This page explains what data KodeNet collects, why, how long it keeps it, who it goes to and how to exercise your rights. Data controller: EMERY SERVICES, a French SARL (private limited company), Le Bas Tertrais, 35720 Pleugueneuc, represented by Jack Emery, managing director. Contact: contact@kodenet.fr.
What we collect
- “Start a project” form and builder: your name and email, your phone number and company if you provide them, and a description of your project. Legal basis: pre-contractual measures taken at your request.
- Client area: name, email, password (stored in hashed form, never readable), your change requests, messages and attachments, contractual documents, the log of backup downloads. Legal basis: the performance of our contract.
- Quotes and online signature: the identity of your company and of its representative, your email and phone number, the content of the quote; when it is opened or downloaded, the date, IP address and browser; when it is signed, the signatory's name and position, the date, IP address and browser, and the one-time code (stored in hashed form, then erased). Legal basis: pre-contractual measures taken at your request, then the proof of the contract (our legitimate interest and our legal obligations).
- Invoices and payments: your billing details (company, address, SIREN or VAT number), invoices, payments, the reference of your SEPA mandate and the last 4 digits of your account, and the log of each invoice (sent, its link opened, with the date and IP address, paid). Legal basis: the performance of our contract and our accounting obligations.
- Monitoring: availability checks concern our clients' websites, not their visitors. No visitor data is collected in the process.
- Monthly report (depending on the subscription): your email address, to send it to you. You can stop receiving it from “My account”. The statistics of our clients' websites are processed on their behalf (see article 12 of our terms). Legal basis: the performance of our contract.
- Posting to social networks (depending on the subscription): the texts, photos, videos and PDF documents of your posts, the names of the accounts you connect, the result of each post and, with the full dashboard, the figures the networks give (followers, reach, interactions, views of your Google Business Profile). You connect your accounts yourself on our provider's page: we never see your passwords. If you ask for a suggested text, your notes (never your photos or videos) are sent to our artificial intelligence provider, Anthropic, which does not use them to train its models. Legal basis: the performance of our contract.
- Referral: for a referrer, their name, email and phone number if given, the date they accepted the referral rules, then, when a reward is paid by bank transfer, their bank details (sent to us by email) and, above the tax reporting threshold, their address and SIRET number; for a referee, their name and the progress of their request, which their referrer sees in their client area (the referee is told so on the form). Legal basis: running the referral programme and our tax obligations.
- Reporting illegal content: the address of the content, your explanation, your name and email, to handle your report and tell you what we decide. Legal basis: our legal obligations as a hosting provider (EU Digital Services Act).
Website analytics
To know which pages are read and how the website is found, visits are measured with Umami, a cookie-free tool installed on our own server in France. It only produces anonymous statistics: pages viewed, the website a visit comes from, device type, approximate country and city, how long pages take to display, and contact actions (a click on the phone number or the email address, a form sent: never what is written in it). Your IP address is not stored, no profile is created, and nothing is shared or cross-referenced with other websites. These statistics are kept for 25 months at most. Legal basis: our legitimate interest in knowing how the website is used.
If your browser asks not to be tracked (“Do Not Track”), you are not counted. You can also choose here to .
Cookies
This website sets no advertising or analytics cookies. It only uses cookies needed for what you ask of it:
- Display theme: the “theme” cookie, set only if you choose the light or dark theme with the button in the header, keeps that choice for a year. It only holds that setting, no personal data.
- Client area: the session cookie, set when you log in and essential to that login, and, for an account that manages several businesses, one that remembers the business you chose.
They are exempt from consent: that's why there is no cookie banner.
Technical logs
To keep the website secure and running, Cloudflare, which protects it, processes the IP address of each visitor to filter attacks. Our server records errors (with the address of the page concerned), kept 90 days at most; its other technical logs only keep the last few days. The limits that protect our forms against abuse are counted in memory, without being stored. Legal basis: our legitimate interest in the security of the website.
How long we keep it
- Contact requests that go no further: 3 years after the last exchange.
- Client area data: the length of the contract, then 5 years (limitation period).
- Invoices and accounting documents: 10 years, as required by law.
- Quotes: 3 years after the last exchange if not signed; a signed quote and its proof of signature: 10 years.
- Log of the emails we send (recipient, subject, whether it went out; never the content): 12 months.
- Photos and PDF documents of your posts: 12 months, then deleted; videos: 3 months (their cover image stays); the list of your posts: the length of the contract.
- Referral: for as long as you take part, then 3 years after the last exchange; documents relating to rewards paid: 10 years.
- Reports of illegal content: 3 years after they are closed.
- Error log: 90 days.
- Our backups, encrypted, follow the same rules: a deleted item disappears from them as they are renewed, within 13 months at most.
Who has access, and where
Only the KodeNet team. No data is sold or passed on. To work, we use the following providers, each only for its part:
- OVH SAS (France): our server, our encrypted nightly backups in a second data centre in France, and our emails.
- Cloudflare (United States): it carries and protects all traffic to the website.
- Stripe (Stripe Payments Europe, Ireland): online payments and SEPA direct debits. It holds your card or bank details; we only keep the last 4 digits of your account and the reference of your mandate, printed on your invoices.
- Upload-Post (TONVI TECH SL, Spain): it sends the texts, photos, videos and PDF documents of your posts to the networks you chose, which then process them under their own rules (Meta, Google, LinkedIn, TikTok, X…).
- Anthropic (United States): suggested texts for your posts, if you ask for them.
- Google (United States): for search follow-up, the Search Console figures of your website.
Transfers outside the European Union
Cloudflare, Anthropic and Google are based in the United States, and Stripe may transfer data there. These transfers are covered by the European Commission's standard contractual clauses and, for the companies that have joined it, by the EU–US Data Privacy Framework, recognised by the Commission as offering an adequate level of protection. Our data stays stored in France.
Your rights
You can access, rectify or erase your data, restrict or object to its processing, or ask for its portability by writing to contact@kodenet.fr; we answer within one month. You can also give instructions on what should happen to your data after your death. If you believe your rights are not being respected, you can lodge a complaint with the CNIL (www.cnil.fr), the French data protection authority.