Privacy Policy
Who we are
Your Kith and Kin Inc. ("Kith and Kin", "we", "us") runs yourkithandkin.com, a platform for collecting memories, advice and stories from friends and family into a hardcover book. We are the controller of the personal data described in this policy.
Your Kith and Kin Inc.
c/o Northwest Registered Agent Service, Inc.
8 The Green, Ste B
Dover, DE 19901, USA
Email: help@yourkithandkin.com
This policy explains what personal data we collect, why, who we share it with, where it is stored and your rights. It applies to everyone who uses our site, including project creators, contributors and visitors.
What personal data we collect
We collect different data depending on how you use Kith and Kin.
If you create a project or buy a book:
- Name, email address and account login details. If you sign in with Google or Facebook, we receive your name, email address and profile picture from them.
- Shipping address and phone number.
- Order history. Payments are processed by Stripe; we never see or store your full card number.
- The names and email addresses of people you invite to contribute.
- Messages you send us by email or through our live chat.
If you contribute to someone's book:
- Your name and email address, provided by the project creator or by you.
- Your responses: the memories, stories, advice and photos you submit.
If you visit our website:
- Device and usage data such as IP address, browser type, pages viewed and how you interact with pages. Some of this is collected through cookies and similar technologies (see "Cookies and tracking").
If you sign up for our discount offer:
- Your email address. We use it to send your discount code and occasional tips and offers, and we record whether you open or click our emails.
How we use your data and our lawful basis
Under GDPR we must have a lawful basis for each use of your data. Ours are set out below.
| What we do | Lawful basis |
|---|---|
| Create and manage your account, build your book, take payment, print and deliver your order | Contract: needed to provide what you asked for |
| Send emails about your account, orders and projects, such as contributor invitations and response notifications | Contract, or legitimate interests for emails to contributors |
| Invite contributors on a project creator's behalf and send them reminders | Legitimate interests: helping creators gather contributions they have requested |
| Check that email addresses are valid before we send to them | Legitimate interests: making sure invitations and order emails arrive |
| Include contributors' responses in the book | Legitimate interests, and the contributor's choice to submit. Contributors can ask us to remove a response before printing |
| Answer your questions and support requests | Contract or legitimate interests |
| Send your discount code, tips and offers, only to people who signed up for our discount offer | Consent, given when you sign up. You can unsubscribe at any time |
| Analyze site use (Google Analytics, Hotjar) and measure advertising (Meta Pixel, TikTok Pixel, Brevo website tracking) | Consent, given through our cookie banner, if you are in the EU, EEA, UK or Switzerland. Elsewhere, legitimate interests; you can opt out (see "Cookies and tracking") |
| Show our fonts and Trustpilot reviews on the site | Legitimate interests: displaying the site as designed |
| Keep the site secure and prevent fraud | Legitimate interests |
| Keep tax and accounting records | Legal obligation |
Where we rely on legitimate interests, we have weighed our interests against your rights. You can object at any time (see "Your rights"). Where we rely on consent, you can withdraw it at any time without affecting earlier processing.
We do not sell your personal data, and we do not make decisions about you based solely on automated processing.
Who we share your data with
We share personal data only with service providers who help us run Kith and Kin. Each acts on our instructions under a written contract. If you are in the EU, EEA, UK or Switzerland, our analytics and advertising providers receive your data only after you consent.
| Provider | What they do | Data they receive | Location |
|---|---|---|---|
| DigitalOcean | Hosts our website, database and project content | All account, order and project data | USA (New York) |
| Stripe | Processes payments | Name, email, billing details, card details | USA |
| Our printing partner | Prints, binds and ships books | Book content, including contributor responses and photos, and the recipient's name and shipping address. Not contributors' contact details | USA |
| Shipping carriers | Deliver orders on our printer's behalf | Recipient's name and shipping address, passed on by our printer | Depends on delivery destination |
| Google Workspace | Business email | Emails you send us and our replies | USA |
| Intercom | Live support chat | Name, email, support conversations, device data | USA |
| Brevo | Sends account, order and contributor emails, and emails to people who signed up for our discount offer; website tracking | Name, email, project and contributor status, email engagement, device and usage data | EU (France) |
| Kickbox | Checks that email addresses are valid | Email addresses of account holders and invited contributors | USA |
| Google (Analytics, Tag Manager) | Website analytics | Device and usage data | USA |
| Google Fonts | Serves the fonts used on our site | IP address and browser information | USA |
| Meta (Pixel) | Advertising measurement | Device and usage data, page events | USA |
| TikTok (Pixel) | Advertising measurement | Device and usage data, page events | USA and other countries |
| Hotjar | Website usability analysis | Device and usage data, page interactions | EU (Malta) |
| Trustpilot | Shows our reviews on the site | IP address and browser information | EU (Denmark) |
| Google and Facebook sign-in | Account login, if you choose it | Name, email, profile picture | USA |
We may also disclose data where required by law, to protect our rights, or as part of a sale or merger of our business.
