Privacy Policy

Last updated October 2026

This is a working draft pending legal review. The operator's company details will be added before KiteWP accepts payments.

We collect as little personal data as we can and use it only to provide KiteWP. This policy explains what we collect, why, and your rights under the GDPR.

What we collect

• Account data: email address, optional name, password (stored only as a secure hash), and Google account ID if you sign in with Google.
• Theme requests: your wizard answers, uploaded images and change requests.
• Orders: purchases, payments and invoices; for domains, the registrant details the registry requires.
• Support: your tickets and our replies.
• Technical data: IP address and browser information in security logs, kept for a limited time to protect the service.

Why we use it (legal basis)

• To provide the service you asked for: building, previewing and delivering your theme, domain and hosting (contract).
• To keep the service secure and prevent abuse (legitimate interest).
• To meet accounting and tax obligations (legal obligation).

We do not sell your data and we do not use advertising trackers. KiteWP only uses cookies that are needed for sign-in and security.

Who processes it for us

Hosting in Germany (Runflare), source and build storage (GitHub), our AI generation service, email delivery, payment providers, and for domains our registrar. Each receives only what it needs. Some providers may process data outside the EU under appropriate safeguards such as the EU Standard Contractual Clauses.

Themes you don't buy

If you do not buy a theme within its decision period, it is published in the public KiteWP archive with the content and images it contains, as you agree separately when ordering (see the Terms, section 4). You can ask support at any time to change or remove personal details in an archived theme. Themes you buy are never published.

How long we keep it

• Images uploaded in a wizard that was never submitted: deleted after 3 days.
• Account and theme data: while your account exists.
• Invoices and payment records: as long as tax law requires.
• Security logs: up to 90 days.

Your rights

You can access, correct, export or delete your data, object to processing, and complain to a data protection authority. Contact us through support to exercise these rights.