Privacy Policy

Effective Date: January 1, 2026

Last Updated: October 9, 2026

Kompunik SAS ("Kompunik," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use the Kompunik platform, including all courses, community features, and related services (the "Service").

This Policy is designed to comply with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable French data protection laws.

1. Data Controller

The data controller responsible for your personal data is:

Kompunik SAS 6 rue des Moulins, 13570 Barbentane, France

Privacy inquiries: compliance@kompunik.org
Data Protection Officer: compliance@kompunik.org

If you have any questions or concerns about how we handle your personal data, you may contact our Data Protection Officer at any time.

2. Data We Collect

We collect the following categories of personal data:

2.1 Personal Information

Information you provide directly when creating and using your account:

Account information: name, email address, password (hashed, never stored in plain text)
Profile information: display name, language preference, country, age range, gender, industry, experience level, education level, years of experience
Avatar configuration: your selected avatar style and customization choices
Community profile: handle (username), profile visibility settings, bio

2.2 Usage Data

Information generated through your use of the Service:

Learning progress: course progress, skill completion status, audio listening time, video watch time, quiz scores, questionnaire responses, self-assessment answers
Streak and achievement data: daily activity streaks, badges earned, certificates issued
Community activity: posts created, comments, reactions, votes, circle memberships, challenge participation, practice room responses, ambassador program activity
Planner data: scheduled learning sessions, configuration preferences
Favorites and playlists: tactic favorites, personal playlists, shared playlist assignments

2.3 Device and Technical Data

Information collected automatically when you access the Service:

Browser information: browser type, version, and language
Device information: device type (desktop, mobile, tablet), operating system
Network information: IP address, approximate geographic location (country/region level)
Access patterns: pages visited, features used, timestamps, session duration
Referral information: how you arrived at the Service (e.g., referral links)

2.4 Community Data

Information you voluntarily share in community features:

Posts and comments: text content you write and share in the community feed, circles, challenges, and practice rooms
Reactions and votes: your interactions with other users' content
Shared playlists: playlist names and tactic selections shared by managers

2.5 Payment Data

Information related to your purchases:

Payment processing: personal subscriptions are sold and processed by Paddle.com Market Limited, acting as Merchant of Record. Organization (Enterprise and Academic) invoices are processed by Stripe, a PCI-DSS Level 1 compliant payment processor. In neither case do we store your credit card number, CVV, or full payment card details on our servers.
Transaction records: we retain transaction identifiers, amounts, dates, invoice numbers, and subscription status for billing and accounting purposes
Billing contact: name and email associated with the payment

2.6 Kernel Page: Recommendations and Survey

The public Kernel programme page (kompunik.org/kernel) offers three optional features that do not require an account:

Recommending Kernel to someone: you enter your first name and up to three email addresses. We use them only to send each person one email, in your name, with a link to the programme page. We do not keep your first name, and we do not keep the recipients' addresses in readable form: we store only a keyed one-way code of each address, for thirty (30) days, so that nobody receives more than one recommendation a month, whoever sends it. Each email explains why the recipient is receiving it and includes a link to stop all future recommendations; if they use it, we keep that one-way code for as long as needed to honour the request. Legal basis: legitimate interest in a single, personal introduction requested by someone who knows the recipient (Article 6(1)(f)). Please only recommend Kernel to people you know.
The "AI at work" survey: your answers to six multiple-choice questions are stored without your name, email address, IP address, or any account or session identifier — only with the page language and the campaign that brought you (for example, "linkedin"). They are anonymous, and are used only in aggregated form: on the page once at least twenty people have answered, and in our live preview sessions.
Invitations to live preview sessions: if you choose to leave your email address after the survey, we use it only to invite you to Kernel preview sessions (legal basis: your consent, Article 6(1)(a)). It is stored separately from your survey answers and cannot be linked to them. As proof of consent, we also keep the wording you agreed to, the date, a one-way code of your IP address, and your browser type. You can withdraw at any time through the unsubscribe link in any invitation or by writing to compliance@kompunik.org; otherwise we delete it three (3) years after our last contact with you.

