Privacy Policy
How CompKit Game Engine handles data, and exactly what is — and isn’t — sent to external services.
1. Who We Are
This website and the CompKit Game Engine plugin are operated by AlfieLucas Ltd (“we”, “us”, “our”), trading as CompKit / KrisCreates. We are the data controller for the personal data described in this policy.
- Company registration number: 16916815 (registered in England and Wales)
- Registered office: Alexandra Road, Cas-Gwent, United Kingdom, NP16 5QU
- Contact: hello@kriscreates.co.uk
Full company details are also listed in our Terms of Use.
2. Scope of This Policy
This policy covers this informational website and the behaviour of the CompKit Game Engine plugin in relation to external services. It does not replace the privacy policy of your own WordPress/WooCommerce store, which remains your responsibility as the site operator.
3. This Website
This is a static informational website. It does not run a shopping cart or process payments, and there is no licence purchase form here. There are two forms: the short form shown when you download the plugin, and the affiliate application form covered in section 4 below. We do not load third-party fonts. We do load one third-party advertising script — the Meta (Facebook) Pixel — but only after you accept the cookie banner; see below. Any contact you initiate (for example, emailing support) is handled in line with the contact details you use.
Downloading the plugin
To download the free plugin we ask for your email address. CompKit is not listed on the WordPress.org plugin directory, so your WordPress dashboard will not notify you when a new version is released — that email is how we tell you, including when a release contains a security fix.
What we collect: your email address, whether you ticked the optional marketing box, the page you downloaded from, and the plugin version you took. Nothing else. We do not ask for your name, your site address or any payment details.
Why, and on what lawful basis:
- Release and security notices — our legitimate interest in making sure people running our software know when it has been updated or a vulnerability has been fixed. These relate directly to software you have chosen to install. If you would rather not receive them, every one of these emails carries an unsubscribe link.
- Tips and product news — only if you tick the optional box, which is unticked by default. That is your consent, and you can withdraw it at any time using the unsubscribe link in any such email, or by emailing us. Withdrawing it does not affect the release notices, and does not affect anything you have already downloaded.
Where it goes: to our own server at licencing.kriscreates.co.uk. It is not passed to a third-party mailing list provider, it is never sold, and it is not used to build an advertising profile.
Retention: we keep your address while you are on the list. If you unsubscribe, we remove you and keep only a suppression record — the address alone — so we do not accidentally email you again. If a list has had no activity from you for three years, we delete the record entirely.
On your device: once you have given us an address, your browser stores a date only in local storage so you are not asked again for six months. That value contains no personal data — not even your email address — and clearing your browser storage removes it.
You can ask us to delete your address at any time by emailing hello@kriscreates.co.uk. See section 12 for your full rights.
Website analytics (privacy-friendly & cookieless)
We collect basic, aggregated usage statistics for this website to understand what is useful and improve it. This uses a first-party measurement request to our own CompKit licence server at licencing.kriscreates.co.uk. It uses no cookies and no third-party analytics service.
These are the only events we record, and this is everything each one contains:
| Event | When it fires | What is sent |
|---|---|---|
| Page view | A page loads | The page path, the domain (not the full address) of the site you arrived from, and any utm_source, utm_medium and utm_campaign values in the link you followed |
| Download | You click a plugin download link | The page path, the file name, which part of the page the button was in (for example “header” or “pricing-card”), and the plugin version |
| Demo click | You click through to the demo store | The page path, which part of the page the link was in, and which game the link opens |
| Theme download | You download a free theme file | The page path and the file name |
| Pricing viewed | A price scrolls into view (once per page) | The page path |
| Billing toggle | You switch between monthly and yearly pricing | The page path and which option you selected |
| Video played | A gameplay clip starts playing | The page path and the file name |
| Outbound click | You click a link to another website | The page path and the destination address |
| Referral | You arrive via an affiliate ?ref= link | The affiliate's code and the page path |
No personal data is included in any of these events. There is no name, email address, account, device identifier or cross-site tracking, and nothing that identifies you as an individual or follows you between visits.
