1. What we collect

Data	Why	Required?
Username	Identifies your account at login	Required
Email address	Account verification, support, security notices	Required
Password (hashed)	Authentication — stored as a one-way bcrypt hash, never in readable form	Required
Full name	Addressed correspondence, invoices	Optional
Address	Billing/invoicing where applicable	Optional
Activation code	Links a payment to your account	Required to activate access

Your drawings are stored only in your own browser (localStorage), not on our servers. We do not see or store what you draw.

2. What we do NOT collect

• We do not track your drawings or calculation contents.
• We do not use third-party advertising or tracking cookies.
• We do not sell, rent, or share your personal data with third parties for marketing.
• We do not perform behavioural profiling.

3. Local storage

The app stores a short-lived login token and your drawing in your browser's localStorage. This data never leaves your device except for the explicit API calls you make (drawing exports, calculations), which require your authenticated session.

4. Payment data

Payments are handled by our merchant-of-record provider. We never receive or store your full card number or banking details — those go directly to the payment processor under their own compliance (PCI-DSS). We retain only the record that a payment occurred and the activation code it generated.

5. Legal basis (GDPR)

Under the EU General Data Protection Regulation (Regulation 2016/679) and Greek Law 4624/2019, we process your data on the following bases:

• Contract (Art. 6(1)(b)) — to provide the service you signed up for.
• Legal obligation (Art. 6(1)(c)) — tax and invoicing records.
• Legitimate interest (Art. 6(1)(f)) — preventing fraud and abuse of the service.

6. Your rights

• Access — request a copy of the data we hold about you.
• Rectification — correct inaccurate data.
• Erasure — request deletion of your account and data.
• Portability — receive your data in a machine-readable format.
• Objection — object to certain processing.
• Complaint — lodge a complaint with the Hellenic Data Protection Authority (dpa.gr).

To exercise any right, email privacy@koincad.com. We respond within 30 days.

7. Data retention

We keep your account data for as long as your account is active. Inactive accounts and their associated data are deleted after 24 months of inactivity, unless retention is required by law (e.g. tax records, retained per Greek tax law).

8. Security

Passwords are bcrypt-hashed. All traffic is served over HTTPS. Access to the application is token-gated. The calculation, export, and scripting engines run server-side and are never exposed to the browser. No method of transmission or storage is fully secure, but we apply measures appropriate to the sensitivity of the data.

9. Changes to this policy

We may update this policy. Material changes will be notified by email or in-app. Continued use after a change constitutes acceptance.

10. Contact