KikiWebs Privacy Policy

🛡️ Privacy & Data Protection Principles

KikiWebs strictly adheres to the principle of data minimization: we only collect the data required to authenticate you, secure your account, and deliver purchased gaming assets. We never sell or monetize your personal data.

1. What Data We Collect

We collect only the specific categories of data necessary to provide a functional and secure digital platform:

• Email Addresses & Usernames: Provided upon account registration to identify your account and dispatch 2FA security codes.
• Passwords: Never stored in plaintext. Passwords are cryptographic one-way hashed using 12-round bcrypt salt algorithms with constant-time verification.
• HTTP Cookies: Essential session tokens (session_token), security CSRF cookies, and interface theme preferences. Cookies are delivered with HttpOnly; Secure; SameSite=Strict attributes to prevent cross-site scripting (XSS) leaks.
• IP Addresses & Network Diagnostics: Collected in ephemeral server access logs to enforce Layer 7 rate-limiting, detect automated brute-force attacks, and protect against distributed denial-of-service (DDoS) intrusions.
• Account Activity & Libraries: Your digital store purchase records, order receipts, game wishlists, and community discussion posts.

2. Why We Collect It

Every piece of data collected has a direct, explicit operational purpose:

• Account Access & Authentication: To verify your credentials and deliver mandatory 2-Factor Authentication (2FA) verification codes.
• Digital Product Provisioning: To associate purchased games, 3D assets, and creator workshop models with your account license ledger.
• Abuse & Bot Prevention: To prevent automated account harvesting, brute-force credential stuffing, and bot flooding via Cloudflare Turnstile human verification.
• Customer Support: To resolve order inquiries, license redemptions, and refund requests within our 14-day policy.

3. How Long We Keep It (Data Retention)

We enforce strict retention horizons based on functional necessity:

• Active Account Data: Retained for the active lifespan of your account so you maintain perpetual access to your purchased digital licenses.
• Session Tokens: Transient browser session tokens expire automatically after inactivity.
• Security & Rate-Limiting Logs: Ephemeral server threat logs and IP quarantine records are retained for a maximum of 90 days for forensic audit defense, after which they are permanently overwritten.
• Deleted Account Data: When an account deletion is requested, all personal identifiable records are expunged from primary production storage immediately.

4. Whether We Share or Sell Data

KikiWebs has a strict zero-sale policy:

• We NEVER sell, rent, license, or trade your personal information, email, or browsing habits to third-party data brokers, marketing agencies, or ad networks.
• We do not display behavioral tracking ads or install intrusive third-party commercial telemetry trackers.
• Financial checkout data is handled directly by certified Level 1 PCI-DSS processors (Stripe & PayPal). Your credit card number, CVV, and banking details are encrypted client-side and never touch our servers.

5. How Users Can Delete Their Account

You have an absolute right to account deletion and permanent erasure (GDPR Article 17 / CCPA):

• Self-Service Erasure: Navigate to General Settings → Danger Zone and click Delete Account to immediately purge your credentials, profile, and sessions.
• Email Request: Send an email from your registered address to support@kikiweb.online with the subject line "Account Deletion Request". Our support team will process and verify your complete account wipe within 24–48 hours.

6. Cookie Notice

KikiWebs uses strictly necessary first-party cookies to provide essential platform functionality:

• session_token: An encrypted, HttpOnly, Secure authentication token ensuring you stay logged in to your gamer profile without transmitting credentials.
• kikiwebs_theme: Remembers your preferred display mode (Dark/Light).
• kikiwebs_cookie_consent: Stores your cookie preference acknowledgement.

You can configure your browser to reject or delete cookies at any time; however, blocking essential authentication cookies will prevent you from signing in to your account.

7. Security & Trust Team Contact

For privacy questions, GDPR/CCPA data export requests, or security disclosures, reach our Trust & Safety Officer directly: