Privacy policy

1. Who is responsible for your data

Company

KronaSoft OÜ

Registry code

16993782

Address

Harju maakond, Tallinn, Pirita linnaosa, Padriku tee T6, 11912

Email

[email protected]

The data controller for this website is KronaSoft OÜ, a company registered in Estonia. For any question about this policy or your personal data, write to us at [email protected] — please mention "Privacy" in the subject line.

2. Contact form requests

When you send the contact form we receive the data you enter:

• your name;
• at least one way to reach you — email address, Telegram username or phone number, and/or WhatsApp phone number or username;
• optionally, your company or project name and project stage;
• your message, the site language you used and the fact that you ticked the consent box.

We use this data only to answer your request and to discuss a possible cooperation with you. The legal basis is taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering business inquiries (Art. 6(1)(f) GDPR). Providing the data is voluntary, but without a way to contact you we cannot reply.

Together with the request we automatically receive technical details: your IP address, the date and time of sending, your browser's time zone and its user agent (browser and operating system). We use them to protect against fraud and abuse and to reply at a convenient time for you (Art. 6(1)(f) GDPR); to check a suspicious request, our team may look up the approximate location of the IP address with MaxMind's GeoIP service.

If you request our launch checklist, we receive your email address (with the same technical details) and may contact you about the platform — only with your consent, given in that form (Art. 6(1)(a) GDPR); you can withdraw it at any time by writing to us.

If you write to us through our Telegram bot @KronaChatBot, we receive what you enter there (name, email, WhatsApp, company, project stage and message, or your email for the checklist) and what Telegram makes available to bots about your account: name, username, user ID, interface language, Premium status and — depending on your Telegram privacy settings — bio, birthday, personal channel and the number of profile photos. If you share your phone number with the bot, we receive it too. We use this data only to handle your request (Art. 6(1)(b) and (f) GDPR; for the checklist, with your consent, Art. 6(1)(a)). An unfinished dialog is kept on our server until you complete or restart it.

Every request — through the form on the website, a checklist request or the Telegram bot — is stored in a database on our server, together with the technical data listed above and, if you gave consent, its text and time. This is a backup in case the notification about your request doesn't reach our sales team or gets lost, and a record of the consent you gave (Art. 6(1)(f) GDPR, and Art. 6(1)(b) for partnership requests). Your request is then delivered to our sales team as a message in Telegram (through our bot @KronaChatBot); requests that couldn't be delivered right away are sent again. We do not use the data for newsletters and do not sell it.

3. Webcam studio forms

On the "For webcam studios" page a studio manager can leave the studio's details. We receive: the studio name, the contact person's name, a way to reach them (email, Telegram and/or WhatsApp), the number of models and the countries where they work, and — optionally — the studio's location and website, where the models work, model categories, their languages, the cam sites the studio works on now, and a comment. Along with the form we receive the same technical data as with a contact request (IP address, time of sending, browser time zone and user agent).

We keep the form on our server and notify our sales team about it in Telegram, so we can get in touch when we have a commercial offer in the cam business that suits your studio. The legal basis is the consent you give in the form (Art. 6(1)(a) GDPR); together with the form we store the consent text and when it was given. You can withdraw consent and ask us to delete the form at any time by writing to [email protected]. We don't pass the forms to third parties or use them for newsletters.

4. Spam and abuse protection

To protect the form from bots we use Google reCAPTCHA v2. When the form comes into view, reCAPTCHA loads from Google and evaluates information about your browser and device, your IP address and how you interact with the page; Google may set its own cookies for this. We also limit the number of submissions per IP address: for this the IP address is stored only as a one-way hash, for 10 minutes. The legal basis is our legitimate interest in keeping the service secure and free of spam (Art. 6(1)(f) GDPR).

Google's handling of this data is described in the Google Privacy Policy.

5. Website analytics and cookies

We use Google Analytics 4 to understand how visitors use the site (pages viewed, time on site, approximate location, device and browser type). Google Analytics sets the cookies _ga and _ga_<ID>, which normally expire after up to 2 years.

