Privacy Policy

This policy describes how SmartKDP ("we", "us") handles personal data when you visit our website, create an account, or use our publishing tools. We have written it against what our systems actually do, table by table — not from a template.

Two things we want to say up front, because they shape everything below:

• We do not sell your personal data, and we do not share it with data brokers.
• We use analytics cookies and advertising cookies, and where you are decides the default. In the EEA, the UK and Switzerland, we ask first and nothing at all is stored on your device before you answer. Elsewhere they are on by default and you can switch either off. They are two separate choices, saying no costs you no functionality, and you can change your mind at any time.
• We advertise on Google, so we measure whether our ads lead to purchases. That is the entire purpose. We do not build advertising audiences, we do not run remarketing, and ad personalisation is switched off permanently in code.

On 21 October 2026 the default changed outside Europe: analytics and advertising measurement now start on there, with a way to switch them off, where before everyone everywhere was asked first. Where you are, and which choice you get below says how we tell, and the sections after it say what changed in each.

This policy changed twice on 13 September 2026: once when we began advertising, and once to describe error reporting before we switch it on (see Error reports below). The first of those is the bigger change. The previous version said we used no advertising cookies at all. We have rewritten the affected sections rather than quietly editing that sentence out, and every previous cookie answer has been reset so nobody is treated as having consented to something they were never asked about.

Who is responsible for your data

The data controller is SmartKDP, Inc., a corporation incorporated in Delaware, United States. Contact details are on our Contact page. For anything involving personal data, email support@smartkdp.com — it reaches a person, not a queue, and it is the fastest route to a real answer.

What we collect and why

Account and identity

When you create an account we store your email address, your display name, your locale, and the time you last signed in. If you sign in with Google, we also receive and store the provider's identifier for you, whether that provider has verified your email, and your avatar URL.

We never see or store your password. Sign-in is handled by our authentication provider, Google, which verifies your credentials for us; the password itself never reaches our systems.

If you are signed out, Google's One Tap card may offer to sign you in with your Google account. It loads a script from Google, which discloses your IP address to them, and it sets a g_state cookie so it does not re-offer itself on every page. In the EEA, the UK and Switzerland, it does not run until you have answered the cookie banner — any answer, including a refusal. Elsewhere there is no banner to wait for, so it can run on your first page view. Before 13 September 2026 it ran on your first page view instead; we found that while auditing this policy against the code and fixed the code. Both the script and the cookie are described in our Cookie Policy.

Why: to give you an account, to keep your work associated with you, and to contact you about your account. Legal basis (GDPR): performance of a contract.

Session and device records

Each time you sign in we create a session record containing a hashed session token (never the raw token), the expiry, your IP address, the country derived from it, your browser's user-agent string, and a device fingerprint.

We want to be direct about the fingerprint, because it is the item most people would want flagged rather than buried: when you sign in, we compute an identifier derived from your browser and device characteristics. We use it to detect account sharing and credential-stuffing attempts, and to recognise a suspicious sign-in. We do not use it for advertising, we do not sell it, and we do not use it to track you across other websites.

We also keep an append-only security log of authentication events (sign-in, sign-out, session revocation) with the same IP, country, and user-agent detail.

Why: account security, fraud and abuse prevention, and enforcing plan limits. Legal basis (GDPR): legitimate interests — keeping accounts secure. You can object; see Your rights below.

Consent records

When you accept our terms at sign-up we store which policy version you accepted, when, and the IP address and user-agent at the time. This is the evidence that consent was actually given, and it is what lets us tell you exactly which wording you agreed to.

Legal basis (GDPR): legal obligation and legitimate interests.

Billing and payment data

Lemon Squeezy, LLC is our merchant of record, and it makes the sale to you. This matters for your data rights, so we will not bury it: because Lemon Squeezy is the seller rather than a processor acting only on our instructions, it is a data controller in its own right for your purchase, alongside being our subprocessor for the billing data we send it. Its own privacy policy governs what it does with the payment, fraud-prevention, tax and invoicing data — and for that part, your data-subject requests can be made to Lemon Squeezy directly as well as to us.

