Who is responsible
[BUSINESS LEGAL NAME] operates KitCubby. Contact [SUPPORT EMAIL — TO BE CONFIRMED] or [BUSINESS CONTACT ADDRESS] about your information. [ADD ANY REQUIRED PRIVACY REPRESENTATIVE OR DATA-PROTECTION CONTACT]. This notice concerns KitCubby’s processing; ChatGPT sign-in, hosting providers, and Stripe may also process information under their own terms and notices.
Information we process
- Account information: a site-specific sign-in identifier and email supplied through ChatGPT sign-in. KitCubby uses the identifier to associate records with your account; email is used where needed for checkout and seller setup.
- Public profile information: your chosen display name, handle, biography, avatar, optional website link, and public listings. Published descriptions, tool content, covers, and listing screenshots are visible according to the listing’s access settings.
- Creations and saved work: uploaded HTML and embedded assets, cover images, bookmarks, and data a hosted tool saves for your signed-in account. Tool data can include information you enter, such as notes or application-tracker entries.
- Purchase and payout records: buyer and creator identifiers, tool identifiers, amounts, currency, payment status, Stripe references, and connected-account readiness. Payment details and seller verification information are entered with Stripe; KitCubby’s checkout does not collect full card numbers.
- Reports and administration: report text, reporter and tool identifiers, moderation status, and owner decision notes. If you contact support, we will also receive your message and attachments.
- Service and security information: hosting, sign-in, payment, and font-delivery providers may receive network information such as IP addresses, browser details, and request metadata while serving the website.
Why we use it
We use account and tool information to provide profiles, hosting, saved work, and purchase access; transaction information to process and reconcile payments and refunds; and reports or technical information to investigate abuse, troubleshoot problems, and protect the service.
Where a lawful basis is required, the proposed mapping is contract performance for requested account and purchase services, legitimate interests for proportionate security and support, legal obligations for required records, and consent for any optional processing that requires it. [CONFIRM APPLICABLE BASES, NECESSITY, AND LEGITIMATE-INTEREST ASSESSMENTS FOR EACH LAUNCH MARKET]. We do not treat use of the site as blanket consent to unrelated processing.
Public information and service providers
Published profiles, listing details, and covers are publicly visible. Free published tools can be opened without signing in; paid source is delivered to authorized accounts. Files delivered to a browser can be copied. Do not place private information or credentials in a tool’s source or cover.
KitCubby uses OpenAI Sites for the website and ChatGPT identity, Cloudflare-backed storage and hosting for application records and files, and Stripe for payment and payout workflows. The current design also loads fonts from Google Fonts, causing the browser to contact that provider. Each provider receives information needed for its role.
A creator cannot read other users’ saved tool data through KitCubby’s normal user APIs. That is an access restriction, not end-to-end encryption. Authorized service administration may require access to stored records. Report notes and moderation decisions are not public listings.
[CONFIRM PROVIDER CONTRACTS, PROCESSOR/CONTROLLER ROLES, SUBPROCESSORS, PROCESSING LOCATIONS, INTERNATIONAL TRANSFERS, AND ANY REQUIRED SAFEGUARDS]. We may disclose information when legally required or necessary to protect users and the service, subject to applicable law.
Cookies and browser storage
Sign-in depends on platform-managed session mechanisms. Hosted tools can use KitCubby’s saved-data bridge to keep limited state for each signed-in user and tool; temporary session state is separate. Anonymous tool sessions and starter examples do not save that tool state to an account.
The application code currently adds no advertising tracker or analytics SDK. This is not a claim that underlying hosting, sign-in, payment, or font services use no cookies or logs. [COMPLETE A LIVE COOKIE/STORAGE INVENTORY, RECORD PURPOSES AND DURATIONS, AND ADD CONSENT CONTROLS IF REQUIRED BEFORE OPTIONAL TRACKING IS INTRODUCED].
How long we keep information
The current application does not automatically delete accounts, tool state, orders, reports, or moderation history on a timed schedule. Unpublishing hides a listing from discovery; it does not erase its files, purchases, or user data.
[RETENTION SCHEDULE TO BE SET: account/profile data; uploaded source and covers; user tool state; transaction/tax records; reports and audit history; support messages; provider logs and backups]. The final schedule must explain a period or meaningful retention criteria for each category, including legally required exceptions. Do not assume a deletion request immediately removes records from every provider or backup.
Your choices and requests
You can edit your public profile and unpublish your own listings. For access, correction, export, deletion, restriction, objection, or another applicable privacy right, contact [SUPPORT EMAIL — TO BE CONFIRMED]. We may need proportionate information to verify that the request concerns your account. Do not send passwords, payment credentials, or identity documents unless a secure, necessary verification process has been agreed.
Depending on where you live, additional rights and complaint routes may apply, including a right to complain to your data-protection authority. If processing relies on consent, you may withdraw that consent without affecting earlier lawful processing. [ADD MARKET-SPECIFIC RIGHTS, REQUIRED RESPONSE PERIODS, AND REGULATOR CONTACTS]. The current app has no self-service account-deletion or full export button.
Children, security, and updates
The proposed launch service is intended for adults, not children. Contact us if you believe a child’s information has been submitted. [CONFIRM THE FINAL AGE POLICY AND RESPONSE PROCESS].
We restrict application access by account and use hosting and payment providers to operate the service. No system is perfectly secure; do not store secrets or highly sensitive records in tools. We will update this notice when processing materially changes and provide notice where required.