Privacy Policy

Last updated: September 9, 2026

1. Who is responsible for your data

The data controller is KODE DIY SL (NIF B21903190), Carrer d'Albuixech 8, Piso 4 Puerta 13, 46019 Valencia, Spain — [email protected].

2. What we process, why, and on what legal basis

• Browsing this store. Our edge provider derives your country from your IP address to show prices in your currency; we keep only the two-letter country code in a cookie for 24 hours. Legal basis: legitimate interest in showing correct prices (Art. 6(1)(f) GDPR). We do not log your IP address in our application.
• Buying. When you click Buy you are taken to our checkout (checkout.kode.diy), operated by Shopify. Shopify collects the data needed to fulfil your order (name, address, email, payment details). Legal basis: performance of a contract (Art. 6(1)(b)) and legal obligations such as invoicing and tax (Art. 6(1)(c)).
• Contacting us. If you email [email protected] we process your address and message to answer you. Legal basis: our legitimate interest in responding (Art. 6(1)(f)) or pre-contractual steps (Art. 6(1)(b)).
• Analytics and marketing cookies (only with your consent). If you accept them in our banner, we use Google Analytics to measure site usage and the Meta Pixel to measure our advertising — each can be accepted or rejected separately. Legal basis: consent (Art. 6(1)(a)), which you can withdraw at any time. If the banner is not shown, neither is in use. See the Cookies Policy.

3. Kode accounts and community content

On apps.kode.diy, cloud.kode.diy and in the Kode app you sign in with GitHub, Google or Apple. Our authentication provider is Google Cloud Identity Platform (Google LLC; identity records are processed in the United States under the EU-US Data Privacy Framework). Your Kode data itself is stored on Google Cloud in Belgium (EU). We store the user id your sign-in provider gives us, your email, username, display name and avatar URL to identify you, and we show the username and avatar next to what you publish: apps, ratings and review comments. You can delete your account from the Kode app (Account → Delete account); the identity record is deleted and the profile is anonymised. Legal basis: performance of the service you asked for (Art. 6(1)(b) GDPR).

Review comments are public. Before your first one we ask you to confirm you are 16 or older and accept the content policy; we store the moment you did. Anyone can report a review; a report stores the reason, optional details and, for reports made without an account, the email you choose to give, so we can answer. When we remove a review we record the reason and who removed it.

Retention: your ratings and comments stay until you delete them (you can, from the app's page) or until your account is deleted, when everything you published goes with it. Reports and removal records are kept while they are needed for accountability. To delete your account, or to exercise any other right, write to [email protected].

Kode team members may review Concierge conversations to improve the service and fix problems. Legal basis: our legitimate interest in running the service well (Art. 6(1)(f) GDPR); access is limited to the team and every review is recorded.

4. Who receives your data

• Shopify International Ltd / Shopify Inc. — operates our checkout and order management as our processor under Shopify's Data Processing Addendum. Data may be transferred outside the EEA under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.
• Payment providers — through Shopify's checkout (e.g. card networks, Shop Pay).
• Carriers — name and address, to deliver your order.
• Meta Platforms Ireland Ltd — only if you consented to marketing cookies.
• Google Ireland Ltd — only if you consented to analytics cookies (Google Analytics).

5. How long we keep it

Order and invoicing data: as long as tax and commercial law require (generally 6 years in Spain). Support emails: up to 2 years after the last exchange. The country cookie: 24 hours. Your cookie-consent choice: 12 months.

6. Your rights

You may request access, rectification, erasure, restriction, portability, and object to processing, and you may withdraw your consent at any time, by writing to [email protected]. You also have the right to lodge a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (AEPD, www.aepd.es).

7. Automated decisions

We do not make automated decisions or profiling that produce legal effects on you.

8. US residents (state privacy laws)

If you visit from the United States, advertising cookies run on an opt-out basis under state privacy laws (including the California Consumer Privacy Act): use the "Do Not Sell or Share My Personal Information" link in the footer to disable them at any time. We do not knowingly sell or share the personal information of visitors under 16. For access or deletion requests, write to [email protected].

9. Changes

We will update this policy when our processing changes and revise the date above.

10. Batch reserve list

If you leave your email on our reserve pages, we use it to update you about your batch spot and to send you Kode news. Legal basis: your consent (Art. 6(1)(a) GDPR), given when you submit the form; withdraw it anytime via the unsubscribe link in any email. The email is stored in Shopify, our commerce platform, and — when connected — Klaviyo, our email platform.