Privacy policy

Data controller

AUROCHS Ventures, a French simplified joint-stock company (SAS) with a share capital of €50,000, registered with the Nanterre Trade and Companies Register under number 912 058 104, whose registered office is located at 144 avenue Charles de Gaulle, 92200 Neuilly-sur-Seine, France (hereinafter “kstr”), operator of the kstr platform, is the controller of the processing described in this policy, which it carries out in accordance with Regulation (EU) 2016/679 (GDPR) and French Law No. 78-17 of 6 January 1978. Contact: hi@joinkstr.com. Each Brand and each Creator is responsible for the processing it carries out itself on data obtained in the course of a collaboration.

Data we collect

Account data (email, hashed password), profile data (name, photo, bio, city, social networks and statistics, rates), gifting delivery addresses, Brands' company data (SIRET), messages exchanged, collaboration and payment history, tax and identification data of Creators and Referrers (identity, date of birth, address, tax identification number, VAT number), data relating to the affiliation and Referrer programmes (promo codes, recorded sales, commissions), electronic signature evidence files, reports, connection data and technical data (cookies described below). The service is not intended for minors: kstr does not knowingly collect their data and deletes an account opened by a minor under the conditions of article 2.2 of the Terms of Use. Declarations and supporting documents relating to children appearing in content (article 2.3 of the Terms of Use) are processed only to check compliance with French Law No. 2020-1266 of 19 October 2020.

Purposes and legal bases

Provision of the matching service and performance of the contract between the user and kstr (the “Terms of Use”); payment and invoicing (legal obligation); prevention of fraud, circumvention of the platform and security, including the automated masking of contact details in the messaging and the review of conversations in the event of a report or serious suspicion of circumvention or fraud (legitimate interest; for correspondence, under the conditions of article 14.2 of the Terms of Use, or on the basis of messages that a correspondent has themselves sent to kstr in support of a report); sending service emails (performance of the Terms of Use); compliance with kstr's tax obligations, in particular informing Creators and Referrers and collecting, verifying and reporting their information (articles 242 bis and 1649 ter A et seq. of the French Tax Code; legal obligation); retention of users' identification data (article 6, V, A of French Law No. 2004-575 of 21 June 2004 and Decree No. 2021-1362 of 20 October 2021; legal obligation); handling of reports, content moderation and notification of decisions (Regulation (EU) 2022/2065; legal obligation); evidence of contracts and electronic signatures, enforcement of non-circumvention (article 6 of the Terms of Use), handling of disagreements and conciliations (article 7 of the Terms of Use), establishment, exercise and defence of kstr's legal rights (legitimate interest).

Recipients

Public profile information is visible to users of the site. Payments are processed by kstr's authorised payment service provider (Stripe), which acts as a separate controller for card data. Data may also be disclosed, strictly to the extent necessary: to the Brand or Creator party to a collaboration; to kstr's processors (hosting, email delivery, country detection, and the artificial intelligence provider Anthropic, used by the kstr team to help verify profiles and draft messages, with no automated decision-making and no model training on this data); to the platforms the user chooses to connect (Meta, TikTok, Shopify, WooCommerce…); to administrative and judicial authorities where required by law, in particular the tax authorities; to kstr's advisers bound by professional secrecy; to a potential acquirer or investor bound by a confidentiality obligation, or to the transferee of the platform (articles 12.5 and 18.3 of the Terms of Use). Some of these recipients (in particular Stripe, Meta, TikTok, Shopify, Anthropic and ipinfo.io) may process data outside the European Union; these transfers are governed by an adequacy decision of the European Commission or, failing that, by the standard contractual clauses adopted by it (articles 45 and 46 GDPR). A copy of the safeguards may be obtained by writing to hi@joinkstr.com. No data is sold to third parties.

Retention periods

Account data: for as long as the service is used; an account inactive for 3 years is deleted after its holder has been informed. After the account is closed, civil identity data is kept for 5 years and the other data provided when the account was created for 1 year (article 6, V, A of French Law No. 2004-575 of 21 June 2004 and articles 2 and 3 of Decree No. 2021-1362 of 20 October 2021). Accounting documents and data: 10 years (article L. 123-22 of the French Commercial Code). Register of information collected under the platforms' reporting obligations: 10 years (article 1649 ter D of the French Tax Code). Messages, contracts, signature evidence files and payment histories: for the life of the account, then restricted-access archiving for 5 years from the end of the relationship, as evidence of contracts and for the defence of kstr's rights (article 2224 of the French Civil Code and article L. 110-4 of the French Commercial Code). The periods specific to certain processing operations are set out below.

