Legal

Privacy Policy

Last updated: 13 August 2026

Klyk revolves around photos of real people. So we are careful with your data: we collect little, keep it briefly and never sell it. Below is exactly what we process and why.

1. Who is responsible

The data controller is [JURIDISCHE NAAM], [VESTIGINGSADRES], KVK [KVK-NUMMER]. Privacy questions: [CONTACT-E-MAILADRES].

2. What data we process

From buyers: email address, payment details and (business) company name, billing address, VAT and PO number. Payment details are processed by Stripe; we never see or store your card number.
From participants: your self-chosen name, an avatar, an anonymous device token and a 4-digit recovery PIN — enough to reconnect you to your own player, without an account.
During the game: the photos you upload, your star ratings and any photo reports.
Technical: a language-preference cookie and anonymous visit statistics (Vercel Analytics, without tracking cookies and without profiles).

3. Purposes and legal bases

Performance of the contract: processing your order, delivering codes, making the session work.
Legal obligation: we retain invoices and payment records under Dutch tax retention rules.
Legitimate interest: preventing abuse, reviewing reports of inappropriate photos and anonymous usage statistics.

4. Photos

Photos are only visible to the participants of your session. They are not made public, not used for advertising and not shared with third parties beyond the processors listed below.

Photos are automatically and permanently deleted 30 days after the session ends, together with the other session data.

Participants can report a photo during the game. Reported photos are reviewed by us and hidden or removed where necessary.

5. Processors

We use a small number of service providers that process data on our behalf, each under a data processing agreement:

Stripe — payments and invoices.
Supabase — database and photo storage.
Vercel — website hosting and anonymous statistics.
Resend — sending emails (codes, invoices, confirmations).

6. Retention periods

Photos and session data: 30 days after the session ends.
Orders and invoices: 7 years (Dutch tax retention obligation).
Buyer email addresses: as long as needed for delivery and administration.

7. Your rights

You have the right to access, rectification, erasure, restriction, objection and data portability. Email us at [CONTACT-E-MAILADRES]; we respond within one month. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

8. Cookies and local storage

We only use functional storage: a cookie for your language choice and local storage in your browser to reconnect you to your own player. We use no tracking or advertising cookies; that is why there is no cookie banner.

9. Security

All connections are encrypted (HTTPS). Photos and session data are shielded per session; payment details never touch our systems.

10. Changes

When we change this policy we update the date at the top. For significant changes we notify buyers by email.