Privacy policy

Version of 4 October 2026. The Spanish version prevails in case of discrepancy.

1. Controller

Daniil Khanin, sole trader (autónomo). NIF: ESZ0548134A. C/ Santa Coloma, 35, 1.º 1.ª, 43881 Cunit (Tarragona), Spain. Email: daniil@khanin.info.

2. Our principle: keep the minimum

We do not store your email address. We store only its encrypted fingerprint (HMAC-SHA256 with a secret key), which is used to recognise you when you sign in. The email cannot be obtained from the fingerprint. Still, the fingerprint is pseudonymised data and we treat it as personal data.

3. What data we process and why

• Email fingerprint — to create your account and recognise you when you sign in. Basis: performance of the contract (Art. 6(1)(b) GDPR).
• Email, only at the moment the code is sent — to send you the sign-in code. It is not stored in our database. Basis: performance of the contract.
• Email from the payment — after payment Stripe tells us the address entered on the checkout page. We immediately turn it into a fingerprint to create your account and open access, and show it to you once on the page after payment. The address itself is not stored in our database. Basis: performance of the contract.
• Purchases: which kit, date, Stripe payment identifier, source (Stripe or manual). To open and keep your access. Basis: performance of the contract.
• Sessions: fingerprint of the session token, sign-in date and last visit. To keep you signed in and limit you to 3 devices. Basis: performance of the contract.
• IP address, temporarily, to limit sign-in attempts and protect the site from abuse. Basis: legitimate interest (Art. 6(1)(f) GDPR).

We use no advertising, no third-party analytics and no profiling. We count visits anonymously on our own server, without cookies: which pages are viewed, which site visitors come from and campaign tags (utm). To count unique visitors per day we use a fingerprint of the IP and browser with a random key that is deleted every 24 hours; the IP is not stored and you cannot be recognised from one day to the next. Basis: legitimate interest (Art. 6(1)(f) GDPR).

4. Retention

• Email fingerprint and purchases: for as long as your account exists.
• Sessions: up to 180 days or until you sign out.
• Sign-in codes: 15 minutes (fingerprint only).
• Attempt counters with IP: up to 24 hours.
• Visit statistics: counters and non-reversible daily fingerprints only.

5. Who else processes data

• Stripe Payments Europe, Ltd. (Ireland) — processes card payments, collects the email for the invoice and keeps payment data under its legal obligations, as an independent controller. We never see or store your card details. Stripe's policy.
• Sendinblue SAS (Brevo) (France) — the email service used to send the message with your sign-in code. For this it receives your email address and keeps delivery logs under its own policy. The data stays in the European Union. Brevo's policy.
• Hetzner Online GmbH (Germany) — hosting of the server the site runs on and where the database is kept. The data stays in the European Union.

6. Your rights

You may request access to your data, rectification or erasure, restriction of or objection to processing, and portability. Write to daniil@khanin.info from the email you sign in with: we will compute its fingerprint to find your account. If you delete the account, you lose access to the kits you bought.

You can also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

7. Cookies

We use only strictly necessary technical cookies. Details in the cookie policy.