Cookies

The site only uses technical cookies, which do not require consent: a session cookie, necessary for logging in, a cookie storing the display language and the country code determined on the first visit and, for Brand accounts, a security cookie recognising a device already verified by a code sent by email (12 months). No advertising or third-party audience measurement cookie is set. During a payment, Stripe's payment module may set cookies necessary for transaction security and fraud prevention, which are exempt from consent (article 82 of French Law No. 78-17 of 6 January 1978).

Audience measurement

To measure site traffic (number of visitors, visits and page views, pages viewed, referring site), kstr uses an in-house tool, without cookies and without any external service, configured to meet the conditions for exemption from consent defined by the CNIL for audience measurement (article 82 of French Law No. 78-17 of 6 January 1978 and deliberation No. 2020-091 of 17 September 2020); legal basis: kstr's legitimate interest in measuring traffic to its site. The user's IP address is never recorded: their browser is recognised by an encrypted, non-reversible fingerprint. Only overall statistics are viewed by kstr. This data is deleted after 13 months. If the user's browser sends the “Do Not Track” or “Global Privacy Control” signal, the user is not counted.

Tracker: statistics of collaboration content

For each content published as part of a collaboration, kstr records its link and, at regular intervals for 90 days, its public statistics or those from the Creator's connected account (views, reach, likes, comments, shares, saves), as well as the figures and screenshots declared by the Creator. This data is visible to the Brand concerned and to kstr, and to the Creator if the Brand shares its analysis (performance of the Terms of Use accepted by the Brand and the Creator, article 3.4 thereof). It is kept for as long as the Brand's account exists; the Brand or the Creator who added a content may remove it at any time, which deletes its records. kstr may use these statistics in aggregated and anonymised form, identifying neither the Creator nor the Brand, to improve its services and conduct studies.

Connected Instagram and TikTok accounts

If the Creator connects their Instagram or TikTok account, kstr receives, via the official Meta and TikTok APIs and with the Creator's authorisation, their identifier, username, number of followers and the statistics of their recent posts (likes, comments, views) in order to calculate their engagement rate (performance of the Terms of Use, at the Creator's request). Access tokens are encrypted. kstr never publishes anything in the Creator's name. The Creator may disconnect an account at any time from their profile: the tokens are then deleted.

If the Creator adds screenshots of their statistics to their profile, they are re-saved by kstr's servers (image metadata, including location, is removed) and are only visible to the Creator, to kstr and to Brands approved by the kstr team. They are kept until the Creator deletes them from their profile, or until their account is deleted.

Creator and brand prospecting

To invite Creators to join the kstr platform, the kstr team may record, from public professional profiles, the username, display name, number of followers, topic and professional email address published by the Creator (legitimate interest: B2B prospecting, in compliance with article L. 34-5 of the French Postal and Electronic Communications Code, the message relating to the recipient's professional activity). For Brands, kstr may record the company name, website and sector, as well as the name and professional email address of a contact person, obtained from public sources (company website, LinkedIn). This information is never displayed on the site. Each invitation message contains a link to object to any further contact. For a Creator, the contact details are then deleted. For a Brand, the objection only concerns the person who expresses it: kstr keeps only their name and email address on an opt-out list, so as never to write to them again, and the company may remain in contact with kstr through other contact persons. When the user opens their personal invitation link, kstr records the date of opening and the pages of the site viewed during the visit, in order to know whether the invitation interests the user (legitimate interest; where this tracking involves reading or writing information on the user's device, it is only carried out with their consent, in accordance with article 82 of French Law No. 78-17 of 6 January 1978); this information is deleted together with the user record or as soon as the user objects to contact. Data of non-registered persons is deleted no later than 3 years after the last contact. When a Brand is invited by a Referrer (article 11 of the Terms of Use), kstr receives from the Referrer the name and professional email address of the person invited, which are processed under the same conditions; the Referrer warrants that they obtained them fairly and that they comply with the rules applicable to commercial prospecting (article 11.5 of the Terms of Use).

kstr solidaire: donation links

When the user clicks on a Creator's donation link, kstr records the date of the visit, the campaign and the Creator concerned, as well as an encrypted, non-reversible fingerprint of their browser, which is used only to avoid counting the same visit twice within the hour (legitimate interest: measuring the visits generated for the association); this fingerprint is deleted after 48 hours. Their IP address is not recorded. The user is then redirected to the association's donation page, which is solely responsible for the data the user provides to it in order to donate.