To protect these forms against automated abuse, your IP address is used briefly for rate limiting, and the recommendation form is checked by Cloudflare Turnstile (see Section 5.6).

2.7 The 28-Day Soft Skills Challenge

If you join the 28-Day Challenge (kompunik.org/challenge), we process the following in addition to your account data:

Your participation: the date you joined, the language and time zone you chose (so that each day opens at midnight and the daily email arrives at 07:30, your time), the campaign that brought you (for example, "instagram"), the days you marked as done, your series, and whether you bought the Challenge Pass. Legal basis: performance of the service you signed up for (Article 6(1)(b)).
Your skill maps: when you take the diagnostic from the Challenge, we store your scores for the 28 skills with your account — once before day 1 and once from day 28 — so that you can compare the two. Unlike an anonymous diagnostic result (deleted after 90 days), these maps stay with your account until you delete it. Only you can see them, unless you choose to share an image of them.
Daily Challenge emails: sent to your account's email address as part of the service you joined. You can stop them at any time with the link in every email or in your Challenge settings.
Offers and news by email: only if you ticked the separate, optional box when joining (legal basis: your consent, Article 6(1)(a)). You can withdraw it at any time in your Challenge settings or with the link in any email; this does not affect your participation.
The day's thread: what you post there is a community post (Section 2.4), visible to other participants.
Your certificate: if you complete all 28 days and ask for it, we create a certificate with the name you type, the date and a certificate number. Anyone who has the number or the link — for example a recruiter who sees it on your LinkedIn profile — can open its public verification page, which shows that name, the date and the number, and nothing else about you. Deleting your account deletes the certificate and its verification page.

All Challenge data is included in your data export (Section 8.4) and deleted with your account (Section 8.3).

2.8 The Kompunik League (7-Day Sprint and Squads)

If you start a 7-Day Sprint (kompunik.org/community/league), we process the following in addition to your account data:

Your Sprint: the date you started, the language and time zone you chose (so that each day opens at midnight and the daily email arrives at 07:30, your time), the campaign that brought you, the days you marked as done and your days in a row, whether you saw and opened the offer, and — once you finish — the skill whose track we open for you. Legal basis: performance of the service you signed up for (Article 6(1)(b)).
Your diagnostic, kept with your Sprint: your seven skills are drawn from the diagnostic you took. We store that diagnostic's scores with your Sprint so that your seven skills stay the same. Unlike an anonymous diagnostic result (deleted after 90 days), this copy stays with your account until you delete it. Only you can see it.
Daily Sprint emails: sent to your account's email address during your seven days, as part of the service you started. You can stop them at any time with the link in every email or in your League settings.
The offer by email: one mention, only if you ticked the separate, optional box when starting (legal basis: your consent, Article 6(1)(a)). You can withdraw it at any time in your League settings or with the link in any email; this does not affect your Sprint.
Your Squad: if you name or join a Squad, its other members (four at most) see your first name, the day you are on and that day's skill, the days you have done and your days in a row. They do not see your scores or your diagnostic. What you post in the Squad's feed is visible to its members only.
What you write each day: to mark a day as done you write two short answers — what you did and how it felt. We keep them with your Sprint. Two boxes, ticked by default and yours to untick, decide who else reads them: your Squad (in its feed, under your first name) and the Kompunik Community (as an ordinary Community post, under your full name, which you can delete like any other post). Separately, we may quote what you wrote in our own communication, always without your name and after removing anything that could identify you (legal basis: our legitimate interest in showing what the Sprint is like, Article 6(1)(f)). You can object at any time by writing to contact@kompunik.org. A quote already published without your name is no longer linked to you.
Your diagnostic map, your Squad's average and the Squads board: your profile shows the map of the diagnostic your Sprint was drawn from; if you take the diagnostic again and choose to save it, we keep that one too. When your Squad has three or more members, each member can compare their own map with an average of the others' diagnostics: the average is only ever computed from at least two other people, and nobody's own scores are shown. Squads that are racing appear on a board visible to League members, with the Squad's name, the days its members have done on time and — if the person who started the Squad has set a country in their profile settings — that country's flag. No member's name appears on the board.
Your post on starting, your map and your Squad, your rating: if you ask for it, we create a public page and image saying that you started a Sprint, with your first name and the date — not your skills. Your diagnostic map is shown to your Squad only if you switch that on yourself, and you can switch it off at any time; a teammate can send you a notification asking to see it, at most once every two days. If you rate your Sprint or write us a line of feedback, we keep it with your Sprint; either one opens an extra track for you whatever your answer. When you finish and have left "share with the Kompunik Community" ticked on your last day, your finish is also posted there under your name, with your Squad's name. Squad members can see which of them have full access.
The people you invite: you invite friends by sending them a link yourself. We do not ask for, receive or store their names, email addresses or phone numbers, and we do not contact them. The invitation page is excluded from our audience measurement, and opening an invitation is not saved in our database; only our hosting provider's standard technical logs apply (Section 2.3). We process a friend's data only if they create their own account.
Your Sprint card: if you finish and ask for it, we create a public page and image showing your first name, your seven skills and the date, and nothing else about you. You can stop sharing it at any time; deleting your account deletes it.

Racing for a student society: if you choose to race for a student society (you say yes on your Sprint page, or you open the society's League link and confirm), its organiser sees your first name, your last name and the days you have done. They never see your scores, your diagnostic or what you write. Nothing is shown to them before you choose, and you can stop at any time on your Sprint page: you then leave their list.

Choosing a Squad: from time to time a person at Kompunik reads the answers Squad members wrote about their days (what they did and how it felt), in order to choose a Squad for the League's hall of fame. A Squad's feed is not read for this: only the number of posts and replies is counted. The hall of fame is public and shows the Squad's name, the country of the person who created it, the period and our reasons. It never shows a member's name. If your Squad is chosen, your first name appears on a winner's card only if you make one, and you can withdraw it at any time. Legal basis: our legitimate interest in recognising participation (Art. 6(1)(f) GDPR).

The survey and the idea: every member who finishes a Sprint is asked to answer a survey for our research on work, skills and AI. The answers are kept without your name and are not tied to your account. We record the answers, their language, the week they were sent (not the day or the time), how long each part took (so that answers given in a rush can be set aside) and, only if you agree, the student society you race for. On your Sprint we keep only the fact that you answered, and when. Because the answers cannot be linked back to you, they cannot be shown to you, corrected, exported or deleted afterwards, including when you delete your account; the survey says so before you send it. If you race for a society and agree to be counted for it, its organiser sees the combined answers of its members, always with the number of answers they rest on. There is no minimum number, so in a small society the totals may rest on very few answers. Free-text answers are never shown to an organiser. If you write an idea, it is tied to your account: your society's organiser reads it with your first name; Kompunik publishes it outside the society only if you tick the box for that, and with your name only if you tick the second. You can rewrite or delete it at any time, and it is deleted with your account. Legal basis: our legitimate interest in this research (Art. 6(1)(f) GDPR); your consent for the society's figures, for quoting a free-text answer and for publishing an idea (Art. 6(1)(a) GDPR).

A society's entry and its judging: a student society's entry — its text, the links to its journal posts and its video, in which members appear — is stored by Kompunik and shown to the League's judges and to Kompunik. The video is transcribed automatically to make subtitles for the judges. When submitting, the society's organiser confirms that everyone on camera agreed to be filmed and to the video being published if the society is chosen. A video that is not chosen is deleted 12 months after the result. The judges' scores and comments are given to the society without the judges' names. A judge's email address, scores and comments are kept with the round they judged. Legal basis: our legitimate interest in running the League (Art. 6(1)(f) GDPR); for a person on camera, the agreement they gave their society.

All League data is included in your data export (Section 8.4) and deleted with your account (Section 8.3). If you are in a Squad, you are removed from it.

