Legal
Privacy Policy
This policy explains what personal information Key & Kit collects through keyandkit.com, our email list and our Payhip store, how we use it, and the choices you have.
Who we are
Key & Kit is a trade name of Theodore Osborne, a sole proprietor based in Ohio, USA ("Key & Kit", "we", "us", "our"). We are responsible for the personal information described here. Contact: [email protected].
Information we collect
Information you give us. Your first name and email address when you sign up for a free download or update notices; anything you write when you email us.
Purchase and membership information. When you buy or join through Payhip, Payhip shares with us your name, email address, the products or plan you bought, order amount and date, country (and, where needed for tax, billing location), discount codes, and subscription status. Card and PayPal payment details are handled by PayPal or Stripe; we never receive your full card number.
Sign-up source. Our sign-up forms include a hidden field recording how you found us (for example the campaign tag in the link, the referring website, and the page you signed up on). To do this, our site saves a short note of your first visit's source in your browser's local storage. It stays on your device, is only sent to us if you submit a sign-up form, and you can clear it at any time by clearing your browser's site data.
Website analytics. We use Cloudflare Web Analytics, which is cookieless and doesn't track you across sites. It gives us aggregate statistics such as page views, referring sites, country, and browser or device type. We don't use advertising pixels, ad trackers, or tracking cookies on our site.
How we use it
- To process orders, deliver files and run member access (through Payhip).
- To send the free download you asked for and, if you signed up, our emails with host tips, template updates and offers. Every email has an unsubscribe link.
- To answer your questions and give support.
- To understand which pages and campaigns work, in aggregate, so we can improve the site and products.
- To prevent fraud, keep records for taxes and accounting, and meet legal obligations.
Who we share it with
We share personal information only with service providers that help us run the business, and only for that purpose:
- Payhip: store, checkout, file delivery, customer and member accounts, and order records.
- PayPal and Stripe: payment processing and fraud prevention.
- Kit (formerly ConvertKit): our email list and email delivery.
- Cloudflare: website hosting, security and cookieless analytics.
- Google (Gmail): our support inbox, if you email us.
We may also disclose information if required by law, to protect our rights or others' safety, or as part of a sale or transfer of the business (in which case this policy would continue to apply). We do not sell your personal information, and we do not share it for cross-context behavioral advertising or targeted advertising.
Cookies and similar technologies
Our own site doesn't set cookies. It uses browser local storage only for the sign-up-source note described above (and a short preview note when the site runs without a connected email service). Payhip's checkout and member pages, and PayPal or Stripe, may set their own cookies needed for checkout, login and fraud prevention; see their privacy policies. Because we don't sell or share data for advertising, there's nothing to opt out of, but we honor Global Privacy Control (GPC) browser signals as an opt-out request anyway.
How long we keep it
- Email list: until you unsubscribe or ask us to delete it. After an unsubscribe we keep only your email address on a suppression list so we don't email you again.
- Orders and membership records: for as long as needed for taxes, accounting and refunds, generally up to 7 years after the transaction. Payhip, PayPal and Stripe also keep records under their own policies.
- Support emails: up to 3 years after the conversation ends, unless needed longer for a dispute.
- Analytics: aggregate only, retained by Cloudflare under its own policy.
Your privacy rights
Depending on where you live, including California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other US states, you may have the right to:
- know what personal information we collect, use and disclose, and get a copy of it (access and portability);
- correct inaccurate information;
- delete your information (subject to exceptions such as tax records we must keep);
- opt out of the sale or sharing of your information, targeted advertising, and profiling (we don't do any of these);
- not be discriminated against for exercising these rights.
Some of these laws may not apply to a business of our size, but we offer these rights to everyone. To make a request, email [email protected] from the address you used with us (or tell us which address it was). We'll confirm your request within 10 days and respond within 45 days. We may ask for information to verify your identity. You can use an authorized agent if you give them signed permission. If we decline your request, you can appeal by replying to our decision with the subject "Privacy appeal", and we'll respond within 45 days; if you're still unhappy, you can contact your state attorney general.
Categories of information (California notice)
In the last 12 months we have collected: identifiers (name, email address); commercial information (products and plans bought, order history); and internet activity (sign-up source and aggregate site analytics). We collect it from you, from Payhip and our payment processors, and from your browser, for the purposes listed above, and disclose it only to the service providers listed above. We don't collect sensitive personal information, and we don't sell or share personal information, including that of consumers under 16.
Children
Our site and products are for adults running rental businesses. They are not directed to children under 13, and we don't knowingly collect personal information from children under 13. If you believe a child has given us information, email us and we'll delete it.
Security
We use reputable providers with encryption in transit (HTTPS), keep access to our accounts limited to us, and use strong passwords and two-factor authentication where available. No method of storage or transmission is completely secure.
Where your information is processed
We are based in the United States, and our service providers process information in the United States and other countries. If you are outside the US, your information will be transferred to and processed in the US.
Changes to this policy
We'll post any changes here and update the date at the top. If a change materially affects how we use information you already gave us, we'll let you know by email.
Contact
Privacy questions and requests: [email protected]. We don't have a postal address for correspondence at this time, so please contact us by email at [email protected].
Contact: [email protected]