Privacy Policy
This policy explains what personal data Ownkit collects when you visit ownkit.cloud, create an account, buy or get a kit, or sell kits, why we do it, who else receives it and what rights you have.
In short
- We collect what we need to run your account and your purchases: your email address, an optional name and your orders. There is no password: you sign in with a one-time code we email you.
- Card details go straight to Stripe. We never see your full card number.
- What you type into a kit stays in your own files and your own Claude app. Ownkit does not receive it.
- Campaign tracking and the Meta and TikTok ad pixels only run if you allow them. You can change that any time with Cookie settings.
- We do not sell your data for money. We honour Global Privacy Control.
- You can ask to see, correct or delete your data by emailing us.
1. Who is responsible
Ownkit is operated by Kaptein Consultancy, Bleekstraat 11, 7571 CK Oldenzaal, Netherlands, registered with the Dutch Chamber of Commerce under number 70548803 ("Ownkit", "we", "us"). We are the controller of the personal data described in this policy.
Contact for all privacy questions and requests: info@ownkit.cloud. We have not appointed a data protection officer.
2. What we collect, why, on which legal basis and for how long
The legal bases come from Article 6(1) of the EU General Data Protection Regulation (GDPR): (b) a contract with you, (c) a legal obligation, (a) your consent and (f) our legitimate interests.
| Purpose | Data | Legal basis | How long we keep it |
|---|---|---|---|
| Your account: create it, sign you in, keep your kits | Email address, optional display name, one-time sign-in codes (valid for a short time, handled by our authentication provider), account ID, sign-in times and the IP address used to sign in | Contract (b) | As long as your account exists. After you ask us to delete it, within 30 days, except the order records below |
| Purchases and free kits: deliver the kit, let you download it again, handle refunds | Account ID, email address, which kit, price, currency, date, order status, Stripe Checkout Session ID, and your consent to immediate delivery with the time you gave it | Contract (b); keeping records for tax and bookkeeping is a legal obligation (c) | 7 years after the end of the year of the order, the Dutch bookkeeping and tax retention period |
| Payment | Card or other payment details are entered on Stripe's checkout page and processed by Stripe. We receive the payment status and amount | Contract (b) | With the order record (7 years). Stripe keeps its own records under its own privacy policy |
| Shops and kits you sell | Shop name, shop address on Ownkit, bio, kit files (zip), images, listing text, chosen price and plan, sales and balance | Contract (b), under the Seller terms | While the kit is listed, and after that as long as buyers can still download their copy. Uploads that are declined or withdrawn before going live: deleted within 90 days. Sales records: 7 years |
| Automatic check of kit uploads | The files in your zip and the listing form, sent to Anthropic's API to suggest listing text and flag risky instructions. A person at Ownkit makes the final review decision | Contract (b); keeping buyers safe is also our legitimate interest (f) | We keep the result with your upload. Anthropic states that it deletes API inputs and outputs within 30 days, with exceptions such as enforcing its usage policy or legal requirements |
| Remembering your cookie choice | Your choice per category, a version number and the time you chose | Legal obligation to be able to show consent (c), GDPR Article 7(1) | On your device for 12 months, then we ask again |
| Campaign attribution (only with Statistics consent) | The campaign codes in the link you arrived with (utm_source, utm_medium, utm_campaign, utm_content, utm_term) and the maker code (ref). If you buy, these codes are added to the payment record at Stripe | Consent (a) | On your device for 30 days. If you buy, as part of the payment record at Stripe for as long as that record is kept |
| Measuring our ads (only with Marketing consent) | Pages viewed, which kit you looked at, starting checkout, a completed purchase with its value, getting a free kit, creating an account and opening a shop, plus cookie IDs, click IDs from an ad, IP address and browser details, sent to Meta and TikTok through their pixels. For purchases and free kits we also send the event to Meta directly from our server (Meta Conversions API), with your email address, country and account ID only in hashed (scrambled) form, so Meta can match it and count it once. Never on pages of health related kits | Consent (a), as required by Article 5(3) of the ePrivacy Directive | Cookies: up to 90 days (Meta) and up to 13 months (TikTok). Meta and TikTok keep what they receive under their own policies |
| Hosting, security and abuse prevention | IP address, browser type, requested page and time, in the server logs of our hosting provider and of the network that serves our sign-in library | Legitimate interest (f): delivering and securing the website | Only for the short log retention period of these providers |
| Support, complaints and reports of illegal content | Your email address, your message and anything you attach, and our reply | Contract (b); handling notices under the Digital Services Act is a legal obligation (c); otherwise legitimate interest (f) | 2 years after the case is closed, longer only if needed for a legal claim |
We send emails that belong to the service: your sign-in codes, and confirming your order. We do not send marketing emails. If we ever want to, we will ask you first.
