Privacy policy
Last updated : 2026-10-05
1. Preamble
This policy describes how In Soo Seguier processes personal data collected through the site https://krylli.studio, in application of the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and French law no. 78-17 of 6 January 1978, as amended (loi Informatique et Libertés).
2. Data controller
The data controller is In Soo Seguier, whose registered office is at 35 Avenue du Général de Gaulle, 31700 Blagnac, France. For any question about your personal data, you can write to privacy@krylli.com.
3. Data protection officer (DPO)
A data protection officer has been appointed. You can contact them directly:
In Soo Seguier, dpo@krylli.com
4. Data collected and purposes
The following data may be collected:
- Aggregated browsing data: pages viewed, referrer, device type, country (at regional level), visit duration. Purpose: audience measurement and site improvement. Umami and Ahrefs provide cookieless audience measurement independently of the Meta advertising choice.
- Technical data: IP address, HTTP headers, web application firewall logs, processed by the hosting provider. Purpose: site security, abuse prevention, legal compliance.
- Contact data: only the data you submit voluntarily through a form or by email (name, email address, message). Purpose: responding to your request.
- Creative brief and order data: your work contact details, brand website, selected plan, products, ad spend range and information you provide about assets and available sources. Purpose: preparing and delivering the requested service and keeping a record of the order.
- Payment and invoice data: billing identity and address, tax ID where provided, plan, amount and payment status. Purpose: taking payments, managing four-week subscriptions and issuing invoices. Card details are entered on Stripe's hosted page; we do not receive the full card number.
- Quote-capacity calculator data: business email address, the assumptions you enter (volume, time, team, cost, dependency and available sources) and the calculated indicators. Purpose: producing and sending the requested report, maintaining an up-to-date sales-qualification view, occasionally sending other Krylli resources useful to operations, and carrying out relevant B2B sales follow-up. The form states this use and links to this policy. You can object by writing to privacy@krylli.com. Every prospecting message also carries an unsubscribe mechanism.
Meta advertising: with your consent, we use the Meta Pixel and Conversions API to measure our ads and show relevant advertising. Meta receives browsing data and can use contact details you provide to match visits with a Meta account. Campaign details are linked to enquiries and orders to measure advertising results.
5. Legal basis for processing
- Consent (art. 6.1.a GDPR and article 82 of the French Data Protection Act): Meta advertising measurement and personalisation, including matching visits with Meta accounts.
- Legitimate interest (art. 6.1.f GDPR): cookieless audience measurement, site security and abuse prevention. This basis also covers qualification, the occasional sending of operational resources and relevant B2B sales follow-up, with the right to object via the dedicated address given in this policy and in every prospecting message.
- Performance of a contract or pre-contractual measures(art. 6.1.b GDPR): processing requests sent through a form and generating the requested personalised report, preparing creative orders and processing payments.
- Legal obligation (art. 6.1.c GDPR): retention of logs for security purposes, accounting records and, where applicable, cooperation with the authorities.
6. Retention periods
- Cookie choices: six months in this browser, and on our server after acceptance or withdrawal of consent.
- Meta advertising cookies: until expiry or withdrawal of consent. Meta's retention of received data is described in its privacy and cookie policies, linked below.
- Aggregated browsing data: 6 months (Umami Cloud retention).
- Technical logs (hosting provider): 13 months at most, in line with the CNIL's recommendation.
- Contact data: as long as needed to handle the request, then archived for the applicable statutory period (generally 3 years after the last contact).
- Qualification data from the free tools: 3 years at most after the last contact for a prospect who does not convert. If you object, follow-up stops immediately and only the minimal data needed to suppress future sends may be kept.
- Membership of the Resend source segment: same duration as the qualification data. When it expires, the membership is deleted. The Resend Contact is kept only if another documented relationship or the handling of an objection justifies it.
- Creative brief and order data: for the duration of the customer relationship, then as needed to establish or defend legal rights. Invoice and accounting records are kept for the applicable statutory period, generally ten years.
7. Recipients and processors
The data is accessible to authorised people at In Soo Seguier. It may be processed by the following processors, bound by agreements compliant with article 28 of the GDPR:
Cloudflare, Inc.
Hosting, CDN, DDoS protection, application firewall, Turnstile abuse protection and cookieless website analytics
Data location: Processing at the EU edge (Cloudflare retains aggregated logs); headquarters in the United States
Umami Software, Inc. (Umami Cloud)
Website analytics without cookies
Data location: European Union (Frankfurt servers)
Ahrefs Pte. Ltd. (Ahrefs Web Analytics)
Website analytics without cookies
Data location: Outside the European Union; headquarters in Singapore
Resend, Inc.
Sending requested reports and confirmations for creative orders or Meta management purchases; retaining the address in the lead magnet source segment
Data location: United States; transfers subject to applicable contractual safeguards
Attio Limited
CRM for B2B contacts, briefs, orders, billing details, subscriptions and report qualification indicators
Data location: United Kingdom and other regions described in the provider’s contractual documentation
Stripe
Checkout payments and subscriptions; collecting billing details and tax identifiers entered at payment
Data location: Locations and safeguards described in Stripe’s data processing agreement
Slack Technologies, LLC / Slack Technologies Limited
Minimized internal notifications about new leads and orders in a private channel
Data location: United States and other regions described in the provider’s contractual documentation
Slack Technologies, LLC / Slack Technologies Limited privacy policy
Completed brief details are stored in Attio. Stripe also processes some payment data as an independent controller under its data processing terms. Qonto is used to issue customer invoices; see Qonto's legal center.
Meta Platforms Ireland Limited receives data through the Pixel and Conversions API. Krylli and Meta share responsibility for its collection and transmission under the joint-controller terms linked below. See Meta'sprivacy policy,cookie policyand joint-controller terms.
8. Transfers outside the European Union
Some providers, including Meta, may process data from countries outside the European Union. In that case, transfers are governed by the Standard Contractual Clauses adopted by the European Commission or by an adequacy decision, in accordance with articles 44 to 49 of the GDPR.
9. Cookies and trackers
The banner lets you accept, refuse or manage Meta advertising cookies. Refusing does not prevent use of the site.
- Necessary storage: security, features you request and remembering your cookie choice.
- Audience measurement: Umami, Ahrefs and Cloudflare Web Analytics measure site usage without analytics cookies, independently of your Meta advertising choice.
- Meta advertising: cookies identify visits and ad clicks for advertising measurement and personalisation. They are used only with your consent.
You can change or withdraw consent at any time through“Cookie settings”.
Cloudflare Turnstile processes technical data to protect forms against abuse. Reports are sent through Resend. Contact details and qualification information are stored in Attio and shared with our team through Slack for the follow-up described above.
10. Your rights
Under articles 15 to 22 of the GDPR, you have the following rights over your personal data:
- the right of access, rectification and erasure;
- the right to restriction of processing;
- the right to object on legitimate grounds;
- the right to data portability;
- the right to withdraw your consent at any time, without affecting the lawfulness of prior processing;
- the right to set directives on the retention, erasure and disclosure of your data after death.
These rights are exercised by email to privacy@krylli.com, accompanied where appropriate by proof of identity in case of reasonable doubt about it.
11. Complaints to the CNIL
You can lodge a complaint with the CNIL atwww.cnil.fr.
12. Changes to this policy
This policy may be amended at any time to reflect changes to the site, to the processors or to the regulations. The applicable version is the one in force on the date of your visit. In the event of a substantial change, a notice will be shown on the site.
This policy is governed by Droit français.
Contact
For any question about this policy: privacy@krylli.com.