For visitors from the EU/EEA, the United Kingdom and Switzerland, Google Analytics cookies are set only after you allow them in the cookie banner (Art. 6(1)(a) GDPR). Until then — or if you decline — Google's Consent Mode sends Google only cookieless signals without identifiers. You can change your decision at any time via the "Cookie settings" link at the bottom of every page; when you withdraw consent, existing Analytics cookies are deleted.

Visitors from other regions do not see the banner, and Google Analytics works there with cookies; you can block them in your browser settings or with Google's opt-out add-on.

6. Technical data and browser storage

Like any website, our web server receives technical data with every request: IP address, date and time, requested page, referring page and browser type. It is used to deliver the site, to detect and fix errors and to protect against attacks (Art. 6(1)(f) GDPR), and server logs are kept for no longer than 30 days.

The site's fonts are loaded from Google Fonts, so your browser sends your IP address to Google when fetching them (Art. 6(1)(f) GDPR — a consistent, fast-loading design).

Your browser also stores, locally on your device: your cookie consent (kc-consent, for 12 months; if you decline, this is remembered only for the current visit) and a copy of the homepage video so it does not have to be downloaded again. This data never leaves your device and is not personal data we receive.

7. Who receives your data

Your data is accessed only by KronaSoft OÜ staff who need it to answer your request. We also rely on these service providers:

• Google Ireland Limited / Google LLC — reCAPTCHA, Google Analytics, Google Fonts;
• Telegram — delivery of contact requests to our sales chat (Telegram Privacy Policy);
• MaxMind, Inc. — IP address location lookup when checking a request (only the IP address is sent);
• our hosting and email providers, who store and transmit data on our behalf.

We disclose data to authorities only where the law requires it.

8. Transfers outside the EEA

Some of these providers process data outside the European Economic Area. Google LLC is certified under the EU–U.S. Data Privacy Framework, and Google also relies on the European Commission's Standard Contractual Clauses. Telegram may process messages in countries for which there is no EU adequacy decision; we use it only to deliver the request you send us, which is necessary to act on that request (Art. 49(1)(b) GDPR).

9. How long we keep data

• contact requests and checklist requests, including those sent through the Telegram bot — as long as they are needed to answer your request, for follow-up communication and possible cooperation; if we enter into a contract — for the term of the contract and the statutory retention periods. We review stored requests from time to time and delete those that are no longer needed, and earlier at your request;
• webcam studio forms — while your consent is in place and the form remains relevant for possible commercial offers; once you withdraw consent, we delete the form;
• IP hashes for the submission limit — 10 minutes;
• server logs — up to 30 days;
• Google Analytics data — for the retention period set in our Analytics account, no longer than 14 months;
• your cookie consent — 12 months, after which we ask again; if you decline, we ask again on your next visit.

10. Your rights

Under the GDPR you have the right to:

• get access to the personal data we hold about you and a copy of it;
• have inaccurate data corrected;
• have your data erased or its processing restricted;
• receive your data in a portable format;
• object to processing based on our legitimate interests;
• withdraw your consent at any time (for analytics — via "Cookie settings"), without affecting the lawfulness of processing before the withdrawal.

To exercise any of these rights, email [email protected]. We will answer within one month. You also have the right to lodge a complaint with a supervisory authority — in Estonia, the Data Protection Inspectorate (Andmekaitse Inspektsioon) — or with the authority in your country of residence.

11. Other information

We do not make decisions about you based solely on automated processing, including profiling. The site is intended for businesses and adults; it is not directed at persons under 18, and we do not knowingly collect their data.

We protect data with encrypted connections (HTTPS) and by restricting access to it to the people who need it. The request database is kept on our server outside the publicly accessible part of the website; only the website's system user and authorised staff have access to it.

We may update this policy when the site or the law changes. The current version is always on this page, with the date of the last update at the top.