Every order checked by our team · keys delivered by email

Privacy Policy

Last updated: 15 October 2026

This policy explains what personal data KeyMart collects and why. The data controller is [company legal name and address to be added]. Contact: support@keymart.net.

Data we collect

  • Account data: name, email address and a securely hashed password.
  • Order data: products bought, prices, currency, delivery email, and order and payment status.
  • Fraud-prevention and delivery records: for each order, your IP address, approximate country derived from it, browser/device information (user agent), and the times your key was delivered, revealed or re-sent.
  • Payment data: processed by Stripe or PayPal. We receive a payment reference and status, not your full card number.
  • Communications: messages you send us, and your newsletter subscription if you opt in.
  • Cookies: strictly necessary cookies for your login session, shopping cart and chosen currency. If live chat is enabled, the chat provider (Tawk.to) may set its own cookies.

Why we use it (legal bases)

  • To create your account, process and deliver your order, and provide support (performance of a contract).
  • To check orders, prevent fraud and handle payment disputes (legitimate interests).
  • To keep accounting and tax records (legal obligation).
  • To send the newsletter (your consent, which you can withdraw at any time).
  • To send one renewal reminder about 11 months after you buy a subscription product (legitimate interests). Every reminder has an unsubscribe link.

Email tracking, on-site activity and partner attribution

Our marketing emails, and emails sent by our advertising partners, may contain a tiny image and tracked links. These tell us when an email was opened, which links were clicked, and who unsubscribed or changed their preferences. For each of these events, and for leads (paid orders) and contact-form messages, we record the time, IP address, approximate location (country, region and city, derived from the IP), and device, operating system and browser (derived from the user agent). Location data comes from the free IP geolocation by DB-IP database, licensed under CC BY 4.0, which runs on our own server. Opens fetched through Apple or Gmail image proxies show the proxy's location, not yours.

If you arrive on our site through a tracked email link, we may also record the pages you view and products you add to your cart during that visit, linked to that email. This helps us understand which offers are useful.

Site analytics

To understand how our shop is used and to improve it, we run our own first-party analytics (no third-party analytics or advertising cookies). When you visit, we set a cookie (kv_vid, kept for up to 12 months) with a random visitor ID and record the pages you view, the time, how you reached us (for example a search engine, a social network, an email or a campaign link), your IP address, approximate location derived from it, and your device, operating system and browser. Visits are grouped into sessions.

If you later sign up, contact us, subscribe, click one of our emails or place an order, this browsing history may be linked to your email address so we can see which pages helped you choose. Visitors in the EU and UK are asked for consent first; if you decline, we only count anonymous page views without a cookie, IP address or any link to you, and we remember your choice in a kv_consent cookie. You can change your mind by deleting our cookies in your browser. These records follow the same 90-day IP shortening described below and are visible only to our team (and in our Google Sheet copy).

When you click a partner's link, we set a first-party cookie (kv_aff) for that partner's attribution window (usually 30 days) so we can credit the partner if you buy. We may also match your order email, in hashed form, to an earlier click. Partners see aggregated statistics, order values and a partly hidden email in sale notifications. They never see your full email address, name, IP address, licence keys or payment details. A partner's server may be notified of a sale (a "postback") with the order number, amount, commission, campaign and country only.

We use this data to measure campaigns, pay commissions and detect fraud (for example, unusual numbers of clicks from one IP address), on the basis of our legitimate interests or your consent where the law requires it. Full IP addresses are kept for 90 days and then shortened (for example 203.0.113.0); country and city are kept. Order IP addresses are kept longer, as evidence in case of payment disputes. You can opt out at any time with the preferences link in every email, and blocking images in your email app stops open tracking.

Service providers for this: Google (Google Sheets, where our team keeps a copy of these records, with shortened IP addresses by default) and Telegram (instant notifications to our team and to partners about leads). Both act as processors for us.

Who we share it with

Payment providers (Stripe, PayPal), our email delivery provider, our hosting provider, and the live-chat provider if you use chat. We do not sell your data. Some providers may process data outside the UK/EEA under appropriate safeguards such as Standard Contractual Clauses.

How long we keep it

Order and invoice records are kept for as long as tax law requires (typically 6–10 years). Fraud-prevention logs are kept for up to 24 months. Account data is kept until you ask us to delete your account.

Security

Licence keys are encrypted at rest. Passwords are hashed. Access to the admin area is restricted.

Your rights

Depending on where you live, you can ask to access, correct, delete or export your data, object to or restrict processing, and withdraw consent. Email us to exercise these rights. You can also complain to your data protection authority, for example the ICO in the UK.