We never receive your card number. Card details are entered directly into payment fields served by Lemon Squeezy and are transmitted to Lemon Squeezy, not to us. We share your email address, and the account and product details of the order, with Lemon Squeezy so it can take the payment and issue the receipt; your billing address and any tax identification number you give are collected by Lemon Squeezy at its checkout, for tax determination, and we receive only the country-level result of it. What we store on our side is: your Lemon Squeezy customer identifier, your orders and payment records, your subscription status, and links to your Lemon Squeezy receipts, which you can reach from Account → Billing.

Why: to honour your plan, show you your purchase history, and meet accounting and record-keeping duties. Sales tax and VAT are not included in our listed prices: Lemon Squeezy determines what is due from your billing country, adds it at checkout, and charges and remits it as merchant of record.

Historic orders. Purchases made before 18 September 2026 were processed by Stripe, and before that by Lemon Squeezy under an earlier arrangement. The payment records for those orders remain in our systems for the accounting-retention period described below, and the provider that handled them retains its own records under its own policy. Legal basis (GDPR): performance of a contract, and legal obligation for the financial records.

Your projects and uploads

Your puzzle books, project documents, generated puzzle sets, and any images you upload are stored on our infrastructure. We treat them as yours. We access them only to operate the service, to fix a fault, or where we are legally required to.

If you edit a book while our service cannot be reached, the changes are kept in your own browser until they can be saved to us, and then deleted there. That copy stays on your device; see our Cookie Policy for the details.

Legal basis (GDPR): performance of a contract.

Where you are, and which choice you get

Whether we ask before measuring anything depends on where you are. In the EEA, the UK and Switzerland (and the territories that follow their rules), we ask first, with the cookie banner. Everywhere else, analytics and advertising measurement are on by default, and you can switch either off with Cookie settings, at the foot of the page or in your account menu.

To decide which applies, our hosting provider, Cloudflare, works out the country your connection comes from, as it does for every request it serves. We use that country only to pick which of the two you get, and we do not store it for this purpose. Your browser also checks its own time zone, without sending it anywhere; a European time zone gets you the European treatment even if your connection says otherwise. If we cannot tell where you are, you get the European treatment. We never ask your browser for your location.

If your browser sends a Global Privacy Control signal, we treat it as a request to switch advertising measurement off, including affiliate tracking, and outside Europe it starts off for you.

Website analytics

We use Google Analytics 4, provided by Google Ireland Limited, to understand which pages are useful and where the site confuses people. It sets cookies (_ga, _ga_*) that distinguish one visitor from another.

In Europe, we ask before any of that happens. Google Consent Mode is set to deny analytics storage before the Google script loads, so until you accept, no analytics cookie is set and no identifier that persists between visits is created. If you decline, none is set at all. Elsewhere, analytics is on from your first visit. Either way you can change your answer at any time via Cookie settings, and it takes effect immediately.

We do not enable Google Signals or ad personalisation, and we never send Google Analytics your name, email address, or any other identifier that would single you out personally. Your IP address is processed by Google to derive an approximate location and is not stored by Google Analytics in its raw form. Advertising measurement is a separate purpose with a separate consent, described next.

Google may process this data in the United States. Google LLC is certified under the EU–US Data Privacy Framework, and Google's standard contractual clauses apply in addition. Full detail is in Google's privacy policy and their description of how they use data from sites that use their services.

Separately, when you first arrive and analytics is on for you, we keep a note of where you came from (referrer and any campaign parameters in the link) in your browser's sessionStorage. That is not a cookie and it is erased when you close the tab.

Legal basis (GDPR): consent, which you give via the cookie banner and can withdraw at any time. Withdrawing does not affect anything measured before you withdrew. Outside the EEA, the UK and Switzerland, we rely on our legitimate interest in understanding how the site is used, and you can object at any time by switching analytics off.

