Service owner: KeyFlint (ArceeDev)
Privacy and support contact: support@keyflint.dev
Main jurisdiction: Spain / European Union (GDPR, Regulation (EU) 2016/679, and the Spanish LOPDGDD).
| Context | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Website visits (keyflint.dev) | IP address and technical connection metadata | Server security, content delivery and aggregate, cookieless traffic statistics | Legitimate interest (Art. 6(1)(f) GDPR) | Technical access logs (up to 90 days) |
| License purchase (self-hosted or Managed) | Email, name, country, payment-provider customer ID | Issuing, cryptographically delivering and supporting the license | Performance of a contract (Art. 6(1)(b) GDPR) | License term + statutory tax retention periods |
| Managed instance | Contact email, assigned domain/slug, public keys | Provisioning and operating the infrastructure | Performance of a contract (Art. 6(1)(b) GDPR) | Service term + 7-day grace period after cancellation |
| Transactional emails | Email address and the content of the license or quota alerts | Product delivery and operational notifications | Performance of a contract (Art. 6(1)(b) GDPR) | Delivery logs at the email provider (up to 30 days) |
| Technical support | Email address and messages you send | Resolving incidents and providing technical assistance | Legitimate interest and the contractual relationship | 2 years from the last message |
Payment data: KeyFlint never accesses or stores card numbers. Payments are processed by Stripe (Stripe Managed Payments acts as Merchant of Record), which is PCI-DSS Level 1 certified.
Cookies: This static website sets no advertising or tracking cookies and uses no third-party fingerprinting. Traffic statistics come from Cloudflare Web Analytics, which does not use cookies.
We rely on the following technology providers, each bound by security and confidentiality commitments:
KeyFlint Managed database servers and backups are located in the European Union. Where auxiliary providers operate from outside the European Economic Area, transfers rely on the EU-U.S. Data Privacy Framework (DPF) or on the Standard Contractual Clauses (SCCs) adopted by the European Commission.
Under the GDPR and applicable law, you have the right to access your personal data, request its rectification or erasure, restrict or object to its processing, and request its portability.
To exercise these rights, email support@keyflint.dev. We will respond within 30 days at the latest. You also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or the supervisory authority in your country.
If you are an end user of an MCP server, CLI or application that a developer protects with KeyFlint, the controller is the developer or company you bought the product from. KeyFlint does not store your usage data except on that developer's behalf under its contract with them.