Privacy Policy

1. Who we are

This Privacy Policy explains how YakiemBattle Security Labs ("we", "us") collects, uses and protects personal data when you use the YakiemBattle service (the "Service"): the website, the customer dashboard, the license system, the endpoint agents and the license API.

Questions about this policy: hello@yakiembattle.com. Security matters: security@yakiembattle.com.

2. What we collect

We collect only what is needed to operate the Service. Specifically:

• Account data: name, email address, optional company name, and a cryptographic hash of your password (Argon2id or bcrypt).
• Order and billing data: order number, plan, seat count, amount and currency, payment method identifier and transaction reference provided by the payment provider. We never see or store full card numbers.
• License data: license keys, a hardware fingerprint (SHA-256 hash of device identifiers) per activated seat, platform, hostname, and the IP address used at activation.
• Telemetry: scan, block, rollback and license-status events associated with your account, so your dashboard can show them.
• Support and contact data: name, email, subject and message content you submit through the contact form, plus correspondence history.
• Technical data: IP address, user agent and timestamps for security purposes such as rate limiting and abuse detection.

3. How we use your data

We use the data above to:

• operate the Service: account management, license activation and validation, seat binding and dashboard telemetry
• process payments, invoices and refunds through our payment providers
• protect the Service: rate limiting, lockout after failed logins, detection of key sharing and abuse
• provide support and answer contact messages
• comply with legal obligations, including accounting retention of invoices
• communicate service announcements and material changes to these policies

4. Legal bases

Where the GDPR or similar legislation applies, we process personal data on the following bases: performance of the contract with you (account, licensing, billing), our legitimate interests in securing the Service and preventing abuse, your consent where requested (for example optional marketing), and legal obligation (for example invoicing and retention requirements).

5. Cookies and local storage

The Service uses a strictly necessary session cookie (HttpOnly, SameSite=Lax) to keep you signed in and to protect against cross-site request forgery. No advertising, analytics or third-party tracking cookies are set.

The website stores two preferences in your browser\u2019s local storage, which never leave your device: the chosen colour theme and the sidebar collapsed state. These are not cookies and are not sent to our servers.

See the Cookie Policy for details.

6. How we share data

We do not sell, rent or trade personal data. We share data only with:

Payment providers (to process transactions), limited to what the transaction requires.

Infrastructure providers that host the Service, under data-processing agreements.

Authorities, where required by law or to prevent fraud, and then only to the extent required.

7. Data retention

We keep data only as long as needed:

• Account data: while your account is active, and for a short period after deletion to honour legal obligations.
• Telemetry: deleted 30 days after your license is revoked or the key is consumed.
• Contact messages and support correspondence: two years after the last exchange.
• Invoices and accounting records: as required by applicable accounting law.
• Rate-limit and abuse records: kept for a limited period for security purposes, then purged.
• Audit logs of administrative actions: retained for security and accountability, typically 24 months.

8. Security measures

We apply the following safeguards: passwords hashed with Argon2id (bcrypt fallback), encrypted sessions with absolute lifetime, CSRF protection on every state-changing request, rate limiting on authentication and API endpoints, TOTP multi-factor authentication for administrative access, seat-bound license keys to prevent misuse, and encrypted transport (HTTPS) everywhere. Files uploaded for distribution are stored outside the web root and served only through authenticated, rate-limited endpoints.

9. Your rights

Depending on your jurisdiction, you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to lodge a complaint with a supervisory authority. To exercise any of these rights, email hello@yakiembattle.com from the address on your account. We respond within 30 days.

Deleting your account removes your account data and telemetry in line with section 7; invoices are retained for accounting law reasons.

10. Children

The Service is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us data, contact us and we will delete it.

11. International transfers

The Service may process data in multiple regions through our infrastructure providers. Where data is transferred across borders, we rely on appropriate safeguards such as standard contractual clauses and processor agreements.

12. Changes to this policy

We may update this policy as the Service evolves. Material changes are announced by email or a notice on the Service, with the effective date stated. The current version is always available at /privacy.

13. Contact and complaints

Privacy questions: hello@yakiembattle.com. You may also write to us via the contact form; a human replies within one business day.