Privacy Policy

1. Introduction

This Privacy Policy informs you of the data processing operations of OXPEO. We are committed to protecting your personal information and your right to privacy. If you have any questions or concerns about our policy or practices relating to your personal information, please contact us at hello@oxpeo.com.

When you visit our website https://kolinea.com and use our services, you entrust us with your personal information. We take your privacy very seriously. In this Privacy Policy we describe our privacy policy. We strive to explain to you as clearly as possible what information we collect, how we use it and what your rights are in this regard.

If you do not agree with certain provisions of this Privacy Policy, please stop using our sites and services.

2. What types of information do we collect?

We collect personal information that you provide to us such as name, address, contact information, passwords and security data, and payment information.

• Name and contact information:
  • We collect your first and last name, e-mail address, postal address, telephone number and other similar contact information.
• Payment Data:
  • We collect the data necessary to process your payment if you make purchases, such as the number of your payment method (for example, a credit card number) and the security code associated with your payment method. All payment data is stored and processed by Paddle (Merchant of Record). OXPEO never has direct access to your full payment details.
• Profile picture:
  • You may upload your own profile picture from your account settings; it is then reprocessed on our servers (resized, stripped of its metadata, including GPS location) before being stored. Failing that, a picture may be shown automatically from your connected social account, or resolved from Gravatar or Libravatar using a hash of your e-mail address — never the address itself. You can turn off this automatic resolution at any time from your account settings.
• Messages sent through the support chat:
  • When you write to us from the support chat, we receive the content of your messages. No name or e-mail address is needed to write: both are optional and are only recorded if you choose to leave them, so that we can reply to you later.
  • When you send a message, we also automatically record your IP address, the address of the page you are writing from, your language, your time zone and your browser characteristics (user-agent), to handle your request in context and to limit abuse.

All personal information you provide to us must be true, complete and accurate, and you must inform us of any changes to such personal information.

3. Social networks OAuth

When you connect your favorite social network account (like Google, Apple, LinkedIn, etc.) to our application, we collect and securely store your associated email address to enable email sending on your behalf and the email addresses of your recipients to facilitate message delivery.

This data is used strictly for sending emails through our service and displaying responses received in real time, without recording or storing them.

Your email address and recipients' email addresses are securely stored in our system, while email responses remain transient and are never saved.

We do not share, sell, or transfer your personal data or your recipients' data to any third parties.

We implement strict security measures to protect the confidentiality of all stored data, ensuring it remains secure and inaccessible to unauthorized parties.

4. Automatically collected information

Certain information — such as IP address and/or browser and device characteristics — may be collected automatically when you visit our Services.

This information does not reveal your specific identity (such as your name or contact information) but may include information about your device and its use, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how you use our Services, and other technical information.

This information is mainly necessary to maintain the security and operation of our services, as well as for our internal analyses and reports.

Audience measurement is done by our own application, with no cookie and no third-party tool. To recognise a single visit without storing anything on your device, the application computes, from your IP address and your browser's identifier, a fingerprint that changes every day thanks to a random key erased within 48 hours: for a visitor who is not signed in, it cannot be used to follow them from one day to the next, nor to recover their address. Your IP address and your browser's raw identifier are not kept. We only keep the device type, the browser and system family, the language, the site you came from, the campaign parameters of the landing address and the pages viewed (with no record identifier or parameter). This data is kept for 13 months.

When you are signed in, your visits and your actions in the service (for example creating an item) are linked to your account's technical identifier: this is what lets us follow how the service is used from one day to the next and measure how people get started. This processing relies on our legitimate interest in improving the product (usage statistics). This data is kept for 13 months; the link to your account is cut if you anonymise or delete it. From these actions, we set markers on your account and on your workspace: a step reached (for example "first item created"), a state computed every night (for example "inactive for 14 days") or a tag set by our team. They rely on the same legitimate interest and help us follow how people get started with the service and spot accounts that drift away from it; they trigger no decision with legal effects on you. They are included in your data export and erased when your account is anonymised.

You can object to this measurement — visits, actions and markers — at any time and without giving a reason: with your browser's "Do Not Track" or "Global Privacy Control" signal, or with the "Do Not Track" setting on the "My account settings" page. Nothing is then recorded about you and no marker is set on your account; computed states already set are removed during the next nightly run. To have the history already recorded erased as well, write to us or anonymise your account.

If you tell us which audience segment best describes you (for instance by picking a "you are: …" option on our homepage, or by visiting a page written for that audience), we store that declaration together with the other first-visit information on your account once you sign up. It is exported with your data and erased when your account is anonymised.

If you use "Get the link" to receive our sign-up link by e-mail instead of signing up right away, the address you type is used only to send that one e-mail and is never stored: it is not written to any table, does not appear in your account once you sign up, and is not kept for any other purpose.

5. How do we use your information?

We process your information for purposes based on legitimate business interests, the performance of our contract with you, compliance with our legal obligations and/or your consent.

