Privacy Policy

1. Data controller

BFAT (SASU), registered at BAT B, 10 RUE DU BOCAGE, 44840 LES SORINIERES, FRANCE, SIREN 944 393 388, is the data controller for personal data collected through KiboData.com and related services.

2. Data we collect

Account data: email address, name (optional), password (stored hashed), Gumroad license key when you activate Lifetime Pro.

Site configuration: domain names, webhook secrets you provide, API key metadata (not full keys after creation).

Analytics data: page paths, referrers, UTMs, device/browser hints, approximate country (from IP at ingest), session identifiers in first-party storage on your visitors' browsers. Processed on your behalf as processor when you use the tracker on your sites.

Server logs: IP address, user agent, timestamps for security and rate limiting.

3. How we use your data

To provide the dashboard, verify your badge, enforce plan limits, send optional transactional email (verification, password reset), and improve the service.

We do not sell personal data to third parties.

We use subprocessors for hosting (e.g. Hetzner), databases, and email delivery when configured.

4. Cookies & local storage

KiboData.com uses an essential HTTP-only session cookie for your login.

The KiboData tracker does not set third-party cookies; it may use sessionStorage/localStorage on your website visitors' browsers for anonymous session counting.

We do not use third-party advertising trackers on the marketing site.

5. Retention

Account data is kept while your account exists, then deleted when you delete your account (subject to legal retention).

Analytics events are retained according to your plan (typically 24 months; extended retention if purchased). Old events may be purged automatically.

6. Your rights (GDPR)

You may access, rectify, export, erase, restrict, or object to processing of your account data. Use Settings → Account, or DM @bunbeau on X for help (no email support).

You may lodge a complaint with your supervisory authority (CNIL in France).

7. International transfers

Data is processed in the EU/EEA where possible. If we use providers outside the EEA, we rely on appropriate safeguards.