Privacy Policy

This Privacy Policy explains what personal data htmlkin.io processes, why, who else is involved and what you can ask us to do. It applies to the website, the Dashboard, the REST API, the MCP server, the browser extension and the sites published through the Service.

It works together with the Terms of Service.

1. Who we are

The controller of your personal data is the operator of the Service: Individual entrepreneur Sergei Eliseev (details in section 14). You can reach us at info@htmlkin.io on any question about this Policy or about your data.

2. What data we process

• Account data — your email address; if you sign in with Google, the name and email address that Google returns to us.
• Data about your sites — addresses, sizes, formats, publication and expiry dates, settings such as a custom domain, PIN protection and search engine visibility.
• Content you upload — the HTML or files of a static site that you publish, together with anything they contain.
• Lead form submissions — if you use lead forms, what visitors of your site send through them. Here you decide what is collected; we store it for you and you can export or delete it in the Dashboard.
• Technical data — IP address, browser and device information, request time and result in server logs; the country determined from the IP address when you sign in to the Dashboard.
• Payment data — the fact, amount, currency and status of a payment, the plan and the billing period. Card numbers, expiry dates and security codes are handled by Stripe and never reach us.
• Support correspondence — what you write to us and our replies.

3. Why we process it, and on what basis

• To provide the Service — to create and identify your account, publish and deliver your sites, run the API and the MCP server, and keep your plan limits. Basis: performance of our contract with you.
• To take payments and manage subscriptions — to charge for a plan, renew it and issue refunds. Basis: performance of the contract.
• To contact you — sign-in links, notices about archiving, blocking, payments and the subscription, and answers to your requests. Basis: performance of the contract.
• To keep the Service safe — to detect abuse, prevent attacks and brute force, apply rate limits and investigate incidents. Basis: our legitimate interest in a working and safe service.
• To fix errors — to collect diagnostics about failures in the Service. Basis: our legitimate interest in a service that works.
• To measure our advertising — to find out which of our ads on Reddit bring visitors, sign-ups and payments. Basis: our legitimate interest in knowing which advertising works.
• To comply with the law — to keep accounting records and to answer lawful requests. Basis: a legal obligation.

4. Who else processes your data

4.1. We do not sell personal data and do not share it for purposes unrelated to the Service. We use the following processors, each only to the extent its job requires:

• DigitalOcean — servers and object storage that run the Service and hold published sites.
• Stripe — payments for paid plans, including card data, which stays with Stripe.
• Resend — delivery of sign-in links and service emails.
• Cloudflare — the captcha that protects publication and forms from automated abuse.
• Google — sign-in through a Google account, if you choose it, and Google Analytics, which counts visits to the website.
• Reddit — the Reddit Pixel, which measures our ads on Reddit. When you are signed in to the Dashboard, it receives your email address and account ID; Reddit hashes them and uses them only to match visits and conversions to its users.
• Sentry — collecting technical error reports from the Service.

4.2. We may disclose data to public authorities only where the law requires it and in the manner it prescribes.

5. Where the data is stored

5.1. The servers and the storage of the Service are located in the European Union (Frankfurt, Germany). Error reports are processed in the European Union as well.

5.2. Some of our processors — for example Stripe, Resend, Cloudflare, Google and Reddit — may process data outside the European Economic Area. Where that happens, the transfer relies on the safeguards these providers offer, including the European Commission’s standard contractual clauses.

5.3. Access keys, passwords and other secrets of the Service are kept in the secret storage of our deployment environment; they are never placed in version control or baked into images.

6. How long we keep it

6.1. Account data is kept while the account exists. After you delete the account, or after a written request from you, we erase the data within 30 days, unless the law requires us to keep it longer — for example accounting records of payments.

6.2. Anonymous sites and the technical data about them are deleted automatically 24 hours after publication.

6.3. On the free plan a site is archived after 30 days without visits and can be restored for another 30 days, after which it is deleted.

