Effective Date: 24/09/2026
Controller: JOYKON LTD, trading as Keydra · Company Number 15298115
Registered Office: Suite A, 82 James Carter Road, Mildenhall, England, IP28 7DE
Contact: [email protected]
This Privacy Policy explains how Keydra (“Keydra”, “we”, “us”, “our”) collects, uses, shares, and protects personal data when you visit keydra.net or use our services. It also explains your rights under the UK GDPR and EU GDPR.
If you do not agree with this Policy, please do not use the Platform.
1.1 JOYKON LTD, trading as Keydra, is the controller of personal data processed in connection with your use of keydra.net, your account, purchases, and customer support.
1.2 This Policy applies to visitors, registered users, and guest checkout users.
We collect only what we need to provide and secure the service.
2.1 Data you give us
Email address, for account creation, checkout, and support. Password, stored in hashed form if you create an account. Optional details you send to support, for example screenshots or descriptions of an issue.
2.2 Data we get automatically
IP address, device and browser information, basic system logs, dates and times of requests. Site usage data for security and performance, and to improve features. Cookie and similar identifiers, see section 10. For newsletter signups, the IP address at the time of signup is also recorded for abuse prevention.
2.3 Data from transactions
Order identifiers, product identifiers, fulfilment status and timestamps. Fraud checks and risk signals tied to your session or order, for prevention of abuse.
2.4 Data from third parties
Payment status and limited checkout metadata from payment providers, for example confirmation that a payment succeeded. Authentication basics from social sign-in providers if you choose that option, for example account ID and email.
2.5 Data from affiliate links
If you reach keydra.net through a link from one of our affiliates, such as a content creator or a price comparison site, we record which affiliate sent you, that affiliate’s own reference for the click, the page you landed on, your country and a one-way hashed form of your IP address. If you then place an order, we link the order to that affiliate. See clauses 6.8 and 10.6.
We do not store your full payment card details. Those are handled entirely by our payment providers.
3.1 You may checkout as a guest by providing only your email.
3.2 If you later create or already have an account using the same email, we may associate past guest orders with that account so you can view your history and receive support more easily.
We process personal data for the purposes below, under these legal bases:
4.1 Provide the service and fulfil purchases. Including delivering digital goods, account security, support, and resolving issues. Legal basis: contract necessity.
4.2 Fraud prevention and platform security. Including automated and manual checks, velocity analysis, and IP reputation checks. Our fraud systems may use automated decision-making, see clause 4.6. Legal basis: legitimate interests.
4.3 Service improvement and analytics. For example measuring errors, performance and features. Legal basis: legitimate interests.
4.4 Legal and compliance. For example record keeping, responding to lawful requests. Legal basis: legal obligation or legitimate interests.
4.5 Marketing and commercial email notifications with consent. For example newsletters, wishlist price alerts, and cart abandonment reminders, only if you opt in via your account preferences or the newsletter signup. You can change these preferences at any time in your account dashboard. Legal basis: consent.
4.6 Automated decision-making (Article 22). Our fraud and velocity detection systems use automated processing of IP addresses and order signals to flag or block potentially fraudulent checkout attempts. Where our systems flag your order for review, a human member of our team assesses it before any final action affecting your account is taken. You have the right to request human review of any automated decision that significantly affects you. Contact [email protected].
4.7 Where we rely on legitimate interests we balance our interests against your rights and expectations.
4.8 Affiliate attribution. Recording which affiliate referred a visit or an order, so that we can pay that affiliate and detect fraudulent referrals. Legal basis: legitimate interests. Where the law requires consent for the cookie used to do this, we store it only with your consent, see clause 10.6.
We use the data described in section 2:
5.1 To create and manage your account.
5.2 To deliver orders and show product credentials when you choose to reveal them.
5.3 To detect and prevent fraud and abuse.
5.4 To provide support and handle complaints.
5.5 To maintain and improve the site, features and security.
5.6 To send optional service messages and, with your consent, marketing and commercial email notifications (newsletters, wishlist alerts, cart reminders) that you control via your account preferences.
We share data with the service providers who help us run the platform, and in the other cases set out below:
6.1 Payment providers and banks. To process payments and refunds.
6.2 Hosting, cloud and CDN providers. Infrastructure used to run and deliver the platform.
6.3 Security, anti-fraud and IP reputation providers. Including IP reputation and threat intelligence services used to protect the platform and our customers.
6.4 Customer support tools. Tools used to manage and respond to support tickets.
6.5 Analytics tools. To understand usage and improve user experience.
6.6 These providers act under contracts that require them to protect your data and use it only on our instructions. We also share data where required by law, for example with law enforcement on valid legal requests.
6.7 Bot protection. Account creation, sign-in, password reset and login-link requests are protected by Cloudflare Turnstile, which runs in the background to tell people apart from automated scripts and only shows a checkbox when it cannot decide silently. To do this, Cloudflare processes limited technical data from your browser and device, such as your IP address and browser characteristics, and returns a pass or fail result to us. We do not receive the underlying data, and Turnstile does not track you across other websites. Cloudflare’s handling of this data is described in the Cloudflare Turnstile Privacy Addendum.
6.8 Affiliates. When an order is linked to an affiliate under clause 2.5, we report to that affiliate the order’s reference number, the number of items, the value of the products, the affiliate’s commission, the affiliate’s own click reference, and whether the order was later confirmed or reversed. We do not give affiliates your name, email address, payment details or the contents of your order. Affiliates run their own websites under their own privacy policies, see section 13.
