Legal pages focus the title on load. Section links scroll and focus the target. Escape returns to the table of contents. Not production counsel — live money remains human-GO only.
Cookies · mbk_session HttpOnly · mbk_csrf double-submit · both Strict · cleared on logout · never shown · live money human-GO only.
Secure headers · nosniff · frame deny · CSP · gift APIs no-store · auth shells noindex · live money human-GO only.
Skip to privacy sectionsMeals by KiraPetkira · Koeta IncTrust & data
Privacy
This is a plain-language summary for the Meals by Kira lab/demo product. It is not legal advice and will be replaced by counsel-reviewed policy before production launch with live payments.
Section links move focus for screen readers. Escape from a section returns to this list.
What we collect
- Partner and admin accounts: name, email, password hash
- Donor gifts: phone (OTP), optional name, optional receipt email, amount, payment provider references
- Security logs: hashed IPs, audit actions
How we use it
To operate gifts, verify partners, prevent abuse, and show impact. We do not sell donor data. Optional receipt email is not used for marketing.
Payments
Card and PayPal are processed by those providers when configured. Practice gifts in demo mode do not charge a card. Live production money requires an explicit owner GO.
Free donations retired · 410 requires checkout · rate-limited residual · live money human-GO only. Checkout, OTP, and retired free-donation APIs use no-store so gift traffic is not CDN-cached. Free donations stay retired — OTP-gated checkout only. Live money remains human-GO only.
Contact
For data questions in this lab build, use the email associated with your partner or admin account.