We do not store your IP address against these analytics events. To estimate unique daily visitors only, a short-lived, non-reversible identifier is derived by hashing your IP address together with your browser type and the current date; this hash cannot be reversed to identify you and effectively resets every day.
Lawful basis: our legitimate interest in understanding how this website is used and improving it. Because the events contain no personal data, are not used to build a profile, and set no cookies or similar identifiers on your device, this measurement does not require your consent. The Meta Pixel described below is different, and does require it.
Retention: we keep these aggregated event records for up to 26 months, after which they are deleted or retained only as anonymous totals.
If you arrive via an affiliate referral link (a ?ref= link), we store that affiliate's code in your browser's local storage (not a cookie) for up to 60 days so any resulting purchase can be credited to them, and we record the referral click. This sets no cookies and contains no personal data about you.
Advertising (Meta / Facebook Pixel)
We use the Meta (Facebook) Pixel to measure the performance of our advertising and understand which visitors go on to install the plugin. Unlike the cookie-free analytics above, the Meta Pixel is a third-party service operated by Meta Platforms, Inc., and it sets cookies and may share data with Meta in line with Meta's own privacy policy.
The Meta Pixel only loads if you click “Accept” on the cookie banner shown on your first visit. If you click “Reject”, or don't interact with the banner, the Pixel never loads and no Meta cookie is set. You can change or withdraw your choice at any time using the Cookie settings link, which is also in the footer of every page — it clears your stored choice and shows the banner again. Withdrawing consent stops the Pixel loading on subsequent page views; you can also clear Meta's cookies via your browser settings.
Alongside the Pixel running in your browser, the same events are also sent to Meta from our server, using Meta's Conversions API. This exists because browser scripts are frequently blocked, which makes advertising measurement unreliable — it measures the same things, not additional things. It is governed by exactly the same consent: if you click “Reject”, or never answer the banner, nothing about your visit to this website is sent by either route. The server-side copy carries your IP address, your browser's user-agent string, and Meta's own _fbp/_fbc cookie values where those exist. Reporting of a completed purchase works differently and does not happen on this website at all; it is described separately below.
If — and only if — you download the plugin after accepting the banner, the email address you enter on the download form is also included in that server-side event as a SHA-256 hash, so Meta can tell whether the visit came from one of our ads. Meta calls this “Advanced Matching”. The address is hashed in your browser before it is sent anywhere, so Meta receives only the hash and never the address itself. If you reject the banner no hash is generated or sent, and you can still download the plugin exactly as normal. This is separate from, and additional to, our own use of your address for release notices described in section 2.
Reporting a purchase to Meta
If you take out a paid CompKit subscription, we report that a purchase happened to Meta, so we can tell which of our adverts actually lead to sales rather than only to visits. This is the one piece of Meta reporting that does not come from this website, and it is worth explaining plainly.
Subscriptions are not bought here. You buy from inside your own WordPress admin, the payment is taken by Stripe, and no page of this website is loaded at any point — so the cookie banner, the Pixel and the consent choice described above are never involved. Instead our licence server sends a single event to Meta once payment clears.
That event contains only:
- your email address as a SHA-256 hash — never the address itself
- the amount paid and the currency
- which game modules the subscription covers
It deliberately does not include your name, your IP address, your browser, your site's domain, your licence keys, or any card or payment details, which we never hold in the first place. Nothing about your customers is involved.
Lawful basis: our legitimate interest in measuring whether our advertising works, so we are not spending money on adverts that do not. We have weighed this against your interests: the data is a hash and an amount rather than anything that identifies you to a reader, it concerns a business transaction you have entered into with us, and it is not used to build a profile of you or to advertise to you afterwards. You can object at any time by emailing kris@kriscreates.co.uk, and we will exclude your purchases from this reporting — it has no effect whatsoever on your subscription, your licence keys, or the support you receive.
