Privacy Policy

Effective date: 12 November 2026

This privacy policy explains how Kirnu Interactive ("Kirnu", "we", "us") collects, uses, stores and protects personal data in connection with our website kirnuarp.com, the Kirnu customer portal, and our software products (ButterSynth, Kirnu Cream and future applications).

1. Data controller

Kirnu Interactive
Email: support@kirnuarp.com

2. What data we collect

• Account data: email address, first and last name, account role, registration key (regKey) and password hash (if you set a password).
• License data: the products you own, license channels (release, beta, demo), validity period, issued license identifiers and download counters.
• Purchase data: order notifications from payment providers (customer name and email address) used to create your account and deliver licenses.
• Technical data: IP address, used only for security (bot protection and limiting repeated login attempts). IP addresses are not used for marketing or profiling.
• Email messages: sign-in links, password reset links and registration emails are sent through Google (Gmail) on our behalf.

We do not collect analytics or marketing data, and we do not use tracking or advertising cookies.

3. Why we process your data (legal basis)

• Performance of contract: creating and managing your account, issuing and verifying software licenses, providing downloads and customer support.
• Legitimate interest: protecting the service against bots, brute-force attacks and abuse (GDPR Art. 6(1)(f)).
• Compliance: where required by applicable law.

4. Cookies and local storage

The website uses only strictly necessary cookies:

• kirnu_session and kirnu_2fa — keep you signed in and handle two-factor authentication.
• cf_clearance (Cloudflare Turnstile) — protects forms against bots.

Your theme choice is stored in your browser's local storage only and never leaves your device. Because all cookies are strictly necessary for the service, no consent banner is required.

5. Where data is stored

• Account, license and product data is stored in a database operated by Cloudflare, Inc. (Cloudflare D1, EU region) and product files in Cloudflare R2 object storage.
• Email delivery is handled by Google LLC (Gmail).
• License files for desktop applications are generated from your account data and stored on your own device.

We use these providers as data processors under appropriate safeguards. We do not sell, rent or share your personal data with third parties for their own purposes.

6. Data retention

• Account and license data is kept for as long as your account exists.
• Sign-in links expire after 15 minutes and are single-use.
• Password reset links expire after one hour and are single-use.
• Security logs of failed login attempts are kept for security purposes and do not contain passwords.

7. Your rights

Under the EU General Data Protection Regulation (GDPR) you have the right to request access to your personal data, its rectification, erasure ("right to be forgotten"), restriction of processing, and data portability. You may also object to processing based on legitimate interest and withdraw consent where consent is the basis of processing.

To exercise any of these rights, or to have your account and data deleted, contact us at support@kirnuarp.com. We will respond within one month.

If you believe our processing violates data protection law, you have the right to lodge a complaint with your local supervisory authority (in Finland: the Office of the Data Protection Ombudsman, tietosuoja.fi).

8. Children's privacy

Our services are not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will delete it.

9. Changes to this policy

We may update this policy from time to time. The latest version is always available on this page, with the effective date shown above.

10. Contact

Questions about this policy or your data: support@kirnuarp.com