2.9 The Affiliates Programme

If you apply to become an affiliate (kompunik.org/affiliates), we process what you give us on the form — your name, email address, practice, website and LinkedIn address, the kind of practice you have and who your clients are — together with the pages and resources you open in your personal hub (so that our conversation can be prepared) and the date of your meeting, which is booked in Kompunik's Microsoft 365 calendar. We use this only to run the programme and to write to you about it: you are not added to a newsletter or to any marketing list. Legal basis: steps taken at your request before a contract (Article 6(1)(b)). If you do not become an affiliate, we delete your application when you ask.

If you sign, we also keep your business details (legal name, address, country, registration and VAT numbers), the terms agreed with you and a record of your acceptance: the documents and their versions, the date, a shortened and salted hash of your IP address, and your browser type. We keep this record and your business details for as long as the agreement lasts and for five years after it ends, as evidence of the contract (Article 6(1)(b) and (f)). Statements and invoices are kept for ten years, as the law requires (Article 6(1)(c)).

If you came to Kompunik through an affiliate — by following their link, or by typing their code when buying — we record which affiliate it was, the date and, for a purchase, what was bought and the reference of the transaction (never the amount). We need this to work out what we owe the affiliate (legal basis: our legitimate interest in running the programme, Article 6(1)(f)). This record is kept after your account is deleted, because it is part of what the affiliate is owed; it then no longer points to any account.

What the affiliate sees about you. By default: your first name, the initial of your last name, what you bought and when. Never your email address. If you tick "Share my progress" when you create your account, the affiliate also sees your full name and your learning progress: the share of the course you have completed, the number of skills completed and the date of your last activity. The box is never ticked for you. You can change your choice at any time in Profile → Settings, and it applies at once. Legal basis for sharing your progress: your consent (Article 6(1)(a)). Affiliates undertake to use what they see only to follow the people they brought and to check what they are owed.

If an affiliate introduces your company, they give us the company's name and website and, if they choose, your name and work email address as their contact there. They confirm to us that you know. We use these details only to recognise your company if it contacts us (legitimate interest, Article 6(1)(f)), and we delete them when you ask.

3. How We Use Your Data

We use your personal data for the following purposes:

3.1 Service Delivery

Creating and managing your account
Providing access to courses, content, and learning materials
Tracking your learning progress and generating progress reports
Issuing certificates of completion
Delivering community features (posts, circles, challenges, practice rooms)
Processing your payments and managing your subscription

3.2 Progress Tracking and Personalization

Calculating and displaying your constellation map (soft skills profile)
Computing and displaying your learning streaks and badges
Generating your planner schedule and sending session reminders
Providing personalized learning recommendations (future feature)

3.3 Analytics and Improvement

Analyzing aggregated, anonymized usage patterns to improve the Service
Understanding feature adoption and engagement
Identifying and resolving technical issues
Measuring the effectiveness of our educational content

3.4 Communication

Sending essential service communications (account verification, password resets, security alerts)
Sending in-app notifications about community activity, feedback, and achievements
Sending planner reminders and session invitations (when you opt in)
Responding to your support requests

3.5 Security and Moderation

Protecting against fraud, abuse, and security threats
Enforcing our Terms of Use and Acceptable Use Policy
Moderating community content through our automated and human review systems
Rate limiting and preventing unauthorized access

3.6 Legal Compliance

Complying with applicable laws, regulations, and legal processes
Responding to lawful requests from public authorities
Maintaining records as required by French commercial and tax law

4. Legal Basis for Processing

We process your personal data under the following legal bases as defined by the GDPR:

4.1 Contract Performance (Article 6(1)(b))

Processing necessary for the performance of our contract with you, including:

Account creation and management
Providing access to courses and content
Processing payments and managing subscriptions
Tracking progress and issuing certificates

4.2 Legitimate Interest (Article 6(1)(f))

Processing necessary for our legitimate interests, provided these interests are not overridden by your rights and freedoms:

Improving and optimizing the Service
Analyzing aggregated usage data for product development
Ensuring the security and integrity of the Service
Preventing fraud and enforcing our policies