Providing your email address is needed to create an account, and an account is needed to get or buy a kit. Everything else in the table is optional or only happens with your consent.
3. Data inside kits
Kits run in your own Claude desktop app, on your own computer. What you type into a kit, and the files a kit creates, are processed by your Claude app under your own agreement with Anthropic. Ownkit does not receive that data. Some kits can connect to other services that the kit page lists, such as a spreadsheet or database you choose. That connection is between you and that service.
We do keep a record that you bought or got a kit, including kits on health related topics such as pregnancy, a newborn or sleep. We use that record only to give you access to the kit, keep our books and handle refunds. We never use it for advertising and never send it to Meta or TikTok.
4. Who receives your data
We use the following providers. A processor handles data only on our instructions under a data processing agreement. An independent or joint controller also decides on part of the processing itself.
| Recipient | What for | Role | Where, and transfer safeguard |
|---|---|---|---|
| Supabase (Supabase Pte. Ltd., Singapore) | Accounts, sign in, database with orders, shops and kits, file storage for kit uploads, account emails | Processor | Our database is hosted in the EU (Frankfurt, Germany). Supabase's data processing agreement includes the EU Standard Contractual Clauses for access from outside the EEA |
| Resend | Sending account emails (sign-in codes) and order confirmations | Processor | Our account sends from Resend's EU region (Ireland). Resend receives your email address and the content of the email. We do not use its open or click tracking |
| Vercel Inc., United States | Hosting the website and running our server functions (checkout, downloads, upload check) | Processor | May process data in the United States. Vercel's data processing agreement uses the EU Standard Contractual Clauses (2021/914) and the UK addendum |
| Stripe | Checkout and payments | Processor for processing your payment for us; independent controller for its own fraud prevention, anti money laundering and legal compliance | Stripe states that it complies with the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, and also uses the EU Standard Contractual Clauses. See stripe.com/privacy |
| Anthropic (Anthropic Ireland, Limited) | Automatic check of kit uploads (makers only) | Processor | Anthropic's data processing agreement includes the EU Standard Contractual Clauses. Its commercial terms say it may not train models on this content |
| Meta Platforms Ireland Limited | Meta Pixel and Meta Conversions API, only with Marketing consent | Joint controller with us for collecting and sending the data from our site; Meta is controller for what it does with it afterwards | Meta may transfer data outside the EEA under the safeguards in Meta's privacy policy |
| TikTok Technology Limited (Ireland) | TikTok Pixel, only with Marketing consent | Joint controller with us for collecting and sending the data from our site; TikTok is controller for what it does with it afterwards | TikTok may transfer data outside the EEA under the safeguards in TikTok's privacy policy |
| Advisers and authorities | Accountants, lawyers, and authorities or courts when the law requires it | Independent controllers | Mostly in the Netherlands |
Makers who sell on Ownkit see how many of their kits sold, for how much and when. They do not see who bought them. Some shops on Ownkit are run by the Ownkit team; for those, Ownkit is the seller and the maker.
For the joint controllership with Meta and TikTok, we agreed terms with each of them on who does what. You can use your rights with us or directly with Meta or TikTok. If you want to know the essence of these arrangements, ask us.
5. Transfers outside the EEA
When a recipient above processes data outside the European Economic Area, we rely on an adequacy decision of the European Commission (such as the EU-U.S. Data Privacy Framework, for recipients that are certified under it) or on the Standard Contractual Clauses approved by the European Commission. You can ask us for a copy of the relevant safeguards.
6. Your rights
Under the GDPR you have the right to:
- access your personal data and get a copy (Article 15);
- have incorrect data corrected (Article 16);
- have your data deleted (Article 17), unless we must keep it, for example order records for tax purposes;
- restrict processing (Article 18);
- receive the data you gave us in a common format, or have it sent to another provider (Article 20);
- object to processing based on our legitimate interests (Article 21);
- withdraw your consent at any time, without affecting processing before that (Article 7(3)). For cookies and pixels, use Cookie settings at the bottom of every page.
Email your request to info@ownkit.cloud from the email address of your account. We answer within one month. If we need more time for a complex request, we tell you within that month. We may ask you to confirm your identity.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. The automatic upload check only helps our reviewers.
You can complain to a data protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens. You can also complain to the authority in the EU country where you live or work (list of EU authorities), or in the United Kingdom to the Information Commissioner's Office. We would appreciate the chance to solve it with you first.