• Marketing communications:
  • We may use the personal information you send to us for marketing purposes, if it is consistent with your marketing preferences. You may unsubscribe from our marketing emails at any time.
• Administrative information:
  • We may use your personal information to send you information about products, services and new features and/or information about changes to our terms and conditions and policies.
• Order fulfillment:
  • We may use your information to fulfill and manage your orders, payments, returns and exchanges made through the Services.
• Legal compliance:
  • If we receive a subpoena or other legal request, we may need to inspect the data we hold to determine how to respond.
• Shared workspace export:
  • In a workspace shared between several people, each participant may download a copy of what they can see there; the download link expires after a few days and the archive is then deleted.
• Support through the chat:
  • We use this information to read your message and reply to you. This processing is based on answering your request: taking pre-contractual steps or performing the contract when you are a customer, and our legitimate interest in replying to people who write to us in all other cases. It is not based on your consent: the notice shown under the message field tells you so. Only the cookie that lets us find your conversation again on a later visit requires your agreement (see the cookie policy).
  • If you left your e-mail address and have not read the team's reply in the widget about 3 minutes after it was sent, we send you an e-mail to let you know. It contains a personal link, valid for 30 days, that reopens the conversation. This e-mail is sent by our e-mail delivery provider (see the section "To whom will your information be communicated?"). Without an e-mail address, no e-mail is sent to you.
  • The retention period of conversations is given in the table of the section "How long do we keep your information?". You can exercise your rights over these messages like over the rest of your data, by contacting us at the details given at the end of this policy.

6. Will your information be shared with anyone?

We only share information with your consent to comply with laws, provide you with services, protect your rights, or fulfill business obligations.

• Consent:
  • We may process your data if you have given us your specific consent to use your personal information for a specific purpose.
• Legitimate Interests:
  • We may process your data when reasonably necessary to meet our legitimate business interests.
• Contract fulfillment:
  • Where we have entered into a contract with you, we may process your personal information to fulfill the terms of our contract.
• Legal Obligations:
  • We may disclose your information when we are legally required to do so in order to comply with applicable law.
• Service providers:
  • We may share your information with third party vendors, service providers, contractors or agents who perform services for us or on our behalf.
• Business Transfers:
  • We may share or transfer your information as part of or in the course of negotiating any merger, sale of business assets, financing or acquisition.

7. To whom will your information be communicated?

We only share and disclose your information with selected third parties for specific purposes.

• Kolinea guests and users analysis:
  • Audience measurement built into our application: no third-party tool or sub-processor, the data stays in the application's database, hosted in the European Union.
• Subscriptions payments processing:
  • Paddle — Merchant of Record (Paddle.com Market Limited, United Kingdom), joint controller for payment processing: payments, invoicing, tax compliance and fraud prevention.
• Service e-mails sending:
  • Brevo — transactional email provider (Brevo, formerly Sendinblue, headquartered in Paris, France).
• Address suggestions and map background for shared places:
  • IGN Géoplateforme — public geocoding and mapping service (Institut national de l'information géographique et forestière, France), called directly by your browser: it receives the address text typed, the pin's position and the map area shown, along with your IP address, as with any web request.
• Profile picture (failing a file you uploaded yourself):
  • Gravatar (Automattic Inc.) and Libravatar — receive only a hash of your e-mail address, never the address itself, to offer you a profile picture if you have not uploaded one and have not connected a social account showing one. You can turn this off at any time from your account settings.

We have categorized each party so that you can easily understand the purpose of our data collection and processing practices.

8. Do we use cookies and other tracking technologies?

We may use cookies and other tracking technologies to help us understand how you use our site and to improve your experience.

We may use cookies and similar tracking technologies (such as web beacons and pixels) for this.

• Kolinea mandatory technical cookies (session usage):
  • kolinea-session to store your session data
  • XSRF-TOKEN to ensure the security of your session
• Analytics cookies:
  • No analytics cookies are set. Audience measurement is done by our own application, with no cookie and no third-party tool.
• Support chat cookie (subject to your consent):
  • bmfs_chat_visitor to find your conversation again on later visits, for 365 days. Without this cookie, the current conversation is attached to your session (session cookie above).
• Kolinea preferences localStorage items:
  • kolinea-last-auth-method to store your last used social network OAuth method (if needed)
  • flux.appearance to store your preferred appearance (dark or light)
  • flux-sidebar-collapsed-desktop to store your preferred sidebar collapsed state (desktop usage)

For a detailed description of all cookies used, their purposes, and how to manage them, please refer to our Cookie Policy.

9. How long do we keep your information?

We retain your personal information only as long as necessary for the purposes set out in this Privacy Policy, unless a longer retention period is required or permitted by law. The specific retention periods for each type of data are as follows:

Where we do not need to process your personal information for legitimate business reasons, we will delete it or make it anonymous. Automated purge processes run daily to enforce these retention periods.

10. Where is your data hosted?

Your data is hosted in the European Union, by the providers below.

• OVHcloud:
  • Role: Hosting of the application's servers and database
  • Location: data centers in France
• Cloudflare (R2):
  • Role: Storage of folder documents, exports, avatars and database backups
  • Location: European Union (R2 storage in the "EU" jurisdiction)
• Audience measurement:
  • Audience measurement is done by our own application, in its database hosted in the European Union. No analytics data is transmitted to any third party.