4.3 Consent (Article 6(1)(a))

Processing based on your explicit consent, which you may withdraw at any time:

Participating in community features and sharing your content publicly
Enabling your public profile and share cards
Receiving planner email reminders and calendar invitations
Enabling peer comparison features

4.4 Legal Obligation (Article 6(1)(c))

Processing necessary to comply with legal obligations:

Retaining financial and transaction records as required by French law
Responding to lawful requests from authorities

5. Third-Party Data Sharing

Except where stated otherwise below, we share your personal data with the following third-party service providers solely to the extent necessary for them to perform services on our behalf and on our instructions.

Section 5.1 is the exception, and the distinction matters for your rights: our Merchant of Record is not our service provider.

5.1 Payment Providers

Paddle.com Market Limited — personal subscriptions

Role: Merchant of Record. Paddle sells the subscription to you in its own name; it is not processing your data on our behalf, and is an independent data controller for your payment and tax data.
Purpose: taking payment, fraud screening, determining and remitting VAT/GST, issuing your invoice, and its own statutory record-keeping.
Data shared: name, email, billing country, and payment details (entered directly into Paddle; we never see card details).
What we receive back: a customer and transaction reference, the amount and currency charged, and the renewal date — enough to grant and maintain your licence, and no more.
Consequence for you: Paddle's own privacy notice governs that processing, and some requests about payment data must be answered by Paddle rather than by us. We will help you route any request that reaches us first.
Privacy notice: https://www.paddle.com/legal/privacy

Stripe — organization invoicing

Role: payment processor acting on our instructions (a sub-processor under Article 28 GDPR).
Purpose: processing Enterprise and Academic contract payments. Stripe is not involved in personal subscriptions.
Data shared: organization billing contact name, email, and payment details (processed directly by Stripe)
Compliance: Stripe is PCI-DSS Level 1 certified
Privacy policy: https://stripe.com/privacy

5.2 Resend (Email Delivery)

Purpose: Transactional email delivery (verification, password reset, MFA codes, planner reminders)
Data shared: email address, email content
Privacy policy: https://resend.com/legal/privacy-policy

5.3 OpenAI (AI-Assisted Features)

Purpose: AI writing assistance in community features (Magic Wand) and content moderation classification
Data shared: text content submitted for AI assistance (no personally identifiable information is sent; only the text being processed)
Note: We do not send your name, email, profile information, or learning progress to OpenAI
Privacy policy: https://openai.com/policies/privacy-policy

5.4 DigitalOcean (Infrastructure and Storage)

Purpose: Storage of media content (audio tracks, videos, images, certificates) and hosting infrastructure
Data shared: uploaded content, certificates, avatar images
Privacy policy: https://www.digitalocean.com/legal/privacy-policy

5.5 MongoDB Atlas (Database)

Purpose: Primary database for all application data
Data shared: all account, progress, and community data (encrypted at rest)
Compliance: SOC 2 Type II certified
Privacy policy: https://www.mongodb.com/legal/privacy-policy

5.6 Cloudflare (Bot Protection)

Role: sub-processor acting on our instructions (Article 28 GDPR).
Purpose: Cloudflare Turnstile checks that the recommendation form on the Kernel page is used by a person rather than an automated script, so that it cannot be used to send spam. For most visitors the check is invisible.
Data shared: IP address, browser and device characteristics, and interaction signals collected by the Turnstile widget while the form is open. Turnstile is not used for advertising and does not set tracking cookies.
Privacy notices: https://www.cloudflare.com/privacypolicy/ and https://www.cloudflare.com/turnstile-privacy-policy/

5.7 We Never Sell Your Data

Kompunik does not sell, rent, trade, or otherwise commercially transfer your personal data to third parties. We do not share your data with advertisers or data brokers.

6. Cookies and Local Storage

6.1 Essential Cookies

We use a single strictly necessary cookie:

Authentication session cookie (authjs.session-token): A secure, HttpOnly, SameSite cookie managed by Auth.js that maintains your signed-in session. This cookie is required for authentication and cannot be disabled.

