Privacy Policy — KitSTL

1. What data we collect

• Sign-up: name, email and password (stored only as a cryptographic hash — not even we can read it). We also record the language you signed up in, the channel through which you found us, who referred you (if anyone) and when the account was created.
• Use of the service: download history, likes, searches made on the site, comments posted and access records (login).
• Payments: payment is made by card (or Apple Pay / Google Pay) through Stripe Checkout. Your card details are entered on Stripe's own page and never pass through our servers. We record the amount, currency, date and status of the transaction, plus Stripe's reference IDs.
• Phone number, government ID and postal address: we do not ask for them. There is no column for any of them in any of our tables.
• Contact form: the questions you send through the contact form are answered by artificial intelligence (through Anthropic's API) and are stored.
• Access records: IP address, browser, approximate country (provided by Cloudflare), device type, operating system, in-app browser (such as Instagram or TikTok), date and time of access, including catalog pages opened without an account. They serve security purposes and help us tell human visits apart from automated bots. Because we operate from Brazil, Brazilian law (article 15 of the Marco Civil da Internet, Law No. 12,965/2014) requires us to keep these records for 6 months; after that, we delete them.
• Our cookies: there are five, and none of them is for advertising:
  • b3d_sessao — keeps you logged in. 30 days. Essential.
  • b3d_v — a random number, with no name or email, only so that we do not count the same person twice in our visit statistics. 365 days. Along with it we measure, per page, how long it stayed open, how far it was scrolled, the screen width and what kind of item was clicked (a model, the button to get access) — never passwords or what you type in forms (search terms are logged separately, as described below). It is not used for advertising and is not combined with any other database.
  • b3d_origem — records through which channel you found the site (Instagram, TikTok, search), so we know where to promote it. 90 days.
  • b3d_ind — stores who referred you to the site, so we can record the referral when you create your account. 30 days.
  • b3d_idioma — remembers the site language you chose. 30 days.
  We also store a mark in your browser (b3d_popup_visto) only so as not to repeat the welcome message. It is not sent to our servers.
• Meta Pixel (Facebook/Instagram): not used on kitstl.com. On this site, no Meta tracking code is loaded in your browser and we send nothing to Meta about your visits, sign-up or purchase.

2. What we use it for

• Providing the service you signed up for — creating your account, managing your access and the fair-use limit, and enabling downloads.
• Meeting legal and tax obligations relating to payments.
• Security and the prevention of fraud and abuse, such as the download limit and access records.
• Keeping access records for 6 months, as required by the Brazilian law mentioned above.
• Knowing through which channel you reached the site, to decide where to promote it. This is our own audience measurement, not advertising profiling: the data stays with us and is not combined with any third-party database.
• Sending the email confirmation link when you create your account; if your account uses a free catalog download, a single email with the link to open that model on your computer (along with an invitation to get lifetime access); and password reset emails when you ask for them. There is no marketing list and no recurring mailing.
• Answering the questions you send through the contact form, with the help of AI as described above.

We do not sell your data, and we do not share it with anyone for advertising purposes.

3. Who we share it with

With Stripe, to process and confirm the card payment. We pass on only your email, to identify the purchase. The payment details themselves — your card number and billing data — are entered on Stripe's page and stay between you, your bank and Stripe; they do not pass through us.

Beyond that, only with infrastructure providers strictly necessary to run the site: Cloudflare (network and content delivery, which handles every request to the site, including your IP address), Resend (sending our emails, which receives your email address and the message) and Anthropic (which receives the text of questions sent through the contact form in order to answer them). Each of them processes data under its own policies. We do not sell your data.

Our servers are located in Brazil, so your data is processed and stored in Brazil. If you use the site from another country, your data is transferred to Brazil, where it is protected under Brazil's General Data Protection Law (LGPD) and the measures described in this policy.

4. Your rights

At any time, you can: confirm whether we process your data, access it, correct it, ask for a copy in a portable format, object to its processing and ask for its deletion. Within the site: your data and history are in My account, where you will also find the Delete my account button, which immediately deletes your account, downloads, comments and sessions, and removes your email and name from the internal history of events and support. What remains, and only this: payment records, for the period required by tax law, and access records, for the 6 months required by the Brazilian law mentioned above. For any request: [email protected].

You also have the right to complain to Brazil's data protection authority (ANPD) or to the data protection authority in your country.

5. Security and retention

Passwords are stored with a strong hash (scrypt), the site works only over HTTPS and sessions use httpOnly cookies.

How long we keep each thing:

• Access records (IP address, browser, approximate country, date and time): 6 months, as required by the Brazilian Marco Civil da Internet. After that, we delete them.
• Login sessions, terms searched on the site and usage records (pages viewed, time on page, clicks and actions such as downloading or liking): 12 months. After that, we delete them.
• Your account (name, email, downloads and comments): for as long as the account exists. If you delete the account, this is erased immediately.
• Payments: for the period required by tax law.

6. Controller and contact

The data controller is the operator of kitstl.com, which is the same operator as baixa3d.com: Marcio Chaves, an individual based in Brazil. To exercise your rights or ask questions about this policy, contact [email protected]. This policy may be updated; the date at the top shows the version in force.

The site is not directed to children under 13, and we do not knowingly collect personal data from them. If you believe a child under 13 has given us personal data, contact us and we will delete it.