KAI LabsLast updated: 26 September 2026
This Policy explains how KAI Labs processes personal data on kailabs.eu, in the Customer Area, contact and quote requests, reviews and NFC keyring management.
1. Controller and contact details
The controller operates under the name KAI Labs.
- Location: Recarei, Porto, Portugal
- General and privacy contact: labs@kaistores.com
- Account and security support: support@kaistores.com
2. Personal data we process
- Contact: name, email, optional phone number, subject, message, language and communication history.
- Quote requests: contact details, project description and type, references, measurements, quantity, material, colour, finish, deadline, purpose, intended use, notes and submitted files.
- KAI Labs account: email, generated internal identifier, optional first and last name, display name, language, records of Terms acceptance and Policy acknowledgement, password stored only in protected form, and authentication and security events.
- NFC keyrings: keyring code, account association, chosen destination URL, status, association and update dates, total scans and last scan date. The redirect record does not create an individual profile of each person who scans it.
- Reviews: chosen name, unpublished email, rating, review, language, consent date and version, and an optional project photo. Once approved, the chosen name, rating, review and authorised photo may be public.
- Technical and security data: IP address, date and time, browser, device, requests, form security response and technical logs produced by the server, WordPress, WooCommerce and abuse-prevention systems.
- Preferences: language and choices strictly necessary to operate the session.
While the Shop is closed, the website does not provide a cart, checkout, orders, delivery addresses or online payments and does not request that information through the current public journey.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Reply to messages and prepare a requested quote. | Steps requested before entering a contract; legitimate interests in replying where the message is not contractual. |
| Perform a project after its quote has been accepted. | Performance of a contract and legal obligations. |
| Create and administer an account, authenticate users and recover access. | Performance of the accepted Terms and services requested by the user. |
| Associate and manage NFC keyrings and show basic scan statistics. | Performance of the service requested by the user. |
| Receive, moderate and publish optional reviews and photos. | Consent, which may be withdrawn at any time. |
| Protect accounts, forms and systems and prevent abuse and incidents. | Legitimate interests in service and user security. |
| Keep legally required records or evidence of consent and defend rights. | Legal obligations and legitimate interests in legal claims. |
We do not make solely automated decisions that produce legal or similarly significant effects.
4. Required data and submitted files
Fields marked with an asterisk are required to provide the requested feature. Other fields are optional. Please do not submit passwords, payment details, special-category data or unnecessary third-party data. You must be authorised to submit files or references containing third-party data or rights.
5. Recipients and external services
KAI Labs does not sell personal data. Access is limited to what is necessary and may involve hosting, server administration, security, backups and maintenance; Zoho Mail and FluentSMTP for email; Cloudflare Turnstile on protected forms; production or transport providers required for an accepted project; and accountants, advisers, insurers, authorities or courts where legally justified.
Social media and Google Translate links communicate with those services only when you choose to open them. Their own policies then apply.
6. International transfers
Some providers may process data outside the European Economic Area. Where applicable, transfers rely on a GDPR-recognised mechanism, such as an adequacy decision or standard contractual clauses, with additional measures when required. You may request information about the applicable safeguards.
7. Retention
Data is periodically reviewed and retained only as long as required for its purpose, legal duties or legal claims. General criteria are: non-contractual contacts up to 12 months after the last communication; rejected quotes up to 24 months after the last interaction, with technical files removed earlier where possible; accepted projects for the relevant contractual, tax, warranty and legal-claim periods; accounts and NFC data while active and then deleted or anonymised unless retention is necessary; reviews while published or until consent is withdrawn; and security logs for a limited period unless an incident requires longer retention.
Backups follow their own replacement cycles and are not used for new purposes.
8. Cookies and local storage
In the current mode, KAI Labs uses only technologies necessary for the service requested. Advertising, audience measurement and commercial attribution cookies are not enabled.
| Technology | Purpose | Indicative duration |
|---|---|---|
| WordPress test, authentication and security cookies | Check cookie support, sign in and protect the account. | Session or the period selected with “Remember me”. |
| Polylang language preference | Remember the chosen PT or EN version. | Up to 1 year. |
| WooCommerce session, where required by the Customer Area | Keep technical session state and form notices. | Normally up to 2 days. |
| Cloudflare Turnstile | Protect forms from automated submissions. | Short-lived token; a security cookie may be used when a challenge requires it. |
| WordPress compatibility storage | Avoid repeating browser capability tests such as emoji support. | Browser session. |
These technologies are necessary and do not rely on consent. If optional technologies are added later, they will remain blocked until a free, informed and revocable choice is made.
9. Security
Measures appropriate to the risk include encrypted connections, access controls, protected passwords, form validation, quote files outside the public media library and abuse prevention. No internet system is entirely risk-free. Report suspected account misuse immediately to support@kaistores.com.
10. Your rights
Where applicable, you may request access, correction, deletion, restriction, portability or objection, and withdraw consent at any time without affecting previous lawful processing. Send requests to labs@kaistores.com. We may request only the information needed to verify identity and will normally reply within one month, subject to lawful extensions.
You may also lodge a complaint with the Portuguese Data Protection Authority, the Comissão Nacional de Proteção de Dados, at www.cnpd.pt.
11. Changes
This Policy may be updated for legal, technical or operational reasons. The date above identifies the current version. Material changes will be communicated appropriately before taking effect where required.