7. Notice for US residents
This section applies to residents of US states with consumer privacy laws, such as California (California Consumer Privacy Act as amended by the California Privacy Rights Act), Colorado, Connecticut, Virginia, Texas and others. It is our notice at collection: it tells you what we collect and why at or before the moment we collect it.
Categories we collect
| Category | Examples | Purposes | Disclosed to | Sold or shared? |
|---|---|---|---|---|
| Identifiers | Email address, display name, account ID, IP address, cookie IDs | Account, purchases, security; cookie IDs for ad measurement with consent | Service providers (Supabase, Vercel, Stripe); Meta and TikTok only with Marketing consent | Cookie IDs and IP address are shared with Meta and TikTok only if you allow Marketing |
| Customer records | Name and email address linked to your orders | Purchases, refunds, bookkeeping | Service providers (Supabase, Stripe), advisers | No |
| Commercial information | Kits you bought or got, prices, dates; sales and balance for makers | Delivering kits, refunds, bookkeeping, maker payouts | Service providers (Supabase, Stripe); a purchase event with its value to Meta and TikTok only with Marketing consent | Purchase events are shared only if you allow Marketing, and never for health related kits |
| Internet or other electronic network activity | Pages viewed, campaign codes in the link you arrived with | Campaign reporting with Statistics consent; ad measurement with Marketing consent; security logs | Service providers (Vercel, Stripe); Meta and TikTok only with Marketing consent | Shared only if you allow Marketing |
| Sensitive personal information | Account log-in: your email address together with the one-time sign-in code we email you | Only to sign you in and keep your account secure | Supabase as service provider | No |
We collect this information from you, from your browser, and from Stripe (payment status). How long we keep each category is set out in section 2. We do not collect precise geolocation, biometric, health or financial account information. We use sensitive personal information only for purposes that do not give you a right to limit it under California law, so we do not offer a "Limit the Use of My Sensitive Personal Information" link.
Do Not Sell or Share My Personal Information
We do not sell your name, email address or payment details for money. If you allow Marketing in our cookie settings, the Meta Pixel and the TikTok Pixel receive information about your visit, and our server sends purchases and free kits to Meta, so we can measure our ads. Under some US state laws, that can count as "selling" or "sharing" personal information for targeted advertising.
To opt out: and keep Marketing switched off, or choose Reject all. You do not need an account to opt out. If your browser sends a Global Privacy Control signal, we treat it as an opt-out: Marketing stays off and cannot be switched on from that browser.
Ad pixels only ever load after you allow them. Browsers that send "Do Not Track" see the same choice as everyone else; nothing is switched on until you choose.
We do not knowingly sell or share personal information of consumers under 16.
Your US privacy rights
- Right to know and access the personal information we hold about you, including the categories, sources, purposes and recipients.
- Right to delete personal information, with the exceptions the law allows, such as records we must keep.
- Right to correct inaccurate personal information.
- Right to opt out of the sale or sharing of personal information and of targeted advertising, as described above.
- Right not to be discriminated against for using these rights. We do not charge different prices or give a different service if you use them.
To make a request, email info@ownkit.cloud. We confirm receipt within 10 business days and answer within 45 calendar days. If we need more time, we tell you why and can extend once by up to 45 more days. To protect your account, we verify your request by matching it to the email address of your account. You can let an authorized agent make a request for you; we may ask for proof of their authority and ask you to confirm your identity with us.
If we decline your request, you can appeal by replying to our answer with "Appeal" in the subject line. We answer an appeal within 45 days (or the period your state's law sets). If we deny the appeal, you can contact the Attorney General of your state.
We do not offer financial incentives or price differences in exchange for personal information.
8. Children
Ownkit is for adults. You must be at least 16 years old to create an account and at least 18 years old to buy a kit. Ownkit is not directed at children under 13 and we do not knowingly collect personal information from them, as required by the US Children's Online Privacy Protection Act. Some kits help parents plan family life; what a parent enters about a child stays in the parent's own files and does not reach Ownkit. If you think a child has given us personal data, email us and we will delete it.
9. Security
We protect your data with encrypted connections (HTTPS), sign-in with one-time codes instead of passwords, database rules that let you see only your own data, secret keys that stay on our servers, and access for as few people as possible. No system is perfectly secure. If a breach puts your rights at high risk, we tell you without undue delay, and we report breaches to the supervisory authority where the law requires it.
10. Changes to this policy
We update this policy when our processing changes. The version and date at the top show which version applies. If a change matters for how we use your data, we tell you by email or on the site before it takes effect, and we ask for consent again where the law requires it.
11. Contact
Kaptein Consultancy, Bleekstraat 11, 7571 CK Oldenzaal, Netherlands. Email: info@ownkit.cloud.
See also our Cookie Policy, Terms of Service and Legal notice.