Legal
Privacy Policy
Last updated: 25 July 2026
This policy explains what personal data AppRejectKit (apprejectkit.com) collects, why, and your rights. The data controller is Sachs Consulting Sàrl, 25 Rue du Nant, 1207 Geneva, Switzerland. Contact: support@apprejectkit.com.
What we collect
- Purchase data — when you buy the kit, your email address and order details. Card details are handled by Stripe; we never receive or store them.
- Licence data — the licence key issued for your purchase, tied to your checkout session, so we can grant and restore your access.
- Attribution data — which advertisement, campaign or link brought you here. This comes from the parameters in the address you arrived on (for example
utm_source,fbclid,gclid), plus the referring website, stored in our own cookie together with a random visitor identifier. It contains no name, email or account. - Usage data, only if you agree — pages viewed, clicks, scrolling and other interactions on our public pages, plus technical details such as browser, approximate location derived from your IP address, and advertising identifiers set by Meta. See “Advertising and analytics” below.
- Cookies — the full list is in the table below.
Advertising and analytics
We advertise this product, mostly on Meta (Facebook and Instagram), and we need to know whether those advertisements work. If, and only if, you accept in the cookie banner, two third-party tools run on this site:
- Meta Pixel and Conversions API — measures which advertisement led to a purchase, and lets us build audiences for future advertising. When you buy the kit, we send Meta the event together with identifiers that let it recognise you: your email address, name, city, region, postcode and country, all hashed (turned into an irreversible code) before they leave our servers, plus your IP address, browser user-agent and Meta’s own cookie identifiers, which are sent as-is because Meta requires them in that form. This is a form of profiling for advertising purposes.
- PostHog (European hosting) — shows us how our public pages are used: funnels, heat maps, and session recordings of the public marketing pages. Recording is deliberately switched off on every page behind the paywall and on the pages that display your licence key.
If you decline, neither tool is loaded, no data is sent to Meta or PostHog, and no purchase of yours is ever reported to Meta. We still record the attribution data described above, because it stays with us — see the legal bases below.
Why we use it (legal bases)
- To deliver the kit — process your order, issue your licence key, and unlock your access (performance of our contract with you).
- To email your licence key and essential purchase information (performance of the contract).
- To meet legal and accounting obligations — e.g. keeping invoicing records (legal obligation).
- Advertising and analytics — Meta Pixel, the Conversions API and PostHog run on your consent only, which you may withdraw at any time.
- Our own attribution measurement — knowing which campaign produced a sale, using only our own cookie and never sharing it, rests on our legitimate interest in running a viable business. You can object to it at support@apprejectkit.com.
Service providers and recipients
We share the minimum data needed with providers that operate the service on our behalf:
- Stripe — payment processing and tax calculation.
- Resend — sending your licence-key email.
- Vercel — website hosting and delivery.
- Upstash — secure storage of issued licence keys and of the short-lived advertising match record described below.
- PostHog — product analytics, on the EU cloud, only with your consent.
- Meta Platforms Ireland Ltd — advertising measurement, only with your consent. For the Pixel and the Conversions API, Meta is not merely acting on our behalf: we and Meta are joint controllers for the collection and transmission of that data, and Meta then uses it under its own responsibility and its own privacy policy.
Some of these providers process data outside your country, including in the United States; where required, transfers are covered by appropriate safeguards (such as EU Standard Contractual Clauses or the EU–US Data Privacy Framework).
Cookies
Only the first three below are set without asking you, because the site cannot do what you asked of it otherwise, or because they record your own choice. Everything else waits for your consent.
| Cookie | Purpose | Basis | Lifetime |
|---|---|---|---|
kit_access | Signed token proving your device bought the kit, so the paid pages stay unlocked. | Strictly necessary | 1 year |
kit_owner | A plain marker telling the page you already own the kit, so it stops showing you the buy button. Not a security check. | Strictly necessary | 1 year |
arc_consent | Remembers whether you accepted or declined, so we do not ask again. | Strictly necessary | 6–13 months |
arc_attr, arc_vid | The campaign you arrived from and a random visitor identifier. Ours alone; shared with Meta only if you accept. | Legitimate interest | 90 days |
arc_aff | Set only if you arrived through a partner's referral link, so we can pay them their commission if you buy. It holds a short partner code and nothing about you. Never shared with anyone. | Legitimate interest | 60 days |
_fbp, _fbc | Set by the Meta Pixel to recognise your browser and the advertisement you clicked. | Consent | Up to 90 days |
ph_* | Set by PostHog to recognise a returning visitor across pages. | Consent | 1 year |
Change your cookie choice. Declining also deletes the Meta and PostHog cookies we can reach. Your browser settings can remove all of them at any time.
Retention
We keep purchase and licence data for as long as your lifetime access is active and as long as legal/accounting rules require. You can ask us to delete data that we are not legally required to keep.
Attribution data lives in your browser for 90 days. When you start a checkout, the identifiers Meta needs to match your purchase — your IP address, browser user-agent and Meta cookie identifiers — are held on our side for 30 days and then deleted automatically. The campaign name stays attached to the payment record in Stripe, because it is part of our accounting picture of where a sale came from. Data held by Meta and PostHog is subject to their own retention rules.
Your rights
Subject to applicable law (the Swiss Federal Act on Data Protection, and the GDPR where it applies to buyers in the EU/EEA), you may request access to, correction of, or deletion of your personal data, object to or restrict certain processing, and request portability. To exercise any of these, email support@apprejectkit.com. You also have the right to lodge a complaint with your local data-protection authority.
Where we rely on your consent, you may withdraw it at any time, with no effect on what happened before — reopen the cookie banner.