Privacy policy

This policy explains what personal data Kinkmarket collects, why, who we share it with, how long we keep it, and your rights.

1. Who we are

Kinkmarket is run by KCTECHNOLOGY Ltd (company number 17302910), 66 Paul Street, London EC2A 4NA. We are the controller of your personal data under UK data protection law. For anything about your data, email [email protected].

This policy covers kinkmarket.me. It does not cover sellers’ own websites, which have their own policies.

2. If you just browse

• An age confirmation cookie, so we do not ask you on every page.
• Server and security logs, including your IP address, browser type and the pages you request. These pass through Cloudflare, which protects and delivers the site.
• A record of which Kinkmarket page you first arrived through, used to credit referrals under our Refer and Earn terms, and anonymous counts of which listings are viewed and clicked.

We do not use advertising or third-party tracking cookies, and we do not sell data.

3. If you have a buyer account

• Account details: email address, username, display name, and your password stored only as a secure hash. If you use Continue with Google, see section 12.
• Age check: the result of your Didit check, the method, Didit’s reference for the check, when it passed and when it expires (12 months later). Didit carries out the check itself. See section 5.
• Kredits: your balance and a record of every top-up and every spend. Card payments are taken on Fynex’s (Fondy’s) secure page and bank payments by GoCardless. We never see or store your card number.
• Orders: what you ordered, from which seller, the price, how you paid, and the order status. To send your order, the seller receives your name, delivery address, email address and, if you give it, your phone number.
• Messages, feedback and profile: messages you send and receive, feedback you leave, anything you add to your buyer profile such as a picture or interests, and people you block or report.
• Notifications: if you switch on browser notifications, the push address your browser gives us.
• Newsletter: if you sign up, your email address, used only for the newsletter. You can unsubscribe from any email.

4. If you sell on Kinkmarket

• Account and shop: your email, username, display name, country, shop name, tagline, bio, photos, listings, prices and postage settings, and how you found us.
• Your chosen payment methods: if you add details such as a PayPal address or bank details for buyers to pay you directly, those details are shown to buyers at checkout. That is their purpose.
• Identity check: the result of your Didit check (status, decision, Didit’s reference and dates). If you are an AI persona, this is the check of the real person or company operating it.
• Records of what you agreed to: which tick boxes you confirmed at sign-up and when, and for agreements you sign, the version, time and IP address.
• Your answers at sign-up about social media promotion and our Telegram group, and your Telegram handle if you give it.
• Earnings and cash-out: your Kredit earnings and ledger. When you cash out we hold the account holder’s name, bank name, country and the last 4 digits of the account so we can manage the payment. The full account number, sort code or IBAN is encrypted (AES-256) with a key kept outside the website, and is only decrypted by an operator making that payment.
• Billing: your plan, payment dates and history. If you pay by Direct Debit, GoCardless holds your bank details and we hold the mandate reference and status.
• Directory applications: your contact details, website, the categories you choose and the listing picture you upload.

5. Age and identity checks

We use Didit to confirm that buyers are 18 or over before they can see or buy adult content, and that sellers are real, identifiable adults before they can sell or cash out. Didit asks for a photo of a government-issued ID and a short selfie, and may check that the face matches the ID. This involves biometric data, which is a special category of data under UK law.

The ID document and selfie go straight to Didit. We do not keep copies of ID documents or selfies on our own systems. We receive and keep the result of the check and Didit’s reference for it, so that we can show a payment provider, a regulator or law enforcement that a check was done when they are entitled to ask. Didit processes the check data on our instructions.

6. How we use your data, and our legal reasons

• To run your account, take and deliver your orders, run Kredits and cash-outs, and provide messaging. Legal reason: to perform our contract with you.
• To check age and identity. Legal reason: to meet our legal obligations, including under the Online Safety Act 2023, and our legitimate interest in keeping minors and fraud off the site.
• To keep the site safe: security logs, bot checks on forms, fraud checks, and automated screening of images posted to the community feed before they appear. A flagged post is held for a person to review; it is never removed or approved by a machine alone. Legal reason: legitimate interests, and legal obligation where the law requires us to act on illegal content.
• To keep financial records. Legal reason: legal obligation.
• To send service emails, such as order updates, message alerts and account security. Legal reason: to perform our contract with you.
• To send the newsletter or promote your shop on social media, only if you said yes. Legal reason: consent, which you can withdraw at any time.

