Privacy policy

Effective date: 3 June 2026 — Version 1.0

This policy explains how Lumileo SAS (publisher of Kribo, see Legal notice) collects and uses your personal data, in accordance with the GDPR (RGPD). The data controller is Lumileo SAS. Contact: support@kribo.fr.

1. What data we collect

Clients (who post a project): first name, email, phone, any company name, and the content of the Brief (project description, budget, sector, area).

Providers (who respond): identity, email, phone, trade name, SIREN number, and the profile information you provide (presentation, sectors, areas, photo).

Technical data: IP address, browser type and activity logs, for security and fraud-prevention purposes.

We do not collect any banking data: payments are processed by Stripe.

2. Why we use it

• to connect Clients and Providers (the core of the service);
• to validate and score the quality of Briefs (via our AI tool);
• to manage accounts, credits, subscriptions and invoices;
• to send service-related emails (confirmations, new leads matching a profile, notifications);
• to ensure security, prevent fraud and comply with our legal obligations.

3. On what legal basis

• Performance of the contract: management of your account and of the connection service.
• Legitimate interest: security, fraud prevention, service improvement.
• Legal obligation: invoicing, accounting.
• Consent: optional notifications, which you can withdraw at any time.

4. Who has access to your data

• Between users: a Client's contact details are only visible to a Provider after the Brief is unlocked. As long as a Brief is not unlocked, the Client's contact details remain hidden.
• Our subprocessors: hosting and database (Supabase, hosted in Europe), email sending (Resend), payments (Stripe), application hosting and audience measurement (Vercel), usage analysis and anonymised session recording (PostHog, hosted in the European Union), usage statistics (Microsoft Clarity) and advertising-performance measurement (Google Ads). They only use your data to provide their service.
• We never sell your data.

5. How long we keep it

• Account data: as long as the account is active, then archived for the duration of legal obligations (in particular accounting obligations: 10 years for invoices).
• Briefs and connections: kept for as long as necessary for the service, then deleted or anonymised.
• Technical logs: 12 months maximum.

6. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability. To exercise them, write to support@kribo.fr. You can also lodge a complaint with the CNIL (www.cnil.fr).

7. Cookies and audience measurement

Kribo uses a minimum of cookies and measurement tools:

• Essential cookies: necessary for operation (login, security). They do not require consent.
• Audience measurement and usage analysis: we use PostHog (hosted in the European Union) to understand how the service is used and to improve it. PostHog includes a session recording (session replay) in which all input fields are masked: your free text, email, phone and contact details are never recorded. We also use Microsoft Clarity and Vercel Analytics for statistical purposes.
• Advertising measurement: a Google Ads identifier allows us to measure the effectiveness of our campaigns (for example, knowing that a project was posted after a click on an ad). We do not carry out advertising retargeting.
• Attribution: a first-party kribo_utm cookie (90-day duration) stores the origin of your visit (marketing campaign) in order to attribute conversions correctly. It contains no personal data.

You can configure your browser to block cookies, or install a blocker, at the risk of degrading some features. We never sell your data for advertising purposes.

8. Changes

This policy may change. The applicable version is the one online. In the event of a major change, registered users are informed.

For any question: support@kribo.fr.