4. Affiliate Applications
If you apply to our affiliate programme using the form on the Affiliate Program page, we collect the information you enter: your name, email address, website or channel, a description of how you plan to promote CompKit, and your payout email address. This is submitted to our own server at licencing.kriscreates.co.uk and is not shared with any third-party form provider.
Why we process it: to assess your application, and — if you are approved — to set up your affiliate account, issue your tracking link, and pay commission you have earned.
Lawful basis: taking steps at your request prior to entering into a contract, and our legitimate interest in running an affiliate programme. Where we pay commission, processing is necessary for performance of that contract and to meet our accounting obligations.
Retention: if your application is unsuccessful, we delete it within 12 months. If you are approved, we keep your account and payout details for as long as you remain an affiliate, and afterwards only as long as we are required to for tax and accounting purposes (currently six years under UK law).
We do not use affiliate application data for unrelated marketing, and we do not sell it. You can ask us to delete your application at any time by emailing hello@kriscreates.co.uk.
5. Premium Licence Validation & Game Assets
Premium modules validate licence keys and load game assets from the KrisCreates licence server at kriscreates.co.uk.
This request is made only on order confirmation pages when a valid premium licence key is configured in the plugin.
Data that may be transmitted
- Licence key
- Site domain
Submitting a review from the plugin
If your customers have used the reveal games regularly, the plugin admin may once ask whether you would be willing to be quoted on this website. Answering is entirely optional, and dismissing the request stops it returning.
If you choose to submit one, the following is sent to the licence server:
- What you wrote
- The name and store name you typed in the form
- Your licence key, site domain and plugin version, so the review can be confirmed as coming from a real customer
6. The Free Instant Reveal Module
The free Instant Reveal module operates entirely within your own site and does not make licence-validation requests to the KrisCreates licence server. The Smart Email Delay Handler manages the timing of WooCommerce emails locally on your server.
7. Data Processed Within Your Store
To display reveals, the plugin works with giveaway, prize group and order data that already exists inside your WooCommerce store. This processing happens on your own hosting under your control. We do not receive a copy of this data.
8. Cookies
Our own website usage analytics are cookieless (see section 3). The only cookies this website sets are from the Meta (Facebook) Pixel, and only after you accept the cookie banner shown on your first visit — you can change that decision at any time via the Cookie settings link in the footer — see “Advertising (Meta / Facebook Pixel)” above. If you reject or ignore the banner, no cookies are set. The plugin may use standard WordPress/WooCommerce session mechanisms on your store to coordinate reveals and email timing; these are governed by your store’s own cookie and privacy policies.
9. Your Responsibilities as a Store Operator
If you run competitions using CompKit, you remain the data controller for your customers’ personal data. You should reflect your use of instant win reveals and email timing in your own customer-facing privacy policy.
10. Third Parties
We do not sell customer data. If you accept the cookie banner on this website, browsing data is shared with Meta via the Facebook Pixel for advertising measurement, governed by Meta's own privacy policy (see “Advertising” above). Separately, if you take out a paid subscription, a hash of your email address and the amount paid are reported to Meta so we can measure which adverts lead to sales — see “Reporting a purchase to Meta” in section 3, including how to object. The only external service contacted by the plugin is the KrisCreates licence server, and only for the limited validation purpose described above — the Facebook Pixel is a website-only script and is never loaded by the plugin.
11. Data Retention
Licence validation records are retained for the duration of an active licence, plus up to 12 months after expiry to support renewals and troubleshooting, after which they are deleted.
12. Your Rights
Depending on your jurisdiction, you may have rights to access, correct, or erase personal data we hold about you as a licence holder (for example, your account or billing contact). To exercise these rights, contact hello@kriscreates.co.uk.
If you are in the UK or EU, you also have the right to object to or restrict processing, to request a copy of your data in a portable format, and to withdraw consent where consent is the basis for processing. We will respond within one month.
If you are unhappy with how we have handled your personal data, you have the right to complain to the UK supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk — though we would appreciate the chance to put things right first.
13. Changes to This Policy
We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date above.
14. Contact
Questions about this policy? Email hello@kriscreates.co.uk.