Privacy

Last updated: November 1, 2026

The short version

We collect only what we need to deliver the kit and help you. We never receive your API keys. We don't sell your data.

What we collect

• When you buy: Paddle shares your name, email address, country and order details with us. Paddle handles your payment. We never see your card details.
• When you tick the box before checkout: the time, your IP address, your browser and the version of the wording you agreed to. We keep this as proof of what you agreed to.
• When you download: the time, your IP address and your browser, for each download.
• When you write to us: your email and what you send.
• When you join a waitlist: your email, which kit and the time. We use it only to email you when that kit opens.
• When you comment or message us on Instagram or Facebook: your username and what you sent, so we can reply.
• On our site: We count visits with Umami, which runs on our own server and sets no cookies. It records the page you visit, the site that sent you, any campaign tag in the link, your device type, your browser and your approximate location. It uses your IP address only during your visit, to work out that location (country, region and city) and a scrambled visitor ID that resets regularly. Umami doesn't save your IP address or follow you to other sites, and only we see what it records. If you accept cookies, the Meta Pixel records the pages you view and whether you buy, so our Meta ads reach people likely to want the kit. If you don't accept, it never loads.

What we never collect

Your API keys, your passwords, your accounts on other platforms, or anything your AI does on your computer. The kit runs on your machine and your own Cloudflare account, not ours.

Why we use it

To deliver the kit and its updates, answer support, prevent fraud and refund abuse, handle disputes and chargebacks, and meet tax and legal duties.

Emails

We email you your download link, messages about your order and important updates about the kit. Marketing emails only go to you if you opted in. Every marketing email has an unsubscribe link.

Who we share it with

Only the services that help us run the shop:

• Paddle, our reseller (payment, tax, refunds)
• Cloudflare (hosting this site and email routing)
• Google Gmail (the inbox our support email forwards to)
• Meta (ad measurement, only if you accept cookies; and our Instagram and Facebook messages)
• Contabo (our server in the EU, which sends our email and runs our Umami visit counts plus our social media scheduling and replies)

We share data with authorities only when the law requires it.

How long we keep it

Order, consent and download records: as long as tax law and dispute rules require, then deleted. Umami visit counts: deleted after 24 months, and our backups of them expire within 6 months after that. They hold no IP addresses. Support emails: two years. Marketing list: until you unsubscribe. Waitlist: until we email you that the kit is open, then deleted. Instagram and Facebook messages: one year.

Your rights

You can ask for a copy of your data, ask us to correct it or delete it, or object to how we use it. Write to mati@thekitroom.co. If you are in the EU or UK, you can also complain to your data protection authority.

Contact

The Kit Room, a brand of bstack Digital, run by Matias Barragan, Paraguay. mati@thekitroom.co