Privacy Policy

1. Introduction

KeyBouncer ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, website, APIs, and related services (collectively, the "Service"). By using the Service, you consent to the practices described in this policy.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Your name and email address
• Payment details processed securely through Stripe (we do not store card numbers)
• Account preferences and settings

2.2 Usage Data

We automatically collect certain information about how you use the Service:

• Validation logs (license key validation requests, response times, success/failure status)
• API usage analytics (request counts, endpoint usage, aggregated performance metrics)
• IP addresses, user agent strings, and approximate geographic location derived from IP
• Audit logs of account actions (license creation, team changes, settings updates)

2.3 License Data

As part of providing the Service, we store:

• License keys (encrypted at rest using AES-256-GCM)
• License metadata (status, type, expiration, customer information you provide)
• Activation records including hardware IDs and device metadata

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process payments and manage your subscription
• Send transactional emails (magic links, welcome emails, team invitations)
• Monitor and enforce rate limits and usage quotas
• Generate analytics and insights for your dashboard
• Detect and prevent fraud, abuse, and security threats
• Respond to support inquiries and communicate service updates

4. Third-Party Services

We use the following third-party services to operate the platform:

• Stripe — Payment processing. Stripe handles all payment card data in accordance with PCI-DSS standards. See Stripe's Privacy Policy.
• Resend — Transactional email delivery (magic links, notifications). See Resend's Privacy Policy.
• Upstash — Rate limiting and caching infrastructure. See Upstash's Privacy Policy.

We do not sell, rent, or share your personal information with third parties for their marketing purposes.

5. Data Security

We implement industry-standard security measures to protect your data, including:

• AES-256-GCM encryption for sensitive data at rest (license keys)
• HTTPS/TLS encryption for all data in transit
• HMAC-SHA256 signed webhooks for secure event delivery
• HTTP-only cookies for authentication tokens (XSS protection)
• Rate limiting on all API endpoints to prevent abuse
• Strict security headers (HSTS, CSP, X-Frame-Options)

While we strive to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

6. Data Retention

We retain your data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, except where retention is required by law or for legitimate business purposes (such as resolving disputes or enforcing agreements). Aggregated, anonymized data may be retained indefinitely for analytics purposes.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict processing of your data
• Export your data in a portable format

To exercise any of these rights, contact us at support@keybouncer.com.

8. Cookies and Tracking

We use HTTP-only cookies for authentication purposes (storing JWT tokens). We do not use third-party tracking cookies or advertising pixels. We do not participate in cross-site tracking or targeted advertising.

9. Children's Privacy

The Service is not directed to children under the age of 13. We do not knowingly collect personal information from children. If we become aware that a child under 13 has provided personal data, we will take steps to delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Service and updating the "Last updated" date. Your continued use of the Service after changes are posted constitutes acceptance of the revised policy.

11. Contact

If you have any questions about this Privacy Policy or our data practices, please contact us at support@keybouncer.com.