Privacy notice

1. Who is responsible

KHALED AL HARAZI, trading as KDPika, SIREN 899816219, SIRET 89981621900013, 11 AVENUE ARISTIDE BRIAND, 69190 SAINT-FONS, France, is the controller for platform-account administration, billing, security and our relationship with you. Contact hi@kdpika.com for privacy questions or rights requests. No appointed data-protection officer is currently represented. Where a developer supplies customer and device data for licensing, the developer ordinarily determines the purposes and KDPika acts as processor under the Data processing agreement; contact that developer first about their application's data.

2. Information processed

Account information: name, email, password hash, workspace membership and roles, verification and recovery records, preferences and relevant account events. We do not store plaintext account passwords.

Billing information: chosen plan and interval, subscription and payment-provider references, invoice status, currency, amounts, billing-contact information available through the integration and records of accepted checkout terms. Full card numbers and CVCs are handled by Stripe- or Mollie-controlled fields, not stored in KDPika's application database. Each provider’s separate privacy terms explain its payment, legal-compliance and fraud-prevention processing.

Licensing information supplied by developers: product configuration, customer name and email, optional company, country and external reference, license entitlement and status, device-identifier hashes, device labels, platform and application version where supplied, activation records and related usage. These fields may identify a person; hashing does not necessarily make them anonymous.

Operational information: request identifiers, endpoints, outcomes, timestamps, usage counts, security and audit events, HMAC-protected IP representations in application API logs, support messages and privacy requests. Hosting access/security logs may include network addresses. Email-delivery records may include recipients, subjects and temporarily rendered message content. Do not put sensitive personal information, passwords, API secrets or bank-card details into support messages or application metadata.

3. Purposes and legal bases

We use necessary account, verification, service and billing information to prepare or perform our contract with you. Accounting and legally required records are processed to comply with legal obligations. Proportionate security, abuse detection, incident investigation, service reliability and business-contact communications rely on legitimate interests in protecting users and operating the service; we consider the impact on individuals and provide applicable objection rights. Legal claims may require preserving relevant evidence.

Where consent is legally needed for optional communications or non-essential tracking, it must be obtained separately and may be withdrawn without affecting prior lawful processing. Creating an account is not consent to unrelated marketing. KDPika does not sell personal information or use it to build an advertising audience. Required fields are marked or explained in the relevant process; without necessary email verification or billing information we may be unable to create or supply the requested service.

4. Recipients and providers

Information is accessible only to authorized people and providers for the relevant purpose, such as hosting, transactional email, payment processing and support. Developers can access the customer and licensing data in their own workspace, not other workspaces. The Service providers page identifies providers and the configuration facts still requiring confirmation. We may disclose information where lawfully required by authorities or necessary to establish or defend legal rights. We do not describe every provider as a processor in every context: Stripe may have independent controller obligations.

5. International transfers

The business is based in France, but that does not prove all providers or support access are confined to France or the EEA. Before live launch, the actual hosting location, provider contracting entities, active SMTP provider and onward-access locations must be confirmed. Where personal data is transferred outside the EEA, the appropriate legal mechanism and supplementary measures must be established, such as a valid adequacy decision or applicable standard contractual clauses. Ask hi@kdpika.com for applicable safeguards and a copy or description, with necessary protection of confidential information. No unverified EU-only hosting or transfer certification claim is made.

6. Retention and deletion

Account and workspace information is retained while needed for the service, then subject to review for deletion, anonymization or legally justified restricted archiving. Account closure is not proof that every related database record or backup has instantly disappeared. A privacy request can be used to ask about associated customer, license and device information and required exceptions.

Current application maintenance uses plan-based API/audit retention, typically 3, 30, 90 or 365 days according to the configured plan. Delivered email and completed webhook delivery records are normally cleaned after 30 days; rendered email bodies are cleared after successful delivery. Registration and recovery records expire quickly and are cleaned by scheduled maintenance; completed registration records are retained for up to 30 days. These cleanup operations depend on maintenance running successfully; they are not a guarantee that every hosting log or backup follows the same schedule.

Cookie-consent proof contains a random anonymous consent ID, the UTC decision time, choices by purpose, displayed language and banner version. It does not contain an email, account ID, full IP address or user agent. It is retained for up to 400 days for consent evidence and bounded cleanup. A person who still has their anonymous consent ID can ask hi@kdpika.com to locate and delete matching proof records. We verify the request proportionately, delete only exact-ID matches, and retain a separate administrative audit entry recording that a deletion occurred without copying the deleted choices.

French accounting documents are normally retained for ten years where required. Necessary dispute, fraud or security evidence may be retained for applicable legal periods with restricted access. TO COMPLETE — establish and document backup rotation, hosting-log retention, erasure of closed-workspace records and retention exceptions. Records must not be kept indefinitely simply because no automated cleanup exists. Retention for data processed on developers' instructions is governed by their lawful instructions and the DPA.

7. Security and incidents

Controls include encrypted HTTPS transport, password hashing, role and workspace authorization, protected administrative actions, key management, signed payment-event checks and audit records. These measures reduce risk but are not an assurance that compromise is impossible. We assess incidents and notify the competent authority and affected individuals when legally required. You should protect credentials, use supported devices, avoid sharing accounts and report suspected compromise promptly.

8. Your rights

Depending on the circumstances, you can request access, correction, erasure, restriction, portability and object to processing based on legitimate interests. You may withdraw consent for consent-based processing. French law also provides applicable instructions concerning personal data after death. These rights may be subject to lawful exceptions, including required accounting retention and the rights of others.

Use Settings and the privacy-request tools, or email hi@kdpika.com from your account address. We may ask for proportionate evidence of identity; do not send an identity document unless specifically needed and requested through an appropriate channel. We normally respond within one month. If a lawful extension is needed because of complexity or the number of requests, we inform you within that initial period and explain the reason. Requests are ordinarily free; legally permitted exceptions for manifestly unfounded or excessive requests are assessed individually.

You can complain to the CNIL, France's data-protection authority, at https://www.cnil.fr, or another competent supervisory authority. Contacting us first may help resolve the issue but is not a condition for exercising that right.

9. Automated controls and updates

Verification, rate limits, subscription status and entitlement checks automate service-access decisions; payment providers may perform their own fraud screening. KDPika does not claim that its controls are legal judgments about you or that it runs unrelated profiling for advertising. Contact support if you believe a restriction is incorrect. We will assess any processing requiring additional safeguards under automated-decision rules before introducing it.

Material changes to this notice will be made accessible and communicated where appropriate. Check the version and effective date. This pre-launch review text does not authorize an otherwise unlawful use of personal data.