Privacy policy.

The data controller is SUDOSU (SASU with €100 capital, RCS Lyon 931 107 916, operating under the trade name "Kraftory"), registered office at 8 rue Jules Vallès, 69100 Villeurbanne, France.

For any question about your personal data, contact us at hello@kraftory.digital.

We only collect data necessary for the purposes described below:

Through the brief form

• Identity: first name, last name
• Contact: work email, company (optional)
• Project: project type, timing, team size, free-text brief
• Source: how you heard about us (optional)

Through site navigation

• Technical data: IP address, browser type, pages visited, visit duration
• Cookies: see the "Cookies" section below

Your data is used to:

• Reply to your brief and prepare a call
• Draft a commercial proposal and, where applicable, a contract
• Measure site audience and improve performance (only with your consent)
• Comply with our legal and accounting obligations

• Pre-contractual measures at your request, for processing briefs (GDPR art. 6-1-b)
• Legitimate interest of Kraftory for site security and spam prevention (GDPR art. 6-1-f)
• Consent for non-strictly-necessary cookies (GDPR art. 6-1-a)
• Legal obligation for accounting retention (GDPR art. 6-1-c)

Briefs received

3 years from last contact, then archived or deleted

Accounting data

10 years (legal obligation)

Analytics cookies

13 months maximum

Technical logs

12 months maximum

Your data is only accessible to the Kraftory team handling your project. We rely on the following sub-processors, framed by data processing agreements:

• Discord — internal notification of new briefs (Discord Inc., USA)
• Google Tag Manager / Google Analytics — audience measurement, only after your consent (Google LLC, USA)
• [Hosting provider — Vercel/OVH/etc.] — site hosting

We never sell your data to third parties.

Some sub-processors are located in the United States. Transfers are framed by the European Commission's Standard Contractual Clauses and, where applicable, by the Data Privacy Framework (DPF).

Under GDPR, you have the following rights:

• Access — know what data we hold about you
• Rectification — correct inaccurate data
• Erasure — request deletion of your data
• Objection — object to processing on legitimate grounds
• Restriction — temporarily limit processing
• Portability — retrieve your data in a structured format
• Consent withdrawal at any time, without retroactive effect

To exercise a right, write to hello@kraftory.digital. We respond within one month maximum. ID may be requested in case of doubt.

If you disagree, you can file a complaint with the French data protection authority CNIL — www.cnil.fr.

We use two categories of cookies:

• Strictly necessary cookies — security, session, language preference. These do not require consent.
• Analytics and marketing cookies — Google Analytics, Google Tag Manager. Set only after your explicit consent via the banner.

You can change your preferences at any time by clicking the "Cookie preferences" button in the footer, or by deleting cookies from your browser settings.

We implement appropriate technical and organizational measures to protect your data: TLS encryption, restricted access, backups, team training. In the event of a breach likely to risk your rights and freedoms, we notify the CNIL within 72 hours and, if necessary, the affected individuals.

We may update this policy to reflect legal, technical or operational changes. The last update date appears at the top of this page. For substantial changes, we will actively inform you.