Demo requests

When a user requests a demo, kstr records the name of the Brand or Creator, their contact details (name, email, phone) and the information they provide, in order to call them back and present the platform (pre-contractual measures taken at their request, article 6(1)(b) GDPR). This data is kept for no more than 3 years after the last exchange with kstr if the user does not create an account on the kstr platform.

Website chat

Visitors can write to kstr via the website chat. kstr keeps the first name (optional), email address and messages exchanged, solely in order to reply to them (including by email if they have left the site); legal basis: kstr's legitimate interest in answering the requests sent to it. Conversations are deleted no later than 12 months after the last message.

Contact details and verification documents

On registration, kstr collects the first name, last name, job title (Brands) and phone number of the contact person: they are only visible to the kstr platform team and are used to validate accounts and contact the user (performance of the Terms of Use). The kstr team may keep professional supporting documents sent by Creators (SIREN or Kbis extract, URSSAF and tax compliance certificates, ID document, bank details), in particular to enable Brands to meet, where applicable, the due diligence obligation incumbent on them as principal (articles L. 8222-1 and D. 8222-5 of the French Labour Code), and for the performance of kstr's reporting obligations (articles 1649 ter A et seq. of the French Tax Code). These documents are stored in a private space accessible only to administrators and deleted when the account is closed, subject to the legal retention periods indicated above and the applicable limitation period. Documents provided by the signatory of an affiliation contract (ID document, Kbis extract, bank details, power of attorney) are kept for the term of the contract and the applicable limitation period (article 9 of the affiliation special terms). When a contract is signed electronically on the platform, kstr records in an evidence file the name entered, the dates and times of sending, viewing and signature, the IP address, the browser and the digital fingerprint of the document (legitimate interest: evidence of consent and of the integrity of the contract); this file is kept for 5 years from the end of the contract.

Campaign offers to creators

Registered Creators may receive by email campaigns matching their topic or geographical area (legitimate interest: a service offered by the platform). Each email contains an unsubscribe link, and this option can be disabled at any time in “Account settings”.

Gifting delivery addresses

When a gifting is confirmed, the Creator provides the address at which they wish to receive the product: name, postal address, phone (optional, for the carrier) and, if they wish, details such as size. This address is only sent to the Brand of the collaboration concerned, with the Creator's express consent, given for each gifting when entering it. If necessary, the Brand passes it on to the factory or logistics provider in charge of shipping, for that sole purpose; it then acts under its own responsibility. Legal basis: performance of the Terms of Use and of the gifting service requested by the Creator, who accepts the transmission of their address to the Brand. The Brand, recipient of the address, is a separate controller for shipping the product (article 14.1 of the Terms of Use). The address is kept with the collaboration for the life of the account. The Creator may save it for future giftings; they may change it as long as the product has not been shipped and request its deletion by writing to kstr. Where the gifting uses a personal code in the Brand's store (article 3.7 of the Terms of Use), the Creator enters their address directly in that store, under the Brand's responsibility: kstr does not receive it. The bank details used for Creators' payouts are collected and kept directly by Stripe, kstr's payment service provider; kstr only receives the information necessary for its reporting obligations (articles 1649 ter A et seq. of the French Tax Code).

Shopify app or equivalent stores

When a Brand connects its Shopify store to kstr (Shopify app “kstr”), kstr reads the products and variants (name, variant, price, SKU) so that the Brand can pick them for a gifting campaign; for each gifting, it creates in the store a personal single-use discount code, limited to the gifted products and their price, which the Creator uses to place the order in the store themselves (Shopify checkout); it then finds this order, by this code or by the tag KSTR-<collaboration number> if the Brand created it itself, to retrieve its fulfilment status and tracking number; for affiliation, it reads the orders placed with the Creators' discount codes (order number and date, amounts, taxes, shipping, refunds, codes used and payment status) in order to calculate commissions. kstr never creates, edits or completes any order, and no payment goes through the app. kstr does not read the store's customers or their personal data (name, address, email, phone number). The Creator enters their delivery address directly in the Brand's store when placing the order; kstr does not read it in Shopify. kstr keeps the store address, an encrypted access token, the Brand's settings, the gifting codes it created, the identifiers of the gifting orders it found and the affiliation sales needed to calculate and justify commissions. When the app is uninstalled, or when Shopify asks kstr to erase the store's data, the access token and the connection are deleted; affiliation sales already approved are kept for as long as required by accounting obligations. Legal basis: performance of the service requested by the Brand.