7. Who we share data with

We do not sell your data. We share it only with the people and companies below, and only what they need.

• The seller you order from: your name, delivery address, email and any phone number, and your messages with them.
• Buyers: a seller’s shop, listings and chosen payment details.
• Service providers who work on our instructions:
  • Hostinger: hosting and database.
  • Cloudflare: delivers and protects the site, and runs the Turnstile check on sign-up forms.
  • Didit: age and identity checks.
  • Fynex (Fondy): card payments.
  • GoCardless: Direct Debit and bank payments.
  • Resend: sends our emails.
  • Google: only if you choose Continue with Google.
  • Anthropic: automated screening of images posted to the community feed.
  • OpenRouter and RunPod: run the AI chat and voice features, if you use them.
  • Bunny.net: hosts our Hub tour video, only if you play it.
  • Your browser’s push service (for example Google, Apple or Mozilla), only if you switch on notifications.
• Payment and banking partners, regulators, and law enforcement, where the law requires it or where we must show that age and identity checks were done.
• A buyer of our business, if Kinkmarket is ever sold, under the same protections.

8. Data sent outside the UK

Some of the providers above are based outside the UK, for example in the USA. When personal data is sent outside the UK, UK data protection law requires it to keep the same level of protection, for example through UK adequacy regulations or the UK International Data Transfer Agreement or Addendum. You can ask us for details by emailing [email protected].

9. How long we keep it

• Accounts: while your account is open. When you close it, it is removed from the site straight away and permanently deleted, with your profile picture, 30 days later.
• Age and identity check results, and records of what you agreed to: while your account is open and for 7 years after it closes, so we can show payment providers and authorities that the checks were done. A buyer’s age check lasts 12 months, after which a new check is needed.
• Money records (Kredit purchases, orders, cash-outs, including the encrypted bank details given for them, and billing): 6 years.
• We may keep something longer if we need it for a dispute, an abuse report, a legal claim or because the law requires it.

10. Cookies and similar technology

We only use cookies the site needs to work:

• km_age_ok: remembers that you confirmed you are 18 or over. Lasts 30 days.
• A session cookie for buyers and one for sellers (km_sess): keep you signed in. Removed when you sign out or the session ends.
• Cloudflare security and Turnstile cookies: protect the site from bots and attacks.
• Your browser’s local storage: remembers small display choices on your device, such as a dismissed notice.

We do not use advertising cookies, analytics cookies or third-party tracking.

11. Your rights

You have the right to ask for a copy of your data, to have it corrected or deleted, to restrict or object to how we use it, to take it elsewhere where that applies, and to withdraw consent at any time where we rely on consent. To use any of these, email [email protected]. We will reply within one month.

If you are not happy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk. We would like the chance to put things right first.

12. Signing in with Google

You can choose to sign in to Kinkmarket with your Google account instead of a password. If you never use the Continue with Google button, none of this section applies to you.

What Google user data we access

We ask Google for three basic permissions: openid, email and profile. From those we receive your Google account ID, your email address and whether Google has confirmed it, your name, and a link to your profile picture. We do not store the profile picture, and we cannot see your Gmail, contacts, calendar, Drive, photos or anything else in your Google account.

How we use it

We use this only to create your account, recognise you when you come back, and sign you in. We keep the Google account ID so we still recognise you if you change your email. We do not use Google user data for advertising, analytics, profiling or to train any AI model.

Who we share it with

Nobody. We do not sell, rent or pass Google user data to anyone. It is held in our database, run on our hosting provider’s servers, and protected as described in this policy.

How to remove it

You can disconnect Google at any time in your account settings or by emailing [email protected]. That removes the stored Google account ID and leaves your account working. If you close your account, the Google connection is deleted with it.

13. Children

Kinkmarket is only for people aged 18 or over. If we find that someone under 18 has an account, we close it and delete their data except what we must keep to protect them or to report to the authorities.

14. Changes to this policy

We may update this policy. The date at the top shows when it last changed. If a change significantly affects you, we will tell you by email or on the site.

15. Contact

[email protected]. KCTECHNOLOGY Ltd, 66 Paul Street, London EC2A 4NA.