7.1 Some providers may be located outside the UK or EEA.
7.2 Where data is transferred internationally, we use appropriate safeguards, for example Standard Contractual Clauses, and additional technical and organisational measures as needed.
We keep data only as long as needed for the purposes described:
8.1 Account data. For as long as your account is active. On account deletion, personal data is removed subject to the legal retention obligations below.
8.2 Order and support records. For the period needed to handle after-sales obligations, tax and accounting requirements (up to 7 years under UK law), and to resolve disputes.
8.3 Security and fraud logs. For a short rolling period unless needed for ongoing investigations or legal proceedings.
8.4 Marketing preferences. Opt-out records are retained indefinitely to ensure we respect your preferences. Active subscription data is kept while your consent is in place.
8.5 When data is no longer needed, we delete it or irreversibly anonymise it.
8.6 Affiliate referral records. For as long as needed to credit and pay the referring affiliate, to audit that payment, and to resolve any dispute with the affiliate. Where a record is linked to an order, it is kept with the order records in clause 8.2.
Under UK GDPR and EU GDPR you have the right to:
9.1 Access
Obtain a copy of the personal data we hold about you.
9.2 Rectification
Correct inaccurate or incomplete personal data.
9.3 Erasure
Request deletion of your data in certain circumstances, subject to legal retention obligations.
9.4 Restriction
Ask us to restrict how we process your data in certain cases.
9.5 Object
Object to processing based on legitimate interests, including profiling used in fraud prevention.
9.6 Withdraw consent
Withdraw consent at any time where processing relies on consent, for example newsletters or cart reminders. Manage this in your account preferences.
9.7 Portability
Receive your data in a portable format where processing is based on consent or contract and carried out by automated means.
9.8 Human review
Request human review of any automated decision that significantly affects you, including fraud flags.
9.9 To exercise any of these rights, contact [email protected]. We will reply without undue delay, and within one month where the law requires it.
9.10 You also have the right to complain to your local data protection authority. In the UK, this is the Information Commissioner’s Office (ICO) at ico.org.uk. In the EU, contact the supervisory authority in the member state where you reside.
We use cookies and similar technologies to make the site work, keep your session, secure the platform, and understand how features are used.
10.1 Strictly necessary. For core site functions and security, including session management, fraud prevention signals and the Cloudflare Turnstile bot check on account creation and sign-in. These cannot be turned off.
10.2 Functional. To remember preferences, such as your cookie consent choice.
10.3 Performance and analytics. To understand errors, improve UX, and measure how features are used. Requires your consent where applicable under UK or EU law.
10.4 Advertising. Only if we introduce advertising, and only with your explicit consent.
10.5 For EU, UK, and EEA visitors, a consent banner is displayed before non-essential cookies are activated. You can accept or reject non-essential cookies at any time via your browser settings or by revisiting the banner. Withdrawing consent does not affect anything that happened before you withdrew it.
10.6 Affiliate referral cookie. If you arrive through a link from one of our affiliates, we may store a cookie that records which affiliate sent you, so that an order you place later can be credited to that affiliate. It lasts for the attribution period agreed with that affiliate, normally 30 days. For EU, UK, EEA and Swiss visitors, this cookie is stored only if you choose “Accept cookies”. If you choose “Reject”, your visit and any order are not linked to the affiliate. It does not change the price you pay.
11.1 Our services are intended for users aged 16 and over. Users between 16 and 18 should use the service only with the consent of a parent or guardian, as stated in our Terms of Service.
11.2 If we learn that we have collected personal data from a child under the age of 16 without appropriate consent, we will delete it promptly. If you believe we have done so, please contact [email protected].
12.1 Encryption in transit. All data is transmitted over HTTPS/TLS.
12.2 Hashed passwords. Passwords are never stored in plaintext.
12.3 Audit logging. Access and security events are logged for review.
12.4 Access controls. Internal access to personal data is restricted on a need-to-know basis.
12.5 Two-factor authentication. Optional 2FA is available for your account.
12.6 Provider due diligence. Third-party providers are reviewed for security standards.
12.7 You should keep your account credentials safe, use a strong unique password, and sign out on shared devices. No security measures are perfect. If you suspect your account has been compromised, contact [email protected] immediately.
13.1 Our site may contain links to third-party websites. This Policy does not apply to those sites. Their privacy practices are their own. Please review their policies if you choose to visit them.
13.2 We are not responsible for the content or privacy practices of external sites.
14.1 We may update this Policy from time to time. We will post the new version on this page with a revised effective date. If changes are material, meaning they meaningfully affect how we use your data or your rights, we will provide reasonable prior notice by email or via a prominent notice on the Platform.
14.2 Your continued use of the Platform after the effective date of an update means you accept the revised Policy. If you do not agree with a change, please stop using the Platform before the effective date.
15.1 For questions about this Privacy Policy, to exercise your data subject rights, or to raise a privacy concern, contact us at [email protected].
15.2 We will acknowledge your request promptly and respond within one month where required by law.
Controller: JOYKON LTD, trading as Keydra
Suite A, 82 James Carter Road, Mildenhall, England, IP28 7DE
Company Number 15298115
For privacy queries or to exercise your rights, contact us at [email protected]. For complaints, you may also contact the ICO (UK) or your local EU supervisory authority.