Privacy policy

This policy explains what data Ksar processes, why and how, in accordance with the General Data Protection Regulation (GDPR).

Two different roles

• Controller: for data about website visitors and our customers (account, billing, audit requests). This is what this page covers.
• Processor: for the email addresses our customers send us to analyse during signups on their own websites. This processing is governed by the data processing agreement (DPA).

Controller: [To be completed : owner name], trading as Ksar, [To be completed : address] — contact@useksar.com.

Data, purposes and legal bases

Data	Purpose	Legal basis	Retention
Email (encrypted), sign-in sessions	Create and manage the customer account (passwordless magic-link sign-in)	Performance of the contract	Contract duration, then 3 years; never-confirmed accounts: 7 days
Billing details, invoices	Invoicing, accounting obligations	Legal obligation	10 years
"Request an audit" form	Answer the request	Pre-contractual steps	3 years after last contact
Technical logs (IP address, date, page or route)	Security, abuse prevention, rate limiting	Legitimate interest	30 days
Newsletter (discount pop-up): email (encrypted), language, discount code	Send the newsletter and your code (double opt-in by email); check the address is not disposable	Consent (checkbox), withdrawn in one click in every email	Until you unsubscribe, when the address is erased; unconfirmed sign-up: 7 days. An encrypted fingerprint of the address is kept 3 years after unsubscribing, so that each person gets only one discount (legitimate interest)
Address tested in the free "Email Risk Checker"	Display the result	Legitimate interest	Not stored

We do not sell any data and do not do targeted advertising.

Cookieless analytics

We measure website traffic with Cloudflare Web Analytics, without cookies, without local storage and without personal identifiers: a small script, loaded from static.cloudflareinsights.com, counts page views and measures load time, then sends these measurements to Cloudflare (cloudflareinsights.com). We only see aggregated statistics (pages, countries, browsers, performance); no visit is linked to a person. Legal basis: legitimate interest (knowing the site’s traffic and speed). See the cookie policy.

Recipients and sub-processors

Data is only accessible to the publisher and its sub-processors, within the scope of their mission:

Sub-processor	Role	Data location
OVH SAS	API and database hosting	European Union (France)
Cloudflare, Inc.	Website hosting, bot protection, cookieless analytics	Global network (standard contractual clauses, Data Privacy Framework)
Brevo (Sendinblue SAS)	Transactional emails	European Union (France)
Stripe Payments Europe, Ltd.	Payment and invoicing	European Union (Ireland)

When a sub-processor is located outside the European Union, the transfer is covered by the European Commission’s standard contractual clauses or the Data Privacy Framework.

Security

Encrypted connections (HTTPS), encrypted contact addresses, hashed sign-in links and API keys, restricted access, logs without clear-text email addresses, encrypted backups. Addresses analysed for our customers are never stored in clear text (HMAC-SHA256 fingerprints).

Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability. Write to contact@useksar.com; we reply within one month. You may also lodge a complaint with the French data protection authority, the CNIL (cnil.fr), or your local authority.

If your address was analysed during a signup on one of our customers’ websites, contact that website first, as it is the controller; we help it respond (in particular by erasing fingerprints).

The French version of this policy prevails.