Privacy Notice

Version 1.0.0 — effective 19 July 2026

Controller and contact

The controller is Sinfin s.r.o., company ID 45800171, Korunní 2569/108, Vinohrady, 101 00 Prague 10, Czech Republic. Use [email protected] for questions or data-subject requests.

Data, purposes and legal bases

• Order: random order number, selected edition, CZ country, price, tax, and the versions and digests of accepted documents. We use this to conclude and perform the contract, prove acknowledgements, handle complaints and meet legal duties.
• Payment: BTCPay invoice ID and state, currency, expected and received amount. We do not retain full webhook payloads or a wallet address beyond data needed from the provider to reconcile payment.
• Licence and delivery: one-way digests of recovery/claim capabilities, activations, installation public key, signed certificate, downloads and receipt. Exchange API keys are never stored in HodlerKit cloud.
• Optional email: encrypted solely to deliver the purchase. It is not used for marketing. Purchase and recovery work without email.
• Security: Cloudflare processes an IP address and technical metadata in transit. The application stores only the two-letter country needed for sales and tax decisions, not the full IP address.

Legal bases are contract performance, legal obligations and legitimate interests in security, abuse prevention and legal claims. We request no marketing consent.

Recipients and transfers

Cloudflare provides hosting, D1, R2, protection and Turnstile; BTCPay infrastructure processes payment; Resend sends a delivery message only when an email is supplied. Accounting, tax or legal advisers receive only what is necessary. Providers may process data outside the EEA only with an applicable legal mechanism and contractual or technical safeguards. We do not sell data.

Retention

• encrypted optional email is erased after confirmed delivery, an authenticated request, or no later than 30 days after creation;
• payment, contract, tax and acceptance records are retained for 10 years after the relevant accounting period, or longer while a dispute remains open;
• active licence and security evidence remain for the licence lifetime; after termination, only evidence needed for legal claims and repeat-abuse prevention remains;
• short-lived provider security logs follow the service configuration and are not used for marketing profiles.

Your rights

You may request access, correction, erasure, restriction and portability, and object where the relevant right applies. Some contract and tax evidence cannot be erased before its statutory period ends. We respond without undue delay, normally within one month. You may complain to the Czech Office for Personal Data Protection, https://uoou.gov.cz/.

HodlerKit performs no marketing profiling or solely automated decision with legal or similarly significant effects. An automatic checkout refusal outside the supported country can be reviewed through the contact email.