Who We Are

RegKit is a software product operated in England and Wales. This privacy policy applies to all users of RegKit worldwide. For the purposes of applicable data protection law, the data controller is RegKit (hello@regkit.dev).

What We Collect

We collect only what is necessary to operate RegKit. This falls into two categories:

Information you provide directly

• Email address — provided at purchase and used to manage your account, deliver repository access, and send transactional and product communications
• Payment information — collected by Stripe on our behalf. We receive only a transaction confirmation and a Stripe customer ID. We never store or have access to your full card number, CVV, or bank details.

Information collected automatically

• Usage data — pages visited, time on site, referral source, browser and device type, collected via Umami Cloud. No cookies are set and no personal data is collected.
• Cookies — this site sets no analytics or tracking cookies. See Section 5 for full details.
• Log data — standard server logs including IP address and request timestamps, retained briefly for security and diagnostic purposes

How We Use Your Data

We use the data we collect for the following purposes, and only these purposes:

• Fulfilling your purchase — processing payment, activating your license, and granting repository access (legal basis: performance of a contract)
• Account management — managing your license tier, project usage for Agency accounts, and renewal tracking (legal basis: performance of a contract)
• Transactional communications — receipts, license confirmations, renewal reminders, and security notices (legal basis: performance of a contract / legitimate interests)
• Product updates — occasional emails about significant new features, stack additions, or important changes to RegKit (legal basis: legitimate interests — see Section 6 for opt-out)
• Site analytics — understanding how the site is used so we can improve it (legal basis: legitimate interests — no consent required as no cookies or personal data are collected)
• Legal compliance — retaining records as required by applicable law, including financial records (legal basis: legal obligation)

We do not use your data for advertising, profiling, or any automated decision-making that produces legal or similarly significant effects.

Third Parties

We share data with a small number of third-party services that are necessary to operate RegKit. We do not sell your data to any third party, and we do not share it for advertising purposes.

Each of these services acts as a data processor on our behalf and is contractually bound to process your data only for the purposes we specify, in accordance with applicable data protection law.

Analytics & Cookies

We use Umami Cloud to understand how visitors use this site — which pages are visited, how long people spend on them, and where traffic comes from. Umami is a privacy-first analytics platform that is designed to operate without cookies and without collecting personal data.

Umami Cloud processes analytics data on servers located in the EU (Netherlands and Germany) and potentially the United States (San Francisco). See Section 9 for details on international transfers and the safeguards in place.

Strictly necessary cookies — the only cookies this site may set are those required by Stripe to process payments, and any session cookie required to manage your account. These are essential to providing the services you have requested.

You can verify the cookies set by this site at any time using your browser's developer tools. Most browsers also allow you to block or delete cookies entirely without affecting your ability to browse the site.

Emails

We send two types of email:

• Transactional emails — purchase receipts, license confirmations, renewal reminders, and security notices. These are essential to your account and cannot be opted out of while you hold an active license.
• Product update emails — occasional announcements about significant new features, new stack support, or important changes to RegKit. These are infrequent and directly relevant to the software you have purchased.

You can unsubscribe from product update emails at any time by contacting us at hello@regkit.dev. Unsubscribing from product updates does not affect transactional emails.

We do not send promotional emails, third-party advertisements, or any email unrelated to RegKit.

Data Retention

We retain your personal data only for as long as necessary for the purposes set out in this policy, or as required by law.

• Account and license data — retained for the duration of your license, and for up to 7 years after your account closes to comply with applicable financial record-keeping requirements
• Payment records — retained for 7 years in accordance with applicable tax and financial record-keeping obligations
• Analytics data — aggregated and anonymised usage data retained by Umami Cloud in accordance with their data retention policy. As no personal data is collected, no individual-level deletion is possible or necessary.
• Server logs — retained for up to 90 days for security and diagnostic purposes, then deleted
• Email correspondence — retained for as long as reasonably necessary to resolve any queries or disputes

If you request deletion of your account, we will delete or anonymise your personal data promptly, except where we are required to retain it by law (such as financial records).

Your Rights

Depending on where you are located, you may have the following rights in relation to your personal data. UK and EEA residents have these rights under UK GDPR / EU GDPR respectively; residents of other jurisdictions may have similar rights under their local laws. We apply these rights to all users regardless of location:

• Access — you can request a copy of the personal data we hold about you
• Correction — you can ask us to correct inaccurate or incomplete data
• Deletion — you can ask us to delete your data, subject to any legal obligations to retain it
• Restriction — you can ask us to restrict processing of your data in certain circumstances
• Portability — you can ask us to provide your data in a structured, machine-readable format
• Objection — you can object to processing based on legitimate interests, including product update emails
• Withdraw consent — where processing is based on consent (such as cookies), you can withdraw it at any time

To exercise any of these rights, contact us at hello@regkit.dev. We will respond within one month of receiving your request. There is no charge for making a request.

If you are in the UK and not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. If you are in the EEA, you may contact your local supervisory authority. Residents of other jurisdictions may have the right to complain to their relevant national data protection authority.

International Transfers

Some of the third-party services we use — including Stripe and Umami Cloud — may process your data outside your country of residence. Where this occurs, we ensure that appropriate safeguards are in place, including Standard Contractual Clauses (SCCs), the UK International Data Transfer Agreement (IDTA), or adequacy decisions recognised under applicable law.

Stripe maintain standard contractual clauses and are certified under appropriate data transfer frameworks. Full details are available in their respective privacy policies linked in Section 4.

Umami Cloud — analytics data may be processed on servers located in the Netherlands, Germany, and/or San Francisco, USA, depending on infrastructure routing. As Umami collects no personal data — only aggregated, anonymised usage statistics — this does not constitute a transfer of personal data for the purposes of GDPR or equivalent legislation. No information that identifies you is transmitted to or stored by Umami.

Changes to This Policy

We may update this policy from time to time. Where changes are material — for example, if we begin collecting new categories of data or sharing data with new third parties — we will notify you by email at least 14 days before the changes take effect.

The current version of this policy, along with its effective date, is always available at regkit.dev/privacy.

Contact

For any questions about this policy, to exercise your data rights, or to make a complaint:

• Email: hello@regkit.dev
• Website: regkit.dev

We aim to respond to all privacy-related enquiries within 5 business days, and will always respond within the statutory one-month period for data subject requests.