This notice is for people who visit kairomi-pro.mokita.studio, who buy or try Kairomi Pro for WordPress, and for the sites where the plugin is installed. It explains what data this page and the service that manages licences and payments (the “Licence service”) collect, why and for how long.
It does not cover the customers of the shops that use Kairomi. A shop's bookings and its customers' names, phone numbers and pets stay in the database of that shop's WordPress site and never reach the Licence service. The shop is the controller of those data.
1. Controller
Valerio Rullo · Mokita Studio, sole proprietorship (ditta individuale)
VAT number IT03321070801
Via Polistena I traversa privata 10, 89132 Reggio Calabria (RC), Italy
Email info@mokita.studio · PEC (certified email) valerio.rullo@pec.it
No data protection officer has been appointed: the law does not require one for a business of this size.
2. What data we process
When you use the purchase form on this page
You choose the licence and enter your email and the address of your WordPress site. When you press “Start the trial”, the page sends the Licence service the email, the site address, the licence and the payment interval you chose. The Licence service creates a licence key for this purchase and passes the email, the chosen licence, the key and the site address to Stripe to open the payment page. Before you press the button the page sends nothing.
When you start a trial or buy a licence
- the email address you enter in the form or, if you start the trial from the plugin's Subscription page, the email of the WordPress user you are logged in as;
- the address of the WordPress site you declare;
- the licence you choose (1 site or 3 sites) and the payment interval (yearly or monthly);
- the licence key generated for you (format
PLCT-XXXX-XXXX-XXXX-XXXX); - the IDs Stripe gives you and your subscription, the subscription status (trial, active, payment pending, cancelled) and the end date of the paid period.
You enter your card details on the payment page: the Licence service never sees or stores them.
When the plugin is installed on a site
The plugin talks to the Licence service in five cases: when you activate the key; once a day, to check the licence status; when WordPress looks for updates; when the site gives up the key (with “Libera questo sito”, by uninstalling the plugin or by entering another key); when, from the Abbonamento page, you start a purchase, ask to recover your key or ask to manage your subscription. These requests carry:
- the licence key;
- the site address;
- the installed plugin version (update checks only);
- the email, only when you start a purchase or ask to recover your key;
- as with any request made by WordPress, the IP address of the server hosting the site and a technical header with the WordPress version and the site address.
The Licence service stores the list of sites activated with the key and the date of the last check. For each site it keeps the address without http or https and without www.: the domain, the port if there is one and, if WordPress lives in a folder, the path (for example yoursalon.com/book). It does not keep a log of individual requests.
When you write to us
The address you write from, the message and any attachments.
Data the Licence service does not receive
Bookings, customers, pets, settings and content of your site. The plugin sends no usage statistics.
3. Why we process them and on what legal basis
| Purpose | Legal basis |
|---|---|
| Opening the payment page when you use the form, starting the trial and the subscription, generating and sending your key, letting you download the plugin | Performance of the contract or pre-contractual steps you ask for (Art. 6(1)(b) GDPR) |
| Checking every day that the licence is valid, enforcing the licence's number of sites, delivering updates | Performance of the contract (Art. 6(1)(b)) |
| Sending you your key and the subscription management link again when you ask | Performance of the contract (Art. 6(1)(b)) |
| Answering support requests | Performance of the contract or pre-contractual steps you ask for (Art. 6(1)(b)) |
| Bookkeeping | Legal obligation (Art. 6(1)(c)) |
| Limiting repeated attempts, preventing key abuse and defending the controller's rights in a dispute | Legitimate interest in keeping the service secure (Art. 6(1)(f)) |
We do not use your data for advertising, we do not profile you and we do not sell your data. The emails the Licence service sends are service emails only: key and download after payment, key recovery, subscription management link.
Sale through Link. The seller you buy from is Sold through Link, LLC (“Link”), a Stripe company. Link collects payment and billing details, calculates taxes, issues receipts and invoices and processes these data as an independent controller under its own privacy policy (link.com/privacy). The controller receives from Stripe only what is needed to manage the licence: email, country, licence and subscription status.
