Privacy Policy

Last updated: April 8, 2026

1. Data Controller

The data controller for your personal data is:

  • Name: Sebastien DUCLY
  • Status: Sole proprietor (France)
  • SIRET: 52120173100044
  • Email: contact@kitsulab.app

As a small organization, the data controller also serves as Data Protection Officer (DPO).

2. Data We Collect

2.1 — Account Data

When you create a Kitsulab account:

  • Email address: required for authentication and service-related communications
  • Username: your identifier on the platform

2.2 — Payment Data

Payments are processed by Stripe (Stripe, Inc.). Kitsulab does not store any banking data (card number, CVV, etc.). Only transaction identifiers and payment status are retained by Kitsulab.

See Stripe's Privacy Policy for more information.

2.3 — Usage Data (Analytics Cookies)

The kitsulab.app website uses Google Analytics to analyze traffic. These cookies are only placed after your explicit consent via the cookie banner.

Data collected by Google Analytics:

  • Pages visited and visit duration
  • Traffic source (search engine, direct link, social network)
  • Device type, browser and operating system
  • Approximate geographic location (country/city)
  • IP address (anonymized)

See Google's Privacy Policy for more information.

2.4 — Content Data

The gameplay data you create in the CMS (items, quests, recipes, configurations) is stored on our servers to operate the service. This data is 100% yours (see our Terms of Sale).

3. Legal Basis for Processing

In accordance with the General Data Protection Regulation (GDPR), our data processing relies on the following legal bases:

  • Contractual performance (Article 6.1.b GDPR): account and content data, necessary to provide the service
  • Consent (Article 6.1.a GDPR): Google Analytics cookies, placed only after explicit agreement
  • Legitimate interest (Article 6.1.f GDPR): platform security, fraud prevention
  • Legal obligation (Article 6.1.c GDPR): billing data retention

4. Cookies

4.1 — Cookies Used

The site uses only the following cookies:

  • Google Analytics (_ga, _ga_*): analytics cookies, placed only after consent. Duration: 14 months maximum.
  • Cookie consent (kitsulab-cookie-consent): stores your acceptance or rejection of cookies. Stored in localStorage (not an HTTP cookie). No expiration date.

Kitsulab does not use any advertising cookies or third-party tracking cookies.

4.2 — Managing Your Consent

On your first visit, a cookie banner asks you to accept or reject analytics cookies. Your choice is saved for subsequent visits.

You can change your consent at any time by clearing the kitsulab-cookie-consent entry in your browser's local storage (Developer Tools > Application > Local Storage).

5. Data Retention

  • Account data: retained for the duration of your account, then 3 years after deletion (legal retention obligation)
  • Content data: retained for the duration of your account. Deleted within 30 days after account closure.
  • Payment data: retained in accordance with legal accounting obligations (10 years)
  • Google Analytics data: 14 months maximum (configured in Google Analytics settings)

6. Sub-processors and Data Transfers

Kitsulab uses the following sub-processors:

  • Render Services, Inc. (USA) — Website and API hosting
  • Google LLC (USA) — Google Analytics (traffic analysis)
  • Stripe, Inc. (USA) — Payment processing

These sub-processors are located in the United States. Data transfers to the US are governed by the EU-US Data Privacy Framework (European Commission adequacy decision of July 10, 2023). Google, Stripe and Render are certified under this framework.

7. Your Rights

Under the GDPR, you have the following rights:

  • Right of access: obtain a copy of your personal data
  • Right to rectification: correct inaccurate or incomplete data
  • Right to erasure: request deletion of your data (subject to legal retention obligations)
  • Right to portability: receive your data in a structured, machine-readable format
  • Right to object: object to processing based on legitimate interest
  • Right to restriction: request restriction of processing in certain cases
  • Right to withdraw consent: withdraw your cookie consent at any time

To exercise your rights, contact us at: contact@kitsulab.app

We commit to responding within 30 days.

8. Complaints

If you believe that our processing of your personal data violates the GDPR, you have the right to lodge a complaint with your local data protection authority.

For French residents, this is the Commission Nationale de l'Informatique et des Libertes (CNIL):

  • Website: www.cnil.fr
  • Address: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France

9. Security

Kitsulab implements appropriate technical and organizational measures to protect your personal data against unauthorized access, modification, disclosure or destruction. These measures include:

  • Encrypted communications (HTTPS / TLS)
  • Secure authentication
  • Restricted data access (principle of least privilege)
  • Regular backups

10. Changes to This Policy

Kitsulab reserves the right to modify this privacy policy at any time. In the event of a substantial change, users will be notified by email or in-platform notification.

The last update date is shown at the top of this page.

11. Contact

For any questions regarding the protection of your personal data: