Privacy Policy
1. Introduction
This Privacy Policy describes how kdpnichefinder ("we", "us", "our") collects, uses, and protects your personal information when you visit kdpnichefinder.net(the "Site") or use our niche analysis tools (the "Service").
For the purposes of GDPR and equivalent data protection laws, kdpnichefinder is the data controller for personal data described in this Policy. We determine the purposes and means of processing your personal data.
By using the Service, you agree to the practices described in this Policy.
2. Information We Collect
2.1 Information you provide directly
- Account information: email address, password (stored hashed via bcrypt) — only required if you create an account
- Niche analysis inputs: publication type, target price, monthly sales goal, topic interests (entered into the tool)
- Communications: when you email customer support
2.2 Information collected automatically
- Log data: IP address (truncated), browser type, device type, referring page, pages visited, timestamps
- Cookies: see our Cookie Policy for the full list and consent management
- Usage events: tool runs, button clicks, page scrolls (via analytics, if enabled)
2.3 Information handled by third-party services on our behalf
We use the following third-party services to operate the Service. Each service is a data processor acting under contract with us:
| Service | Role | Data shared | Retention |
|---|---|---|---|
| Cloudflare, Inc. (Pages / Workers) | Hosting, edge compute, security | Request logs (IP, UA, path) | Cloudflare default (up to 30 days) |
| Google LLC (Google Sign-In / OAuth) | Authentication provider for paid tier | Email, name, profile ID, OAuth token (used only to verify paying-user status; we do not store, profile, or analyze this data) | Per Google's policies; Google is independent controller for its own data |
| Creem (Armitage Labs OÜ, Estonia — Merchant of Record) | Payment processing and tax collection | Buyer name, email, billing address, payment details, transaction metadata. We never see your full card number. | Per Creem Privacy Notice |
| Resend or SendGrid (TBD) | Transactional email | Email address | Until unsubscribed |
3. How We Use Your Information
We use your information to:
- Provide, maintain, and improve the Service
- Authenticate paying users (via Google Sign-In)
- Process payments via our Merchant of Record (Creem)
- Generate AI-powered niche recommendations (only when you actively use the AI feature)
- Send transactional emails (receipts, account notifications)
- Detect fraud, abuse, and violations of our Terms of Service
- Comply with legal obligations (tax, accounting, law enforcement requests)
Legal bases under GDPR
- Contract performance (Art. 6(1)(b)): providing the Service you signed up for, processing payments
- Legitimate interests (Art. 6(1)(f)): fraud prevention, security, service improvement
- Consent (Art. 6(1)(a)): analytics cookies, marketing emails
- Legal obligation (Art. 6(1)(c)): tax, accounting, law enforcement requests
4. Third-Party Services — Detailed Disclosures
4.1 Cloudflare (Hosting / Edge Compute)
- Purpose: Serve the Site, run API requests, protect against abuse
- Privacy policy: cloudflare.com/privacypolicy
4.2 Creem (Merchant of Record — Payments and Tax)
- Identity: Armitage Labs OÜ (registry code 16977866), Rotermanni 14, Tallinn 10111, Estonia
- Role: Creem is the merchant of record. Creem is the legal seller of your purchase and independently handles billing data, VAT/sales tax, and invoicing
- Buyer data Creem collects: name, email, billing address, payment details, order details, device ID, IP address
- We receive from Creem: transaction IDs, product IDs, subscription status, payout amounts. We do not receive your full card number.
- Creem Privacy Notice: creem.io/privacy
- Creem support: support@creem.io
4.3 Google Sign-In (Authentication)
- Purpose: Verify your identity so we can confirm you are a paying user. We use Google OAuth only as a login credential — we do not store, analyze, or use Google user data for any other purpose.
