Privacy policy

1. Data controller

The data controller is Konoda House, operated by Magna Products Oy, website https://konodahouse.com.

Privacy contact: privacy@konodahouse.com. Support contact: support@konodahouse.com.

This policy covers browsing the site, creating an account, buying digital cases (including as a guest), free previews, and related service emails.

2. Data we process

Account data: email address, password (stored hashed by our auth provider), display name, profile photo, preferred language, product and marketing email preferences, XP points and account progression.

Purchase data: checkout email, Stripe order and payment identifiers, product purchased, language, amount, currency and payment status. If you create an account with the same email, we may link guest purchases to your profile.

Download data: temporary tokens used to access purchased PDFs, including creation and expiry times.

Contact / preview data: emails submitted for a free preview or launch notifications.

Technical data: limited IP address, user agent and security logs to prevent abuse; cookies and local storage needed to run the service (session, cookie consent).

We do not collect full card payment details; those are handled directly by Stripe.

3. Purposes and legal bases

Contract performance (GDPR art. 6.1.b): creating and managing accounts, fulfilling orders, delivering downloads, sending transactional emails (confirmations, download links, password resets, order-related notices).

Legitimate interest (GDPR art. 6.1.f): service security, fraud and abuse prevention, technical improvement, essential reliability measures.

Consent (GDPR art. 6.1.a): newsletters, marketing sequences and non-essential cookies, if used. You may withdraw consent anytime via account preferences, the cookie banner, or by contacting us.

Legal obligations (GDPR art. 6.1.c): retaining fiscal and accounting data related to purchases.

4. Whether providing data is required

Data needed for purchase and account is required to provide the service. Without a valid email we cannot deliver downloads.

Marketing consent and optional cookies are voluntary; refusing them does not block browsing or buying.

5. Processors and transfers

We also process data through providers acting on our behalf: site hosting, Supabase (database and authentication), Stripe (payments), Resend (email delivery), Google (optional OAuth sign-in).

Some providers may process data outside the European Economic Area. Where required, we rely on appropriate safeguards under applicable law (such as standard contractual clauses) and limit data to what is necessary.

6. Google user data (Sign-In)

If you sign in with Google, Konoda House requests only the basic authentication scopes needed (typically email and Google name/profile).

We use this data solely to create or recognise your Konoda House account, display your name in the account area, and link purchases/downloads to your library. We do not use Google user data for advertising, ad profiling, sale to data brokers, or any undisclosed purpose.

Data received from Google is stored in our authentication/account system (Supabase) and handled like other account data described in this policy. We do not share Google user data with third parties except processors needed to provide sign-in and the service, or when required by law.

You can revoke the app’s access in your Google Account settings. You can also delete or update your Konoda House account by contacting privacy@konodahouse.com.

7. Retention

Account data: while the account is active and for a reasonable period after a deletion request, unless law requires longer retention.

Orders and download entitlements: as long as needed to provide access to purchased products and meet accounting/tax duties (typically up to 10 years where required).

Download tokens: until link expiry (about 14 days) or earlier invalidation for security.

Technical logs: limited periods, extendable only if needed to investigate abuse or incidents.

Marketing lists: until consent is withdrawn or data is deleted.

8. Your rights

Under the GDPR you may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest, within legal limits.

You may also withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise your rights, email privacy@konodahouse.com. We will respond within the legal timelines.

You may lodge a complaint with your EU/EEA supervisory authority.

9. Security and automated decisions

We apply appropriate technical and organisational measures (HTTPS, access controls, expiring download tokens) to protect data.

We do not use profiling for automated decision-making that produces legal or similarly significant effects on you.

10. Children

The service is not intended for children under 16 without a responsible adult. Products may list a recommended play age (e.g. 14+), which is separate from the age to create an account.

11. Updates

We may update this policy to reflect service or legal changes. The date at the top shows the latest revision.

For material changes we may notify you by email or with a notice on the site.