Privacy policy

The controller of your personal data is KeyDexa, Latvia. Questions and requests go to support@keydexa.com.

When you buy: your email address, what you bought, the amount, the time, and the moment you consented to immediate delivery. We keep a record of which key was issued against which order.

If you create an account: your email, an optional display name, and a one-way hash of your password. We never store the password itself and cannot recover it.

Automatically: a session cookie if you sign in, a cart cookie holding product identifiers and quantities, and a short-lived record of failed sign-in attempts with the originating IP address, used only to block password guessing.

Card numbers, expiry dates and security codes are entered on Stripe or PayPal's own pages and never reach our servers. We receive only whether a charge succeeded, the amount, and a reference number.

Each purpose has its own legal basis under the GDPR:

• Performing our contract — delivering your key, letting you find it again, handling refunds and replacements.
• Legal obligation — keeping accounting and tax records.
• Legitimate interests — preventing fraud and abuse of the store, and keeping it working.

We do not rely on consent for any of this, which is why there is no cookie banner: both cookies we set are strictly necessary.

Stripe and PayPal take payment. Resend delivers your receipt. Vercel hosts the site and Neon hosts the database. Each processes data on our instructions only.

Trustpilot collects reviews. Your email address is blind-copied to them on your receipt so they can invite you to review the purchase — that copy is the only thing they receive from us, no part of this site loads their software, and they set no cookie on you here. Their invitation carries its own way to opt out.

Jivo provides the live chat. Its software loads only after you press the chat button — not on page load — so nothing reaches it from visitors who never open a conversation. Once opened it receives what you type, along with the technical details any web service sees: your IP address, browser and the page you started from.

These providers are based in, or transfer data to, the United States. Such transfers rely on the European Commission's standard contractual clauses or the EU–US Data Privacy Framework, depending on the provider. [Confirm each provider's transfer mechanism with counsel].

We do not sell personal data, and we do not share it for advertising.

Order records are kept for 7 years to satisfy accounting and tax rules. Failed sign-in records are deleted after 24 hours. Cart cookies expire after 30 days. If you close your account we remove your profile but keep the order record with the account link severed — the record of a sale is not ours to delete.

Under the GDPR you can ask us to:

• give you a copy of the data we hold about you;
• correct anything that is wrong;
• delete anything we are not legally required to keep;
• restrict or object to how we use it;
• hand it over in a portable format.

Write to support@keydexa.com and we will respond within one month. If you are not satisfied, you can complain to Patērētāju tiesību aizsardzības centrs (PTAC) or to the data protection authority where you live.

Two cookies, both strictly necessary: one holds your cart, one holds a random session identifier after you sign in. No advertising, and no analytics service of any kind.

We do count how many people visit, but we count it ourselves and without a cookie. Each visit records the page, the time, and a hash of your address and browser mixed with a secret that changes every midnight. That is enough to tell two people apart on one day and useless for recognising anyone the next — and it is never sent anywhere. Nothing about it can be turned back into your address.

The live chat remains the only third-party component on the site, and it loads nothing until you press the chat button. Open a conversation and Jivo will set its own cookies to keep that conversation going. Do not press it and none are set — which is why this site asks you to accept nothing on arrival.

The store is not intended for anyone under 16, and we do not knowingly collect their information.