6.4. Server logs are kept for a short period needed to investigate incidents, and then deleted.

7. Cookies

7.1. The Service uses technical, analytics and advertising cookies. Technical cookies keep you signed in, protect the session and carry the security checks of the captcha. Analytics cookies are set by Google Analytics to count visits to the website. Advertising cookies are set by the Reddit Pixel to measure our ads on Reddit. Published sites carry no analytics or advertising tags of ours at all.

7.2. The choice to dismiss the cookie notice is stored by your browser, not by us.

7.3. You can block cookies in your browser. Some features of the Service, including signing in, will then stop working.

8. Published sites are public

8.1. A published site is available to anyone who knows its address and, by default, is open to search engine indexing. It may also appear in the public Examples section with a thumbnail of the home page, its address and the date of publication.

8.2. You control this with the “Available to search engines” setting in the Dashboard: when it is off, the site is closed to indexing and is not shown in the Examples section. Sites protected with a PIN are never indexed and never appear there.

8.3. Please do not publish information that you are not ready to make public. PIN protection is a light restriction, not a way to protect confidential data.

9. Security

9.1. We take technical and organisational measures to protect personal data against unauthorised access, loss, alteration and disclosure: encrypted connections, restricted access to production systems, isolated secrets and rate limits on sensitive operations.

9.2. You keep your account credentials and API keys safe and do not pass them to anyone. Tell us at support@htmlkin.io if you think someone else has got access to your account.

10. Your rights

10.1. In relation to your personal data you may:

• ask what data we process and get a copy of it;
• ask us to correct data that is wrong or incomplete;
• ask us to erase your data, including by deleting your account;
• ask us to restrict processing, or object to processing based on our legitimate interest;
• receive the data you gave us in a structured, machine-readable format;
• withdraw consent where processing is based on it, without affecting what was done before;
• complain to a data protection authority in your country.

10.2. Write to info@htmlkin.io to exercise any of these rights. We answer within 30 days and may ask for details that let us identify your account.

11. Children

The Service is not directed at children under 16. If you believe a child has given us personal data, write to info@htmlkin.io and we will delete it.

12. Changes to this Policy

We may update this Policy. The current version is always published at https://htmlkin.io/en/privacy-policy with the date of the last change. If a change materially affects how we process your data, we tell account holders by email.

13. Browser extension

13.1. We distribute the htmlkin browser extension for Chrome, Microsoft Edge, Opera and Yandex Browser. It publishes HTML code from AI chats to the Service. Installing it is optional, and this Policy applies to it in full.

13.2. The extension works on chatgpt.com, chat.openai.com, alice.yandex.ru and giga.chat: it reads the contents of the HTML code block on the open page to place a publish button next to it. This reading happens locally in your browser.

13.3. The content is sent to the site selected in the extension (htmlkin.io or htmlkin.ru) only when you act — click “Publish” or “Update” in the chat or the button in the extension window. The extension does not read or send your conversation, other parts of the page or your credentials for the chat service.

13.4. The extension has no sign-up of its own: it uses the same cookies as the selected site, for htmlkin.io — the cookies described in section 7. Sites published through the extension are handled like any other, including the automatic deletion of anonymous sites 24 hours after publication (section 6.2).

13.5. In browser storage (chrome.storage) the extension keeps only service data: the selected site and a 5-minute cache of your account state on it — whether you are signed in and the list of your sites to pick from when updating. This data does not leave your device and is removed together with the extension.

13.6. The extension contains no analytics and does not share data with third parties. It exchanges data only with the selected site — the htmlkin.io or htmlkin.ru domain.

13.7. The extension picks the site by your browser languages, and you can change it in the extension window. If htmlkin.ru is selected, the data sent to it is processed under the htmlkin.ru privacy policy, not this Policy.

14. Controller details

Individual entrepreneur Sergei Eliseev
Taxpayer number (NIF) 326412115
Address: Praça da Rainha Dona Amélia, 72, 4000-075 Porto, Portugal
Email: info@htmlkin.io

Last updated 22 October 2026.