Privacy Policy

1. Who We Are

KinkCoach is a trading name of KCTECHNOLOGY Ltd, a company registered in England and Wales, company number 17302910. Our registered office is 66 Paul Street, London, EC2A 4NA. We are the controller of the personal data described here.

KinkCoach provides training, guides, software and subscription tools for online sellers and creators, including the KC Hub and our browser extensions.

If you have questions about this policy or how your data is handled, you can contact us at:

2. What We Collect

When you sign up or buy

• your name or display name, email address and password (stored in scrambled, hashed form)
• the country your bank account is in, which decides how you pay and in what currency
• what you bought, what you paid, and your payment status
• if you buy from the guide shop without an account, we create one from the email address you give us so we can send your downloads

We do not receive or store your full card number or bank account details. GoCardless and Fondy hold those.

When you use the KC Hub and our extensions

• the platforms and sites you connect, and your usernames on them
• sign-in tokens or app passwords for social accounts you choose to connect (such as Bluesky, X, Mastodon or Telegram). These are encrypted before we store them.
• messages between you and your buyers on connected platforms, which the extension and the Hub bring into your Hub inbox so you can read and reply in one place
• your buyers' usernames and, where you create orders or buy postage through the Hub, their names and delivery addresses
• listings, photos, videos and files you upload
• your licence key and the device it is locked to
• your settings

Identity checks (marketplace sellers only)

If you sell through KinkMarket or a storefront, we ask you to verify your identity. The check is done by Didit and involves a photo of your ID document, a selfie and a liveness check, matched to each other. Didit holds the images; we do not store them. We keep the result of the check and a reference to it. We do this because adult sellers must be age and identity verified, and to keep payments running. This is biometric data, which the law treats as special category data.

When you contact us

• what you send us, and our replies

When you visit our website

• We count page views on our own server. We record the page, the website that sent you (the site name only, not the full link), and whether you were on a phone or computer. We do not record your IP address and we do not use a cookie for this.
• Our website is served through Cloudflare, which processes your IP address to deliver the page and protect it from attack.
• Our pages load the Poppins font from Google Fonts, so your browser connects to Google, which receives your IP address.

3. Why We Use It, and Our Lawful Basis

• To provide your account, subscription, downloads and services. Basis: contract.
• To take payments and keep accounting records. Basis: contract and legal obligation.
• To answer your questions and send you account, payment and security emails. Basis: contract.
• To run the AI assistant, Alex, and AI writing tools when you choose to use them. Basis: contract.
• To prevent fraud, misuse and licence sharing, and to keep the Service secure. Basis: legitimate interests.
• To understand how our website is used, from page counts that do not identify you. Basis: legitimate interests.
• To verify the identity and age of marketplace sellers. Basis: legal obligation and legitimate interests.
• Marketing emails, only if you have agreed or the law allows it. You can ask us to stop at any time.

4. Who We Share It With

We share it only with the service providers we need to run KinkCoach:

• GoCardless (Direct Debit, UK and Europe): your name, email, bank details you enter on their page, and payment amounts.
• Fondy (card payments): your email, card details you enter on their page, and payment amounts.
• Didit (identity checks for marketplace sellers): your ID document, selfie and liveness check.
• Resend (sending email): your email address and the content of emails we send you.
• Cloudflare (website delivery and security): your IP address and the pages you request.
• Hostinger (hosting our websites, database and files): the data we hold is stored on their servers.
• Bunny.net (file storage and video delivery): photos, videos and files you upload to the Hub.
• Anthropic and OpenRouter (AI providers): when you use Alex or an AI writing tool, the text needed for that task, which can include buyer messages and listing details.
• Google Fonts: your IP address, when a page loads its font.
• Postage services (such as Royal Mail Click and Drop, Parcel2Go and Sendcloud): if you buy postage through the Hub, the sender and recipient names and addresses for that parcel.

We may also share data if the law requires it, or to protect our rights, for example with a payment provider during a chargeback.

5. Data Sent Outside the UK

Some of these providers are based outside the UK. Where data leaves the UK it is protected by the safeguards UK law requires.

6. Cookies

We use only the cookies needed to make the Service work:

• a cookie that remembers you confirmed you are 18 or over, which lasts 30 days
• sign-in cookies on the KC Hub, which keep you logged in

We do not use advertising cookies, and our page counts do not use cookies.

7. Keeping Your Data Safe

We protect your data with encrypted connections, access controls, and encryption of stored platform credentials. Payment details stay with GoCardless and Fondy.

8. How Long We Keep It

• Your account: while your account is open. When you close it, your account is deleted 30 days after closure.
• Identity check results and records of what you agreed to: 7 years.
• Payment and accounting records: 6 years.

When we no longer need data, we delete it.

9. Your Rights

You have the right to:

• ask for a copy of your data
• ask us to correct it
• ask us to delete it
• ask us to limit or stop using it, or object to how we use it
• ask for your data in a portable form
• withdraw consent where we rely on it

To use any of these rights, email [email protected]. We will reply within one month.

You can also complain to the Information Commissioner's Office (ICO) at https://ico.org.uk. We would appreciate the chance to sort it out first.

10. Browser Extension (KinkCoach Tools for Chrome, Edge and Opera)

Stored only in your browser

• your saved settings and message templates
• markers that show whether a task has already run, and short-lived identifiers that stop the same action running twice

Sent to our servers

• your licence key, to check your subscription
• the platform you are working on and your username there
• messages between you and your buyers on the platforms you use, so they appear in your Hub inbox
• details of listings and orders the extension works on for you
• basic usage information, such as which features are switched on

You can clear the extension's stored data at any time from its settings.

11. Signing In With Google

Some of our services, such as KinkMarket, let you sign in with your Google account instead of a password. If you never use the "Continue with Google" button, this section does not apply to you.

What we get from Google

We ask Google for three basic permissions: openid, email and profile. From those we receive your Google account identifier, your email address and whether Google has confirmed it, your name, and a link to your profile picture if you have one. We cannot see your Gmail, contacts, calendar, Drive, photos or anything else in your Google account.

How we use it

Only to create your account or recognise you, and to sign you in. We keep your Google account identifier so we can still recognise you if you change your email address, and we keep your email address and name as your account details. We do not store your profile picture. We do not use Google user data for advertising, analytics, profiling, or training any AI model.

Who we share it with

Nobody. We do not sell, rent or pass Google user data to anyone.

How we protect it

The exchange with Google happens over an encrypted connection between our server and Google, and what we keep is protected as described in section 7.

How long we keep it

For as long as your account exists. You can ask us to disconnect Google at any time by emailing [email protected]. That removes the stored Google identifier and leaves your account working. If you close your account, the Google connection is deleted with it.

12. Changes to This Policy

We may update this policy. The latest version is always on this page with its date at the top.