process, or to protect the rights, property, or safety of Kortado, our users, or others.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, subject to this Privacy Policy.

5Data Retention

We keep order records for as long as needed to provide the Service, support your purchases, and meet legal, tax, and accounting obligations, generally 5 years for transaction records. We keep technical logs for 90 days unless needed longer for security or legal reasons. We then delete or de-identify the information.

6Security

We use reasonable administrative, technical, and physical safeguards to protect personal information, including encryption in transit, access controls, and limiting the data we request to what is needed for each task. No system is completely secure, and we cannot guarantee absolute security.

7Your Choices and Rights

• Disconnect. You can disconnect the Service at any time in your AI Assistant’s connector settings. This stops new requests but does not delete past order records.
• Access, correction, and deletion. You may request access to, correction of, or deletion of your personal information by contacting us at privacy@kortado.com. We may retain information where required by law.
• Marketing. You can opt out of our marketing emails using the unsubscribe link or by contacting us.

Depending on where you live, you may have additional rights. California residents may have rights under the CCPA/CPRA, including to know, delete, correct, and opt out of the sale or sharing of personal information (we do not sell or share it). Residents of the EEA, UK, and Switzerland may have rights under the GDPR, including rights to object to or restrict processing, to data portability, and to lodge a complaint with a supervisory authority. We will not discriminate against you for exercising these rights. We may need to verify your identity before responding.

Where the GDPR applies, we process personal information to perform our contract with you (fulfilling orders), for our legitimate interests (security, fraud prevention, and improving the Service), to comply with legal obligations, and with your consent (marketing).

8International Transfers

We are based in the United States and may process information in the United States and other countries where our service providers operate. Where required, we use appropriate safeguards, such as Standard Contractual Clauses, for international transfers.

9Children’s Privacy

The Service is not directed to children under 13 (or under 16 where applicable), and ticket purchases require users to be at least 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

10Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version with a new effective date and, for material changes, provide additional notice where appropriate.

11Contact Us

Our Terms of Service are at kortado.com/terms. Questions or requests about this Privacy Policy can be sent to: