Privacy Notice

Last updated 20 October 2026. This describes what our code actually stores, checked against the code and the logs.

What we keep when you buy

• Your Stripe checkout session id — we store it because it is how we make sure one payment issues exactly one key or pack, and never two.
• Your API key as a one-way hash only. We store a SHA-256 of it, never the key itself. Even we cannot read your key back out of our database.
• The key in plain text for 7 days, in a file readable only by the service account and by whoever administers the server, so you can re-open the page that shows it. After 7 days it is never served again. The file itself is erased by a clean-up that runs when another purchase comes in, and immediately if you try to retrieve it after it has expired. There is no scheduled job, so on a quiet day an expired file can sit on disk after it has stopped being usable — it is never served once expired.
• A credit count — how many calls the key has used.
• The area you type at checkout, if you buy a workforce-board pack (that product is not on sale at the moment, so this applies to past orders only) — kept alongside your session for 7 days so we know which pack to prepare for you.
• If you request an invoice — the organisation, area and contact details you typed into that form.

What we do not keep

We never see or store your card number — Stripe handles payment entirely. We do not store your name or email unless you typed it into the invoice-request form. We send you no marketing, because our server cannot send email at all.

Logs

Our service writes a line for selected events — a purchase, a failure, a refused key — not for every request. Successful balance checks, coverage look-ups and health checks write nothing. A line records the time, the event type, and a hash of the session id rather than the session id itself. Two exceptions we would rather state than hide: when you request an invoice, the organisation name you typed is written in the log in clear so the request can be traced to an invoice; and if you run too many coverage look-ups in a short time, your IP address is written in the log alongside the refusal.

Separately from that, our web server keeps an ordinary access log, as almost every web server does: for each page you load it records your IP address, the page, the time, the page you came from and your browser's user-agent string. Those entries are kept for roughly two to three weeks of rotations and then deleted. We do not use them for marketing or profiling; they exist for debugging and abuse handling. The pages that carry a purchase reference in their address are excluded from that log on purpose, so a reference that could fetch your key is never written to it. API keys, payment details and secrets are never written to a log. Log files are readable by the service account, by the group it belongs to, and by whoever administers the server.

Who processes data for us

• Stripe — payments and receipts.
• Cloudflare — routes and protects traffic for our tool endpoint at product.kcalbinmcp.uk only. This website, kcalbin.com, is served directly from our own server and does not pass through Cloudflare.
• Supabase — the database holding key hashes and credit counts.
• DigitalOcean — the server itself.
• Telegram — how the owner is alerted to a sale or a failure. If you request an invoice, the name, email address, organisation and area you typed are sent to Telegram in that alert. If you buy a workforce-board pack by card, the area you typed at checkout is sent there too. This is the one place personal data leaves our own server, which is why it is named here.

How long we keep things

Plain-text keys: 7 days. Key hashes and credit counts: while the key is usable, so you can check a balance. Invoice requests: we keep these until you ask us to delete them. Nothing deletes them automatically — settling an invoice does not remove the request, so it stays on our server until a person removes it.

Asking for deletion

Email carey@kcalbin.com and say what you want removed. One person does this by hand — there is no self-service delete button and no automatic process — and deleting the key hash and credit record permanently disables that key. Stripe keeps its own payment records independently of us — ask Stripe about those.

A note on this notice: it was drafted plainly from what the code does and contains no boilerplate we cannot stand behind. It is not legal advice, and an attorney should review it before you rely on it.

Kcalbin LLC · carey@kcalbin.com · Terms of Sale · Privacy Notice