KROMADOC Logo

Privacy Policy

Last updated : September 10, 2026

This policy explains what personal data KROMADOC collects, why, for how long, and how you can exercise your rights over it. "We" refers to the publisher identified in our Legal Notice.

1. Data we collect

  • Account data: name, e-mail address, hashed password (Argon2id — we never store your password in clear text), country, role.
  • Security data: a device fingerprint (derived from technical signals of your browser/device) and IP address, used solely to prevent the abuse of free sign-up credits and to secure new-device logins.
  • Content data: the documents you upload and the presentations generated from them, stored so you can retrieve, edit, and share them from your account.
  • Billing data: credit balance, purchase history, and — for card payments — a tokenized reference provided by our payment processor (we never receive or store your full card number).
  • Affiliate data (if you join the referral program): your referral code, referred sign-ups, commissions, and — if provided — a WhatsApp number to notify you of payouts.
  • Usage data: session activity (used to measure how many users are active/connected, in aggregate, for our own analytics), first-touch traffic source (e.g. "google", "referral:example.com") and language preference, both stored in cookies.
  • Feedback: ratings and comments you voluntarily submit about a generated document.

2. Why we process this data

  • Providing the Service: creating and securing your account, generating and storing your documents, managing your credit balance.
  • Payments: processing credit purchases and, where applicable, affiliate commission payouts.
  • Security: preventing fraud and abuse (device fingerprinting, rate-limiting, new-device approval).
  • Communication: transactional e-mails (verification, password reset, security alerts) and, for affiliates who opt in, WhatsApp payout notifications.
  • Improvement: aggregate, non-identifying statistics on usage and satisfaction.

The legal bases relied upon are, depending on the case: performance of a contract (providing the Service you signed up for), our legitimate interest (fraud prevention, service improvement), and your consent (e.g. cookies, marketing communications where applicable).

3. Who we share data with

We never sell your personal data. It is shared only with the service providers strictly necessary to operate KROMADOC, acting as our data processors:

  • Supabase Inc. — database and file hosting (EU, AWS eu-west-1).
  • OpenRouter — the text/image you submit for restructuring is sent to this AI routing provider to generate your document's content and illustrations.
  • Payment processors you choose at checkout: Stripe, PayPal, Flutterwave, CinetPay, FedaPay, Orange Money, MTN Mobile Money, Flooz, Celtiis Cash, Moneroo, PawaPay, or SasPay.
  • Meta Platforms, Inc. (WhatsApp Cloud API) — only if you are an affiliate and provided a WhatsApp number for payout notifications.
  • Our e-mail delivery provider, for transactional e-mails.

Some of these providers may process data outside the European Union (notably in the United States); in that case, we rely on the safeguards they provide (such as Standard Contractual Clauses).

4. How long we keep it

We keep your account and documents for as long as your account is active. If you delete your account (see "Danger zone" in your account settings), we anonymize your e-mail address immediately and keep only what is strictly necessary for our legal and accounting obligations (in particular, billing records, kept for the statutory period). Security logs are kept for a limited period proportionate to their fraud-prevention purpose.

5. Cookies

We use a small number of first-party cookies, none of which are used for third-party advertising:

  • Session cookie — required to keep you logged in.
  • kromadoc_lang — remembers your language choice (French/English).
  • kromadoc_ref / kromadoc_src — remember, respectively, which affiliate referred you and how you first found KROMADOC, so referral credits and traffic statistics are attributed correctly.

These cookies are strictly necessary to the functioning of the Service and are not subject to consent under applicable law; you can still block them via your browser settings, at the risk of degrading the Service.

6. Your rights

Subject to applicable law (including the GDPR if you are located in the European Union), you have the right to access, rectify, erase, and port your personal data, and to object to or restrict its processing. You can:

  • Update your e-mail address and password directly from My Account.
  • Delete your account and its associated data yourself, at any time, from the "Danger zone" in My Account.
  • Contact us at privacy@kromadoc.com for any other request, including a full export of your data.

If you believe your rights are not respected, you may lodge a complaint with your local data protection authority (in France, the CNIL — www.cnil.fr).

7. Security

Passwords are hashed with Argon2id, all traffic is encrypted in transit (HTTPS), payment details are handled exclusively by our PCI-compliant payment processors, and administrator accounts are protected by two-factor authentication. No method of transmission or storage is 100% secure, but we apply industry-standard safeguards proportionate to the sensitivity of the data involved.

8. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or in the law. The "last updated" date at the top of this page indicates the latest revision.

9. Contact

For any privacy-related question: privacy@kromadoc.com.