- Data we receive: your email address, display name, and a unique Google account ID, used solely to create or sign you into your kdpnichefinder account
- Data we do NOT use Google for: advertising, marketing, user profiling, training of any model, syncing with other Google services, or sharing with any third party
- Compliance: Our use of Google user data complies with the Google API Services User Data Policy, including the Limited Use Requirements
- Google OAuth Scopes Used:
openid email profile(the minimum necessary to identify you as a paying user)
6. International Data Transfers
We are operated from outside the European Union. Your data may be transferred to and processed in:
- United States (Cloudflare infrastructure, Google LLC, our hosting)
- Estonia / European Union (Creem — Armitage Labs OÜ, for payment data)
- European Union (where Cloudflare edge nodes process requests)
For European users, we rely on Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework (where applicable) for transfers to the United States.
7. Data Retention
| Data | Retention |
|---|---|
| Account information | Until you delete your account + 30 days |
| Google OAuth profile data | Not retained beyond active session — we verify your identity and do not profile |
| AI analysis history | Until you delete your account or the record |
| Payment / billing data | Held by Creem per Creem Privacy Notice |
| Server logs (Cloudflare) | Per Cloudflare default (typically up to 30 days) |
| Analytics data | GA4: 2 months; Plausible: no persistent storage |
8. Your Rights
8.1 All users
- Access: request a copy of your personal data
- Correction: update inaccurate data via account settings
- Deletion: delete your account and data
- Export: download your AI analysis history as JSON
8.2 European users (GDPR)
- Right to restrict processing (Art. 18)
- Right to object to processing (Art. 21)
- Right to lodge a complaint with your supervisory authority
8.3 California users (CCPA / CPRA)
- Right to know what personal information is collected
- Right to delete personal information
- Right to opt out of "sale or sharing" (<strong>we do not sell your data</strong>)
- Right to limit use of sensitive personal information (not applicable — we do not collect sensitive PI)
To exercise any of these rights, email privacy@kdpnichefinder.net. We respond within 30 days (45 days for CCPA).
9. Children's Privacy
The Service is not intended for users under 16 (or older age where your jurisdiction requires). We do not knowingly collect data from children. If you believe we have collected data from a minor, contact privacy@kdpnichefinder.net for immediate deletion.
10. Security
We implement industry-standard security measures:
- TLS 1.3 for all data in transit
- bcrypt password hashing (for any account credentials we hold)
- Cloudflare edge security (DDoS, bot detection)
- Principle of least privilege for staff access
- Reliance on Creem's PCI-DSS Level 1 payment infrastructure for billing data
However, no system is 100% secure. Use a strong, unique password and protect your Google account.
11. Changes to This Policy
We may update this Privacy Policy. We will notify you of material changes by email and/or prominent banner on the Site. Continued use after changes constitutes acceptance.
12. Contact
- Privacy / General Contact: privacy@kdpnichefinder.net
- Transactions / Refunds: transaction@kdpnichefinder.net
- Payment Processor (Merchant of Record): Creem — Armitage Labs OÜ, registry code 16977866, Rotermanni 14, Tallinn 10111, Estonia — support@creem.io
For European users: we have not appointed a GDPR Art. 27 EU representative as kdpnichefinder is not systematically targeting EU users. If you are an EU user and require EU-representative contact, write to privacy@kdpnichefinder.net and we will respond via the same channel.
Disclaimer
KDP Niche Finder is an independent tool. We are not affiliated with Amazon.com, Inc., Kindle Direct Publishing (KDP), or any third-party tools referenced on the Service. All trademarks belong to their respective owners.
Our AI analysis is provided for informational purposes only and does not constitute financial, legal, or business advice.
BSR (Best Sellers Rank) and sales estimate data are sourced from publicly available Amazon pages via third-party scraping proxies. Data may be delayed by 24–72 hours and is not guaranteed to be accurate.
Source References
- Creem Privacy Notice V2.0— creem.io/privacy
- Creem Merchant Terms of Service V2.0— creem.io/terms
- Creem Buyer Terms of Service V2.0— creem.io/buyer-terms
- Google API Services User Data Policy— developers.google.com/terms/api-services-user-data-policy
- Cloudflare Privacy Policy— cloudflare.com/privacypolicy
- GDPR (EU 2016/679)— gdpr-info.eu
This policy complies with GDPR, CCPA/CPRA, and Google API Services User Data Policy including Limited Use Requirements. Final wording should be reviewed by a licensed attorney before production deployment.