Some Brands are connected through an app dedicated to their store only (outside the Shopify App Store). In that case, and only if the Brand has allowed it, kstr may prepare a draft gifting order in the store with the Creator's name and delivery address, which the Brand then completes itself in Shopify.

As part of the affiliation programme, the Brand connects its store (in particular WooCommerce) with a read-only access key; kstr only reads the information necessary to record the sales made with the Creators' promo codes (number, date, status, amounts, codes used and refunds). If personal data of the Brand's customers is transmitted to it through this connection, kstr processes it as the Brand's processor, solely for the performance of the affiliation contract (article 28 GDPR). kstr may also assess the Brand's financial soundness from public sources and specialised agencies (article 8 of the affiliation special terms), which may involve data relating to its managers (legitimate interest: preventing unpaid invoices).

Login log

For account security and support, kstr records the date of each login and of each return to the site (once a day), the type of device and browser, the estimated country and a truncated IP address (without its last block). Legal basis: kstr's legitimate interest in ensuring account security and providing support. Only the kstr team has access. This information is kept for 12 months, then erased, and is deleted with the account. To help the user, the team may also display their space as they see it, in read-only mode, without being able to change or send anything; each viewing is logged.

Creator profile visits

When a Brand or a member of the kstr team views a Creator's profile, kstr records the date of the visit, the visiting account and its type (Brand or team), in order to show the Creator the number of visits received and to send them at most one notification per day (legitimate interest: helping the Creator improve their profile), and, where applicable, to prove an introduction made through kstr (article 6.1 of the Terms of Use; legitimate interest). The Creator does not see which Brand viewed them, unless it initiates an exchange with them (article 12.4 of the Terms of Use). Where applicable, Creators' views of campaigns are recorded under the same conditions. This information is displayed for 12 months, then kept in a restricted-access archive for a further 12 months, solely as evidence of compliance with article 6 of the Terms of Use.

Account deletion reasons

When a member deletes their account, they may optionally give a reason and leave a comment. kstr keeps only this reason, this comment, the type of account (Brand or Creator) and the date, without any link to the person, to improve the service.

Language selection

On the user's first visit, the country associated with their IP address is determined in order to display the site in French or English. This information may be obtained from kstr's hosting provider, its content delivery network (CDN) or the ipinfo.io service. Legal basis: kstr's legitimate interest in displaying the site in a suitable language. Only the country code is kept, in a cookie; the user can change the language at any time at the bottom of each page.

Users' rights

Each user has the right of access, rectification, erasure, restriction, portability and objection, the right to withdraw their consent at any time where processing is based on it, and the right to set guidelines on what happens to their data after their death (article 85 of French Law No. 78-17 of 6 January 1978). kstr responds within one month, which may be extended under the conditions of article 12 GDPR, and may ask them to prove their identity in case of reasonable doubt. The user can delete their account at any time from “Account settings” or write to hi@joinkstr.com; closure takes effect after ongoing collaborations have been completed or cancelled and the amounts due have been paid (article 16.1 of the Terms of Use), some data being kept for the periods indicated above. The user may also lodge a complaint with the CNIL (www.cnil.fr).

Right to object. Where processing is based on kstr's legitimate interest, the user may object to it at any time on grounds relating to their particular situation; kstr then stops the processing, unless there are compelling legitimate grounds or for the establishment, exercise or defence of legal claims. The user may also object at any time, without giving reasons, to prospecting (article 21 GDPR).

Mandatory data and automated decisions. Unless otherwise stated when collected, the data requested is necessary for the provision of the service or compliance with kstr's legal obligations; failing this, the account cannot be opened or maintained. kstr takes no decision producing legal effects concerning the user or similarly significantly affecting them based solely on automated processing (article 22 GDPR).

Death of the user. In the absence of guidelines, the heirs may exercise the user's rights under the conditions of article 85 of French Law No. 78-17 of 6 January 1978. The user may tell kstr, by writing to hi@joinkstr.com, whether or not they wish their data to be disclosed, after their death, to a third party they designate.

This English version is provided for convenience. In case of discrepancy, the French version prevails.