Advertising measurement

We advertise SmartKDP on Google. While advertising measurement is on for you — because you accepted it in Europe, or because you are elsewhere and have not switched it off — Google Ads is able to tell that a click we paid for ended in a purchase, which is how we decide whether an ad is worth running. Legal basis (GDPR): consent, given via the cookie banner and withdrawable from any page. Outside the EEA, the UK and Switzerland, we rely on legitimate interests, and you can object by switching advertising off or by sending Global Privacy Control.

What is involved, stated in full:

• Cookies. Google Ads sets the _gcl_* cookies listed in our Cookie Policy, recording that you arrived from one of our ads.
• Click identifier. If you arrive through an ad, the identifier Google adds to the link is kept in your browser for up to 90 days and attached to any purchase you make, so the purchase can be credited to the right click. We store it alongside the order on our own systems and delete it with the order.
• A scrambled email address. When you buy something we send Google a one-way hash of the email address on the order, computed in your browser before anything leaves it. Google uses it to match the purchase to an ad click. The address cannot be read back out of the hash, but it is pseudonymous rather than anonymous: anyone who already holds an address can compute the same value. This is the one piece of personal data we send to Google that we previously said we never would, and it is why this policy has a new version rather than an edit.
• The purchase itself. The fact of a purchase, its value, and its currency.

If you decline or switch off advertising, or your browser sends Global Privacy Control, none of this happens. No advertising cookie is set, no click identifier is kept, and nothing about your purchase reaches Google Ads — not even an anonymised signal, which Google would accept and which we have chosen not to send.

We do not use any of this to build audiences or to show you further ads: ad personalisation and Google Signals are denied in code on every page, for everyone, whatever they answered.

Affiliate referrals

Some people who write about SmartKDP earn a commission when a reader they sent buys something. The program is run by Lemon Squeezy, our merchant of record. Legal basis (GDPR): consent, given as part of the advertising choice on the cookie banner and withdrawable from any page. Outside the EEA, the UK and Switzerland, it follows the advertising choice described above.

This applies only if you arrive through an affiliate link (one carrying an ?aff= code) and advertising measurement is on for you. When both are true, Lemon Squeezy's affiliate script:

• sets the ls_aff_ref cookie listed in our Cookie Policy, for up to 90 days;
• computes a device identifier from your browser's characteristics, so the referral can still be credited if the cookie is cleared; and
• sends that identifier, the page address and the referring site to Lemon Squeezy.

When you pay, the checkout carries the referral so Lemon Squeezy can credit the affiliate. Your price is the same either way.

If advertising measurement is off for you, or you did not arrive through an affiliate link, none of this happens — the script never loads and nothing is sent. Switching advertising off later deletes the cookie.

Product usage events

We record events about how the product is used — for example that an export ran, or that a project was created — linked to your account and stored on our own servers.

Most are written by the server at the moment it does the thing. Two are reported by the app in your browser, because nothing reaches our server when they happen: placing a generated puzzle onto a page, and the upgrade screen being shown to you. Both go to our own endpoint on this domain. No third-party analytics service is involved in any of it, and no additional cookie is set. (Error reports are a different thing and do go to a third party — they are described next, so this sentence is not doing work it should not.)

These events carry what happened, not what you wrote: never a manuscript, a puzzle's words, a book title, or a file name. They are anonymised if you delete your account.

Legal basis (GDPR): legitimate interests — improving the product.

Error reports

When something breaks — a purchase that will not complete, an export that fails, a page that goes blank — we would rather find out from the failure than from you. So a report is sent to Sentry, an error-monitoring service, containing the error, the place in our code it happened, and the address of the page or API route involved.

This is new as of 13 September 2026 and is not switched on yet. We are telling you before we switch it on rather than after.

Three things it never receives, and these are enforced in our code rather than by being careful:

• Not the query string. A web address is cut at the ? before a report leaves us, so nothing carried after it — which can include personal details — ever reaches the error store.
• Not what you sent. Request bodies, cookies and headers are not collected at all — so there is no manuscript, no puzzle, no upload and no payment detail in an error report.
• Not who you are. We do not attach your name, email address or account id. There is no session recording, no screen capture and no replay of what you did.