Your application data, files and backups are hosted in the European Union. Audience measurement is done by our own application, in its database hosted in the European Union — no analytics data is transmitted to any third party. Payment data is transmitted to Paddle; service emails to Brevo (headquartered in Paris, France); and the address text typed and the map area shown to IGN (France), directly from your browser. Some of our providers are established outside the European Union or belong to a company that is. The safeguards that cover these transfers are:

• Cloudflare (R2): US parent company (Cloudflare, Inc.), with data stored in the European Union ("EU" jurisdiction); Cloudflare standard contractual clauses and Data Privacy Framework certification.
• Paddle: company established in the United Kingdom, a country covered by a European Commission adequacy decision.
• Gravatar: US company (Automattic Inc.); only a hash of the email address is transmitted, never the address itself, and this fallback can be turned off in the account settings.

11. Do we collect information from minors?

We do not knowingly collect data from or market to children under the age of 18.

By using the Services, you represent that you are at least 18 years of age or are the parent or guardian of such a minor and you consent to the use of the Services by such minor.

If we learn that personal information from users under the age of 18 has been collected, we will deactivate the account and take reasonable steps to promptly delete such data from our records.

If you become aware of any data that we have collected from children under the age of 18, please contact us at hello@oxpeo.com.

12. What are your privacy rights?

In some regions, such as the European Economic Area, you have rights that allow you to access and control your personal information more easily.

In some jurisdictions, you may have the right (i) to request access to and obtain a copy of your personal information, (ii) to request correction or deletion, (iii) to restrict the processing of your personal information, and (iv) where applicable, data portability.

In certain circumstances, you may also have the right to object to the processing of your personal information.

If we rely on your consent to process your personal information, you have the right to withdraw your consent at any time.

If you reside in the European Economic Area and you believe that we are unlawfully processing your personal information, you also have the right to complain to your local data protection supervisory authority.

13. Your Account Information

If at any time you wish to review or change your account information or delete your account, you may login to your account settings and update your user account.

You may contact us using the contact information provided below.

Upon your request to delete your account, we will deactivate or delete your account and information from our active databases.

However, certain information may be retained in our files to prevent fraud, troubleshoot problems, assist in any investigation, enforce our terms of use and/or comply with legal requirements.

14. The "DO-NOT-TRACK" function

Most web browsers and certain operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting that you can activate to signal your privacy preference.

We respect the DNT signal as well as the Global Privacy Control (GPC) signal. When your browser sends either of them, we automatically disable all analytics tracking for your session. When signed in, you can also set a permanent preference with the "Do Not Track" setting on the "My account settings" page: it applies to all your sessions, whatever the browser, and to the markers set on your account.

15. What are your rights and how can you exercise them?

In accordance with Articles 15 to 22 GDPR, regarding the data we hold about you, you have the following rights:

• Right of access (article 15 of the GDPR)
• Right of rectification (article 16 of the GDPR)
• Right to erasure (Article 17 of the GDPR)
• Right to limit processing (Article 18 of the GDPR)
• Right to notification of rectification, erasure or restriction of processing (Article 19 of the GDPR)
• Right to data portability (article 20 of the GDPR)
• Right to object (article 21 of the GDPR)
• Right not to be profiled (Article 22 of the GDPR)

You can exercise these rights by contacting us at hello@oxpeo.com or through your account administration area.

16. Do we update this policy?

Yes, we will update this policy as necessary to remain in compliance with applicable laws.

We may update this Privacy Policy from time to time. The updated version will be indicated by a "Revised" date and the updated version will be effective as soon as it is available.

If we make any material changes to this Privacy Policy, we may notify you either by clearly posting a notice of such changes or by sending a notice directly to you.

We encourage you to review this Privacy Policy frequently to be aware of how we protect your information.

17. Data deletion

At any time, you can request the deletion of your account. Your account will be deleted within 30 days.

This deletion will result in the complete removal of all your Kolinea data, including your possible workspaces, analytics, statistics and any synchronizations, integrations, accesses or authorizations you may have.

18. Automated decisions and profiling

In accordance with Article 22 of the GDPR, OXPEO does not use automated decision-making, including profiling, that produces legal effects or similarly significantly affects you.

Specifically, Kolinea does not:

• Make automated decisions about granting or denying access to services
• Use algorithms to profile users for targeted content or pricing
• Employ scoring systems based on personal data
• Use automated filtering or recommendation systems that produce legal effects

Our audience measurement is used to produce usage statistics and to follow how people get started with the service, including through the markers described above, which you can object to (see the "Do-Not-Track" section). It produces no decision about you with legal effects or that significantly affects you. No cookie is set.

19. How can you contact us about this policy?

Under the laws of some countries, you may have the right to request access to, amend or delete personal information we collect from you under certain circumstances. To request to view, update or delete your personal information, please submit your request by email or directly via your account back office. We will respond to your request within 30 days.

Do you have a question? You just want some clarification? We would be happy to discuss with you and clarify things for you. At any time. If you have any questions or comments about this policy, you can email us at hello@oxpeo.com.