1. Data controller, regional scope, and hosted stack
The controller is Khunryonflixeron, operating educational services from 6851 S Fry Rd, Katy, TX 77494, United States. Correspondence about privacy may be directed to mailuse@khunryonflixeron.world or by telephone at +1 281-392-4077 during published operating windows.
Public pages are intended for delivery exclusively over HTTPS at khunryonflixeron.world. If a legacy referrer attempts mixed protocols, intermediary edge policies should downgrade or block the request automatically; report anomalies so we may verify certificate chains.
Operational highlights
Controller type
Independent informational publisher
No regulated entity status under HIPAA for website-only interactions absent BAA sponsorship.
Hosting posture
Segmented workloads
Staging previews never ingest production credentials from live visitors.
2. Personal data dimensions we may process
Categories include identity particulars (preferred names), contact paths (digital mailboxes, voicemail lines you supply), conversational prose inside forms, hashed authentication tokens tied to gated downloads after purchase, ephemeral IP derivatives used for intrusion detection, sanitized browser footprints, aggregated engagement metrics surfaced through analytics cookies authorized per the Cookie Policy, contractual billing references minus full payment numbers when gateways tokenize payloads, timezone preferences gleaned voluntarily, accessibility accommodation notes, archival references to mailed packets for proof-of-postage timelines, marketing consent artifacts with timestamps, suppression flags you request globally, escalation references when legal counsel reviews extraordinary requests.
We avoid collecting biometric templates, governmental identifiers unrelated to invoicing mandates, granular geolocation pings, juvenile records absent verified guardian involvement, loyalty metrics tied directly to biometric inference, clipboard extractions unrelated to volunteered content, telemetry from ambient hardware beyond standard browser disclosures.
3. Purposes, lawful bases, and nuanced balances
Operational integrity
Fraud deterrence, cryptographic authentication, anomaly detection notebooks, queue rotation for human reviewers, and integrity alerts when unexpected traffic signatures appear each lean on legitimate interests balanced through proportionality memos when European requests surface.
Contractual cadence
Preparing workshop kits, packaging shipping labels, reconciling partial deliveries, and orchestrating optional remote sessions align with processing necessary to enter or perform agreements you requested or previewed at checkout.
Consent-specific channels
Optional analytics and marketing cookies, asynchronous newsletter threads, and experimental audience surveys depend on recorded consent you may withdraw without retroactively invalidating earlier lawful processing that already completed.
4. Retention grid and minimization philosophy
Abandoned contact threads without commercial nexus auto-expire after eighteen months unless security investigations extend read-only holds. Financially material records remain up to seven fiscal years for Texas-related accounting expectations. Suppression lists persist indefinitely to honor opt-out permanence. Marketing preference centers refresh quarterly snapshots with anonymized aggregates once campaigns conclude. Security logs rotate after ninety days unless escalated incidents warrant encrypted cold storage with named incident owners.
Minimization reviews occur every April and October; artifact inventories align with data-processing registers prepared for supervisory dialogue when requested.
5. Cross-border transfers and contractual assurances
Subprocessors may host encrypted partitions in the United States, European Union, or United Kingdom. Standard Contractual Clauses, UK Addenda, and supplementary technical measures (tokenized transport, tenant-isolated keys, strict firewall posture) accompany each agreement. Transfers to novel jurisdictions pause until counsel documents appropriate Transfer Impact Assessments consistent with Schrems II guidance.
6. Security measures summarized transparently
TLS with forward secrecy, hardware security module-backed key rotation, optional device posture checks for administrator accounts, encrypted offline backups with quarterly restore drills, vendor security questionnaires on two-year cadences, continuous dependency monitoring, zero-trust segmentation between research editors and production environments, manual approval for mass-mail experiments, customer-verifiable password reset tokens, and mandatory incident response tabletop exercises are representative—not exhaustive—controls.
7. Individuals’ rights catalogue
- Access & portability: receive intelligible inventories with machine-friendly subsets whenever automation supports export.
- Rectification: correct spelling, update preferred pronouns appearing in greetings, reconcile duplicate profile fragments.
- Deletion & restriction: evaluated against statutory freezes, dormant litigation timers, bookkeeping duties.
- Object & withdraw consent: marketing ceases promptly; essential communications remain permissible when strictly necessary.
Californians invoking CPRA-aligned rights and Europeans invoking Articles 77+ supervised complaints retain parallel offline instructions shipped upon request referencing this canonical URL.