One limit stated plainly: a report carries whatever our own code put into the error message. We do not put customer data there, and Sentry strips common sensitive patterns on its side, but that is a practice with a safety net rather than a guarantee of the kind the three points above are.

No cookie is set for this, and nothing is stored on your device.

Legal basis (GDPR): legitimate interests — keeping the service working and secure. This is the same basis as our security logging rather than the consent basis our analytics uses, because a service that cannot see its own failures cannot be fixed, and because none of it identifies you.

Email

We send two kinds of email and they are governed differently.

Service email — receipts, refunds, payment problems, security notices, and updates about work you started, such as a large puzzle set finishing or an allowance running low. These come with having an account and cannot be switched off while you have one, because they are the record of what you were charged and what happened to your work.

Legal basis (GDPR): performance of our contract with you, and our legitimate interest in telling you about your own account.

Product updates — new tools, template releases, and publishing tips. Creating an account subscribes you to this list. We say so on the sign-up form, every message carries an unsubscribe link, and you can leave at any time from Settings → Notifications. Unsubscribing costs you nothing else: your account and every service email above are unaffected.

Legal basis: our legitimate interest in telling our own users about our own similar products — the "soft opt-in" in Regulation 22(3) of the UK's PECR and Article 13(2) of the ePrivacy Directive. You may object at any time, and unsubscribing is the whole of what objecting takes.

If you subscribe using the newsletter form on our website without creating an account, that submission is your consent, and you may withdraw it the same way.

For either kind we store your email address, when you subscribed, where you subscribed from, and a record of every time you changed the setting — including which version of this policy was in force when you did. We keep those records as evidence that we had a basis to email you, and we keep them even after you unsubscribe, which is the only way an unsubscribe can be proved.

Support conversations

If you email us, we keep the correspondence so we can help you and refer back to it.

If you report a KDP rejection from a book's Publish page, we keep what you send — KDP's message, any screenshots you attach, the rule you think it was and which of your files it was about — and email it to our support team, so we can find out why a file we checked was refused. We keep a report while we look into it; email us and we delete it.

Legal basis (GDPR): legitimate interests.

Who else processes your data

We use a small number of service providers ("subprocessors"). The current list, with what each one does and where, is maintained at /subprocessors and kept up to date there rather than restated here, so the two can never disagree.

We may also disclose data where we are legally required to, or to establish or defend legal claims. If our business is ever transferred, your data may transfer with it; we would tell you first.

International transfers

Some of our providers process data in the United States. Where personal data of individuals in the European Economic Area or the United Kingdom is transferred there, we rely on the transfer mechanisms offered by those providers, typically the European Commission's Standard Contractual Clauses.

How long we keep it

Note the payment row: when you ask us to delete your account, we remove or anonymise your personal data, but we must keep the underlying financial ledger. We will tell you exactly what was kept and why.

Your rights

Wherever you live, you can ask us to:

• Access the personal data we hold about you, and get a copy.
• Correct anything inaccurate.
• Delete your data, subject to the record-keeping duties above.
• Export your data in a portable format.
• Object to or restrict processing we carry out on the basis of legitimate interests, including the security fingerprinting described above.
• Withdraw consent for anything based on consent, such as the newsletter.

If you are in the EEA or UK, these are your GDPR rights and you also have the right to complain to your local supervisory authority. If you are in California, these are your CCPA/CPRA rights; we do not sell or share personal information as those terms are defined, we honour a Global Privacy Control signal as a request to switch advertising measurement off, and we will not discriminate against you for exercising a right.

To exercise any of them, email support@smartkdp.com. We will verify that the request is really from you, and we respond within 30 days.

Children

SmartKDP is a business tool and is not directed at children under 16. We do not knowingly collect their data. If you believe a child has given us personal data, email us and we will remove it.

Security

How we protect this data — including the fact that card details never touch our servers — is described on our Security page.

Changes to this policy

If we make a material change, we will update the version and effective date at the top of this page and notify account holders by email before it takes effect. Past versions are available on request.