Where your data is stored and international transfers
Your data is stored mainly in the United States. Our website and database are hosted by DigitalOcean in New York, and our printer operates several locations in the United States.
If you are in the EU, EEA or UK, this means your data is transferred outside those areas. We protect these transfers in one of two ways:
- EU–US Data Privacy Framework: where the provider is certified under it, including its UK Extension where relevant. The European Commission has found that this framework provides adequate protection.
- Standard Contractual Clauses: contracts approved by the European Commission (and the UK equivalent) that commit the recipient to EU-level protection.
You can ask us for a copy of the safeguards that apply to any provider by emailing help@yourkithandkin.com.
Cookies and tracking
We use essential cookies and similar browser storage to keep you signed in, remember your cookie choice and keep the site secure. These don't need your consent.
We also use these analytics and advertising tools:
- Google Analytics, loaded through Google Tag Manager: to understand how visitors use the site.
- Hotjar, loaded through Google Tag Manager: to see how people navigate and interact with pages, so we can improve them. Hotjar is set to mask text you type into forms.
- Meta Pixel: to measure how well our Facebook and Instagram ads work, and to show relevant ads.
- TikTok Pixel: to measure how well our TikTok ads work, and to show relevant ads.
- Brevo website tracking: to understand which pages are visited by people who receive our emails.
If you are in the EU, EEA, UK or Switzerland, these load only after you accept them in our cookie banner. You can change your choice at any time using the "Cookie settings" link in our site footer.
Everywhere else, these load when you visit the site. You can opt out by blocking or deleting cookies in your browser settings, installing Google's Analytics opt-out browser add-on, or changing your ad preferences in your Facebook, Instagram and TikTok accounts.
Do Not Track: some browsers send a "Do Not Track" signal. There is no agreed standard for responding to it, so our site does not currently respond to these signals.
How long we keep your data
We keep most personal data until you ask us to delete it, because many customers come back to order more copies of their book. You can ask us to delete your account, a project or a contribution at any time by emailing help@yourkithandkin.com (see "Your rights").
| Data | How long |
|---|---|
| Account details | Until you ask us to delete your account |
| Project content and contributor responses | Until the project creator asks us to delete the project, so copies can be reordered at any time. Contributors can ask us to delete their own responses |
| Contributor contact details | Kept with the project, until the project creator or the contributor asks us to delete them |
| Order and payment records | At least 7 years, to meet tax and accounting rules, even if you delete your account |
| Support emails and chat conversations | Until you ask us to delete them |
| Discount offer email data | We stop emailing you as soon as you unsubscribe, and keep your address on a suppression list so we don't email you again |
| Analytics data | 2 months (Google Analytics setting) |
How we protect your data
We use technical and organizational measures to keep your data safe.
- All data sent between your browser and our site is encrypted using HTTPS (TLS).
- Card payments are handled entirely by Stripe, which is certified to PCI DSS Level 1. We never store card numbers.
- Access to our systems is limited to staff who need it, and requires strong passwords and two-factor authentication.
- Our database and backups are kept on access-restricted servers in secure data centers.
- We choose service providers with strong security practices and bind them by data processing agreements.
- Contributors' contact details are not shared with our printer.
If a data breach is likely to put your rights at risk, we will notify the relevant supervisory authority within 72 hours and tell you without undue delay.
Your rights
If you are in the EU, EEA or UK, you have the right to:
- Access the personal data we hold about you and get a copy.
- Correct data that is wrong or incomplete.
- Delete your data, where we no longer need it or you withdraw consent.
- Restrict how we use your data in certain cases.
- Object to processing based on legitimate interests, and to direct marketing at any time.
- Port data you gave us, in a machine-readable format.
- Withdraw consent at any time, where we rely on it.
We offer these rights to all our users, wherever they live. To use any of them, email help@yourkithandkin.com. We will respond within one month, and may ask you to confirm your identity first.
California and other US states: depending on where you live, you may have the right to know what personal information we collect and how we use and share it; to access, correct and delete it; and to opt out of "sharing" for targeted advertising. We do not sell personal information. Our use of the Meta and TikTok pixels may count as "sharing" under California law. To opt out, use the options in "Cookies and tracking" or email help@yourkithandkin.com. You can also ask an authorized agent to make a request for you. We will not treat you differently for using these rights.
Complaints: if you are unhappy with how we handle your data, please contact us first. You also have the right to complain to your local data protection authority. In Ireland this is the Data Protection Commission; in the UK it is the Information Commissioner's Office. A list of EU authorities is on the European Data Protection Board website.
Children
Kith and Kin is not directed at children, and project creators must be adults. We do not knowingly collect personal data from children under 13, or from children under 16 in the EU, EEA and UK, without a parent's or guardian's permission. If a child contributes to a family book, the parent or guardian should submit or approve the response. If you think we hold a child's data without permission, contact us and we will delete it.
Changes to this policy
We may update this policy from time to time. We will post the new version here with a new effective date, and tell you by email about significant changes.
Effective date: June 2021