6.2 Local Storage (Browser)

We store the following values in your browser's localStorage for UI preferences. These are strictly necessary for the Service to function correctly and are never transmitted to our servers:

kompunik_theme — your light/dark/system theme preference
kompunik_accent — your accent color theme (indigo, rose, amber, sky)
kompunik_active_course — your currently selected course identifier
kompunik_avatar_banner_dismissed — whether you have dismissed the avatar setup prompt

We also store the following values related to the free diagnostic feature. These are used to remember your access state and are never transmitted to our servers:

kompunik_diagnostic_unlocked — whether you have unlocked the diagnostic results by providing your email address
kompunik_diagnostic_email — the email address you entered to unlock the diagnostic results
kompunik_diagnostic_timestamp — the date and time when you first viewed the diagnostic results (used for the limited-time access countdown)
kompunik_league_result, kompunik_league_squad, kompunik_league_society — carried from the diagnostic to the start of your Sprint: the identifier of your saved result and, if you followed one, the code of a Squad invitation or of a student society's League link. They stay in your browser until you are signed in, and the codes are then forgotten

On the Kernel programme page we also store:

kernel_survey_done — the date on which you completed the survey, so that reopening it shows the results rather than the questions

6.3 Analytics

We use anonymized, aggregated analytics to understand how the Service is used. All analytics are processed internally using our own database — we do not use third-party analytics services such as Google Analytics, Mixpanel, or similar tools.

6.4 No Third-Party Tracking Cookies

We do not use third-party tracking cookies, advertising cookies, or cross-site tracking technologies. We do not participate in ad networks or retargeting programs.

Note: Our checkout providers set their own cookies during the payment process, for fraud prevention and to keep your checkout session working. Paddle does so on personal subscription checkouts, and Stripe (e.g. __stripe_mid, __stripe_sid) on organization invoicing. These are third-party cookies set by those providers and are subject to Paddle's Privacy Notice and Stripe's Privacy Policy respectively.

6.5 Affiliate Link Cookie

If you arrive through an affiliate's link, we set one first-party cookie, kompunik_aff. It holds that affiliate's code for 90 days, so that a purchase can be attributed to them (Section 2.9). It is HttpOnly, it is never shared with a third party and it is not used to follow your browsing. It is set only if you say yes when we ask on your arrival, and only when the link belongs to an affiliate who has signed with us. If you say no, nothing is stored; a purchase can then be attributed only if you type the affiliate's code yourself.

7. Data Retention

We retain your personal data for the following periods:

7.1 Account Data

During active account: Your account information, profile data, and preferences are retained for the duration of your active account
After account deletion: Account data is deleted within thirty (30) days of account deletion, except where retention is required by law

7.2 Learning Progress Data

During active account: Your progress data (completion status, quiz scores, listening time, etc.) is retained for the duration of your active account
After account deletion: Progress data is deleted within thirty (30) days of account deletion

7.3 Community Content

Posts and comments: Retained until you delete them or until your account is deleted
Reported content: Content that has been reported and actioned may be retained for up to ninety (90) days after deletion for moderation audit purposes
After account deletion: Community content is deleted within thirty (30) days of account deletion

7.4 Payment Records

Transaction records: Retained for seven (7) years from the date of the transaction, as required by French commercial law (Article L123-22 of the Code de commerce)
This includes: Transaction identifiers, amounts, dates, and invoice data
This does not include: Payment card details, which are held only by our payment providers (Paddle for personal subscriptions, Stripe for organization invoicing) and never by us

7.5 Notifications

In-app notifications: Automatically deleted after thirty (30) days via database TTL (time-to-live) index

7.6 Security Logs

Rate limiting data: Retained in memory only and cleared on server restart
Moderation records: Retained for up to one (1) year for policy enforcement purposes

8. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

8.1 Right of Access

You have the right to request a copy of the personal data we hold about you. We will provide this information in a commonly used, machine-readable format.

