Privacy policy

Data controller

Samy Lestringuez, sole trader (entrepreneur individuel), SIREN 841 978 281, Parentis-en-Born (France). Contact for any question about your data: hello@kinva.eu.

What we keep

Your account: name, work email, company, website, profession, country and city, languages, time zone (the name, company, country and city only when you give them). No password: you enter your space with a 6-digit code received by email.

Your sign-up: your work email, your profession, what you said you were looking for, your language, the phone number you declare for WhatsApp, and two codes (the one in the pre-filled WhatsApp message and the one received by email), kept hashed, never in clear text.

Your professional declaration and your acceptance of the terms, with their exact text, version and date.

What you tell the agent: your messages, cleaned before anything is stored. Our software first removes phone numbers, emails and addresses; the artificial intelligence spots people's names, which the software then removes. Only the cleaned text is kept.

What the agent keeps for you (your needs and offers) and your profile (your areas, your types of clients, your specialities), never a client's name.

Proposals, introductions and their receipts (both identities and both accepted texts, frozen, with a fingerprint), your feedback, your invitations.

If you link WhatsApp (by writing to the agent from your phone): the identifier Meta assigns to you and your number. For messages received by WhatsApp or email: only their technical identifier, never their raw content.

If you ask the agent for help and it cannot solve it itself: your message, already cleaned, is passed on by email to the publisher, with your name, profession and email address, so that they can answer you.

For session security: the IP address and browser of each session. For the monthly cap on exchanges with the AI: the cost of each call, never its content.

What we never keep

The identity of an end client: their name, phone, email, address. The raw text of a message. A received email: it is deleted as soon as it has been read. No data is sold, shared for advertising or used for targeting.

Why, and on what basis

To run the service you asked for by joining (performance of a contract): understanding your needs and offers, finding matches, introducing you, writing to you on the channel where you are active.

To keep proof of what was declared and introduced, protect the network and sign-up against abuse and bots, and track technical errors (our legitimate interests).

No decision affects you without you: an introduction only happens with your agreement and the other member's.

How long

Your account and profile: as long as the account exists. Deleting it, from your profile, erases everything that belongs to you, except the evidence records below.

The phone number declared at sign-up and the two codes: erased as soon as your address is confirmed. A sign-up never confirmed: erased after 7 days. What remains of a confirmed sign-up (the email, profession, what you were looking for, the language): 30 days.

A sign-in code received by email: 15 minutes.

Your messages: 30 days.

What the agent keeps for you: while it is active; once closed or expired, 12 months, then anonymised (without you, without text, without its proposals).

Introduction receipts, your feedback (detached from your account if it is deleted) and the declaration log: 5 years, even after the account is deleted: they are kept as evidence.

A waiting-list request that did not go ahead: 12 months. A report: 12 months after it has been reviewed.

A session (its IP address, its browser): erased when it expires. The cost of AI calls: 13 months.

Technical traces of the channels: 1 day after a WhatsApp linking ends; 30 days for the identifier of a received message and for a sent notification; 24 hours for an email awaiting confirmation (encrypted).

A request for help passed on to the publisher: kept in their mailbox while they answer it, then deleted, and 12 months at most.

Website audience measurement: 13 months, without personal data (below).

Database backups: one every hour, kept for 7 days on the server, and encrypted copies off the server, kept for 35 days at most. Data that is erased, at your request or when it expires, also disappears from the backups within that time.

Who sees it

Another member sees nothing that identifies you before both agreements: they only read a description of your need or offer. The publisher can read accounts to run the service and review reports, and receives the requests for help the agent cannot solve.

Our providers process data on our behalf:

Hosting: a European provider; hosted in France (Paris), for the website and the database.

Artificial intelligence: a provider in the United States, which understands and answers your messages. It receives your messages already cleaned (no phone numbers, emails or addresses), and the descriptions that concern you.

Sending emails: a provider in the United States (confirmation, proposals, introductions, receipts).

Receiving emails: a provider, with data in France; each email you send to the agent is deleted as soon as it has been read.

Error tracking: a provider, with data in the European Union. Nothing personal is sent: no IP address, no member text, no email, no phone.

WhatsApp, from Meta Platforms Ireland Limited, if you link it to your account: it is the channel itself; messages are stored in Germany.

Protection against bots, at sign-up and sign-in: a provider in the United States. At step 3 of the sign-up window, and on the pages where you sign in or ask for a new code, it receives your IP address and technical information about your browser, to tell a human from a bot; it also uses them, on its own behalf, to improve this detection, never to identify you, profile you or show you advertising.

Transfers outside the European Union go to the United States (artificial intelligence, sending emails, protection against bots). They rely on the safeguards provided by the GDPR: the European Commission's standard contractual clauses, or the EU-US Data Privacy Framework.

The list of our processors, by name, is available on request at hello@kinva.eu.

Audience measurement

To count visits to public pages, we keep the time, the page and the domain the visitor came from, with a hash computed from a salt drawn at random every day, the IP address and the browser. The salt is erased the next day: the hash links to no one, and two days do not link to each other. Nothing is written on your device. Signed-in members are not counted.

Your rights

You can access your data, correct it, have it erased, ask for its restriction, object to processing based on our legitimate interests, and receive it in a readable format: "Download my data", in your profile. Deleting your account is also done from your profile.

For any request: hello@kinva.eu. You can also lodge a complaint with the French data protection authority, the CNIL: cnil.fr.