This Privacy Policy describes how KeysBeast ("we", "us", "our") collects, uses, stores, and protects your personal information when you visit our website or purchase digital keys through our Service. It also explains your privacy rights and how to exercise them.
1. Data Controller
KeysBeast is the data controller responsible for the personal information collected through this website. For privacy-related questions or requests, please contact us through the Support page.
2. Information We Collect
- Account data: email address, name, and authentication identifiers used to create and secure your account.
- Order data: products purchased, prices, currency, order status, timestamps, and delivered key status.
- Payment data: handled directly by Stripe. We do not store full card numbers, CVV codes, or bank account details on our servers.
- Technical data: IP address, browser type, device information, and basic logs required to keep the Service secure and operational.
- Support data: messages, screenshots, and order details submitted when you contact support or report a key issue.
3. Legal Basis for Processing
We process your personal data only where we have a valid legal basis, including:
- Performance of a contract: to process orders, deliver keys, and provide customer support.
- Legal obligation: to comply with tax, accounting, and fraud-prevention requirements.
- Legitimate interests: to maintain security, prevent abuse, and improve the Service.
- Consent: where required for optional communications or non-essential cookies.
4. How We Use Your Information
- To create and manage your account.
- To process payments and deliver digital keys instantly after purchase.
- To communicate order confirmations, support responses, and security notices.
- To prevent fraud, abuse, and unauthorized access to the Service.
- To comply with legal and regulatory obligations.
5. Subprocessors and Third Parties
We rely on trusted providers to operate the Service. These include Stripe for payment processing and cloud infrastructure providers for hosting, authentication, database, and storage services. These providers process data on our behalf under data-processing agreements and their own privacy policies.
6. Cookies and Similar Technologies
We use only the cookies and local storage strictly necessary to keep you signed in, maintain your session, and remember basic cart or UI state. We do not use tracking or advertising cookies without your consent.
7. Data Retention
Account and order records are retained for as long as your account is active and for the period required to comply with legal, tax, and accounting obligations. Support tickets and uploaded files are retained only as long as needed to resolve the issue and then removed in line with our retention schedule.
8. Your GDPR Rights
If you are located in the European Economic Area (EEA), United Kingdom, or a jurisdiction with equivalent protections, you have the following rights regarding your personal data:
- Right of access: request a copy of the personal data we hold about you.
- Right to rectification: ask us to correct inaccurate or incomplete data.
- Right to erasure ("right to be forgotten"): request deletion of your personal data where permitted by law.
- Right to data portability: receive your data in a structured, commonly used format.
- Right to restriction: ask us to limit how we use your data in certain circumstances.
- Right to object: object to processing based on legitimate interests.
- Right to withdraw consent: withdraw consent at any time where processing is based on consent.
To exercise any of these rights, please contact us through the Support page. We will respond within the timeframe required by applicable law.
9. International Data Transfers
Some of our service providers may process data outside your country of residence, including in the United States. When this occurs, we rely on appropriate safeguards, such as Standard Contractual Clauses, to protect your personal data.
10. Security
We apply reasonable technical and organizational measures to protect your data, including encryption in transit, access controls, and secure authentication. No online service can guarantee absolute security.
11. Children's Privacy
The Service is not intended for individuals under the age of 18, or the age of majority in their jurisdiction. We do not knowingly collect personal data from children.
12. Changes to This Policy
This Privacy Policy may be updated periodically to reflect changes in our practices or legal requirements. The "Last updated" date at the top of the page reflects the latest revision.