4. Who receives the data
| Who | What it does | Where |
|---|---|---|
| Cloudflare, Inc. | Hosts this page (Cloudflare Pages), runs the Licence service and stores licence data and plugin files. To protect the service it also processes the IP addresses of requests | Global network; company in the United States |
| Stripe and Link (Sold through Link, LLC, a Stripe company) | Stripe runs the payment page, the subscriptions and the subscription management page; Link is the seller and collects the payments. They are independent controllers for the sale and, for some activities (fraud prevention, legal obligations), for the rest too | For European customers the contracting Stripe company is based in Ireland |
| Resend, Inc. | Sends service emails (key, recovery, subscription management link) from noreply@auth.mokita.studio | United States; sending from infrastructure in the European Union |
| Google (Gmail) and Cloudflare Email Routing | Receive and store the messages sent to info@mokita.studio | Global network; companies in the United States |
| The controller's accountant | Keeps the books | Italy |
These providers process data on the controller's behalf under a data processing agreement, except where they are independent controllers as stated. The controller does not disclose data to anyone else, except to authorities when the law requires it.
5. Transfers outside the European Economic Area
Cloudflare, Stripe, Link, Resend and Google may process data in the United States or in other countries outside the European Economic Area. These transfers rely on the European Commission's adequacy decision for companies certified under the EU-U.S. Data Privacy Framework, or on the Standard Contractual Clauses adopted by the Commission. You can ask for a copy of the safeguards at info@mokita.studio.
6. How long we keep them
- Unfinished purchases. If you use the form but do not complete the payment, the licence created for that attempt stays inactive and the Licence service deletes it automatically after 30 days, unless a site has used it during that time.
- Licences and sites. For as long as the subscription runs and for 24 months after it ends, so you can reactivate it without losing your key and any dispute can be handled. Then they are deleted.
- Counters against repeated attempts. To limit repeated purchases, key recoveries and subscription management requests, the Licence service counts requests per IP address, email and key. It does not store these values in clear, only an encrypted fingerprint that expires on its own in little more than an hour.
- Subscription management links. They are valid for 15 minutes and work once; the Licence service stores only an encrypted fingerprint, deleted when it expires.
- Accounting records. 10 years, as the law requires.
- Support emails. As long as needed to solve the request and follow our relationship, then at most for the life of the licence plus the period stated above for licences.
7. Security
- This page and the Licence service answer only over HTTPS.
- A recovery request never returns the key in the response: the key goes only to the registered email.
- The keys the plugin sends to the Licence service travel in the body of requests, not in addresses; so do the email and site address of the purchase form. The exceptions are the confirmation page after payment and its button to download the plugin, which carry the key in their address: the page is not kept in the browser cache and does not pass its address to other sites, and the button downloads the file directly. Plugin versions before 0.9 also send the key in the address of the daily licence check and of the update check.
- Subscription management links and update downloads are signed and expire; subscription management links work once.
- Stripe notifications are accepted only with a valid signature.
- The admin tools require a secret code.
- Only the controller has access to the stored data.
8. Cookies and browser storage
This page uses no cookies and no analytics, and loads nothing from other servers. If you pick the light or dark theme, the choice is stored only in your browser, in local storage under the key kairomi-tema; it never reaches us and you can clear it from your browser settings.
The Licence service pages (installation, key recovery, subscription management) use no cookies and no analytics. When you move on to payment, Stripe's page uses its own cookies, needed for the payment and for fraud prevention, as the privacy policies of Stripe and Link explain.
9. Your rights
You can ask to access your data, correct it, erase it, restrict its processing, receive it in a machine-readable format (Arts. 15-20 GDPR) and object to processing based on legitimate interest (Art. 21). Write to info@mokita.studio or, for formal requests, to the PEC address valerio.rullo@pec.it. We answer within one month.
Erasing the licence while the subscription runs makes it impossible to give you updates and support. Data the law requires us to keep (accounting) stay until the required period ends.
If you believe the processing breaks the GDPR, you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority of the country where you live or work.
10. Changes
When this page, the Licence service or our providers change, we update this notice and the date at the top. If a change is material, subscribers are told by email before it applies.