8.2 Right to Rectification

You have the right to request correction of inaccurate or incomplete personal data. You can update most of your information directly through your profile settings.

8.3 Right to Erasure (Right to Be Forgotten)

You have the right to request deletion of your personal data, subject to certain exceptions (such as legal retention requirements for financial records).

8.4 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.

8.5 Right to Restriction of Processing

You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data.

8.6 Right to Object

You have the right to object to the processing of your personal data based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds.

8.7 Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

8.8 How to Exercise Your Rights

To exercise any of these rights, you may:

Use the in-app contact form at kompunik.org/help (requires sign-in)
Email us directly at compliance@kompunik.org
Data Protection Officer: compliance@kompunik.org

For GDPR erasure (right to be forgotten) and data portability requests, you can also use the self-service tools in your Profile Settings > Privacy & Data section, which allow you to export your data or delete your account directly.

We will respond to your request within thirty (30) days. If the request is complex or if we receive a large number of requests, this period may be extended by an additional sixty (60) days, in which case we will inform you of the extension and the reasons for it.

8.9 Right to Lodge a Complaint

If you are not satisfied with how we handle your request, you have the right to lodge a complaint with the French data protection authority:

Commission Nationale de l'Informatique et des Libertes (CNIL) 3 Place de Fontenoy, TSA 80715 75334 Paris Cedex 07, France Website: https://www.cnil.fr

9. Children's Privacy

The Service is not intended for children under sixteen (16) years of age. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that information promptly.

If you are a parent or guardian and believe your child under 16 has provided personal data to us, please contact us at compliance@kompunik.org.

10. International Data Transfers

10.1 Primary Data Storage

Your data is primarily stored within the European Union through MongoDB Atlas, which provides EU-based cluster options.

10.2 DigitalOcean Spaces

Media content (audio tracks, videos, images, certificates) is stored in DigitalOcean Spaces, which may utilize data centers located in the United States or other regions outside the EU.

10.3 Transfer Safeguards

When personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including:

Standard Contractual Clauses (SCCs) approved by the European Commission
Adequacy decisions by the European Commission where applicable
Appropriate technical and organizational measures to protect the data

10.4 Other Processors

Our third-party processors (Stripe, Resend, OpenAI) may process data in the United States. Each operates under appropriate transfer mechanisms, including the EU-U.S. Data Privacy Framework where applicable.

Payment data for personal subscriptions reaches Paddle.com Market Limited in the United Kingdom. Transfers to the UK rely on the European Commission's adequacy decision for the UK while it is in force, and on Standard Contractual Clauses otherwise. Because Paddle is an independent controller rather than our processor (Section 5.1), it makes that transfer under its own arrangements.

Cloudflare (Section 5.6) may process data in the United States and in other countries where it operates, under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.

11. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher
Encryption at rest: Database data is encrypted at rest using AES-256 encryption
Authentication security: Passwords are hashed using bcrypt; multi-factor authentication (MFA) is available for all users and enabled by default for personal accounts (email OTP)
Access controls: Role-based access control limits data access to authorized personnel and functions
Signed URLs: Media content is delivered through time-limited signed URLs (1-hour expiry)
Security headers: Content Security Policy (CSP), HTTP Strict Transport Security (HSTS), and other security headers are enforced
Input validation: All user inputs are validated and sanitized to prevent injection attacks

For more details about our security practices, please visit our Security page.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors.

12.1 Notification of Changes

When we make material changes to this Policy, we will:

Notify you by email at the address associated with your account
Display a prominent notice within the Service
Update the "Last Updated" date at the top of this Policy

12.2 Review

We encourage you to review this Policy periodically. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Policy.

13. Contact Us

If you have questions about this Privacy Policy, want to exercise your data rights, or have concerns about how we handle your data, please contact us at:

Kompunik SAS 6 rue des Moulins, 13570 Barbentane, France

Privacy inquiries: compliance@kompunik.org
Data Protection Officer: compliance@kompunik.org
General support: contact@kompunik.org

This Privacy Policy is effective as of January 1, 2026.