Privacy policy
Last updated : 2026-08-01
1. Preamble
This policy describes how In Soo Seguier processes personal data collected through the site https://krylli.studio, in application of the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and French law no. 78-17 of 6 January 1978, as amended (loi Informatique et Libertés).
2. Data controller
The data controller is In Soo Seguier, whose registered office is at 35 Avenue du Général de Gaulle, 31700 Blagnac, France. For any question about your personal data, you can write toprivacy@krylli.com.
3. Data protection officer (DPO)
A data protection officer has been appointed. You can contact them directly:
In Soo Seguier,dpo@krylli.com
4. Data collected and purposes
The following data may be collected:
- Aggregated browsing data: pages viewed, referrer, device type, country (at regional level), visit duration.Purpose: anonymous audience measurement and site improvement.
- Technical data: IP address, HTTP headers, web application firewall logs, processed by the hosting provider.Purpose: site security, abuse prevention, legal compliance.
- Contact data: only the data you submit voluntarily through a form or by email (name, email address, message).Purpose: responding to your request.
- Quote-capacity calculator data: business email address, the assumptions you enter (volume, time, team, cost, dependency and available sources) and the calculated indicators.Purpose: producing and sending the requested report, maintaining an up-to-date sales-qualification view, occasionally sending other Krylli resources useful to operations, and carrying out relevant B2B sales follow-up. The form states this use and links to this policy. You can object by writing toprivacy@krylli.com. Every prospecting message also carries an unsubscribe mechanism.
- Identification of visiting companies: the connecting IP address is processed transiently by our processor lemlist to identify the company behind the visit (reverse IP lookup). No natural person is identified; only company-level data (company name, sector) is returned to us. Purpose: B2B sales prospecting and account-interest measurement.
No data is used for advertising profiling and no data is sold to third parties.
5. Legal basis for processing
- Legitimate interest (art. 6.1.f GDPR): anonymous audience measurement, site security, abuse prevention, and identification of visiting companies for B2B sales prospecting. This basis also covers qualification, the occasional sending of operational resources and relevant B2B sales follow-up, with the right to object via the dedicated address given in this policy and in every prospecting message.
- Performance of a contract or pre-contractual measures(art. 6.1.b GDPR): processing requests sent through a form and generating the requested personalised report.
- Legal obligation (art. 6.1.c GDPR): retention of logs for security purposes and, where applicable, cooperation with the authorities.
6. Retention periods
- Aggregated browsing data: 6 months (Umami Cloud retention).
- Technical logs (hosting provider): 13 months at most, in line with the CNIL's recommendation.
- Contact data: as long as needed to handle the request, then archived for the applicable statutory period (generally 3 years after the last contact).
- Qualification data from the free tools: 3 years at most after the last contact for a prospect who does not convert. If you object, follow-up stops immediately and only the minimal data needed to suppress future sends may be kept.
- Membership of the Resend source segment: same duration as the qualification data. When it expires, the membership is deleted. The Resend Contact is kept only if another documented relationship or the handling of an objection justifies it.
7. Recipients and processors
The data is accessible to authorised people at In Soo Seguier. It may be processed by the following processors, bound by agreements compliant with article 28 of the GDPR:
Cloudflare, Inc.
Hébergement, CDN, protection DDoS, pare-feu applicatif, vérification anti-abus Turnstile, analytics serveur (agrégées, sans cookie)
Data location: Traitement à la périphérie UE (Cloudflare conserve les logs en agrégat) — siège social aux États-Unis
Umami Software, Inc. (Umami Cloud)
Analytics web sans cookie
Data location: Union européenne (serveurs Frankfurt)
Ahrefs Pte. Ltd. (Ahrefs Web Analytics)
Analytics web sans cookie
Data location: Hors Union européenne — siège à Singapour
lempire SAS (lemlist)
Identification des sociétés visiteuses par recherche IP inversée, sans cookie — données au niveau de l'entreprise uniquement
Data location: Union européenne (serveurs en France, OVH)
Resend, Inc.
Envoi transactionnel des rapports demandés et conservation de l’adresse dans le segment source du lead magnet
Data location: États-Unis, transferts encadrés par les garanties contractuelles applicables
Attio Limited
Gestion CRM des contacts B2B et des indicateurs de qualification liés aux rapports
Data location: Royaume-Uni et autres régions décrites dans la documentation contractuelle du prestataire
Slack Technologies, LLC / Slack Technologies Limited
Notification interne des nouveaux leads et de leurs indicateurs de qualification minimisés dans un canal privé
Data location: États-Unis et autres régions décrites dans la documentation contractuelle du prestataire
Slack Technologies, LLC / Slack Technologies Limited privacy policy
8. Transfers outside the European Union
Some processors may process data from countries outside the European Union. In that case, transfers are governed by the Standard Contractual Clauses adopted by the European Commission or by an adequacy decision, in accordance with articles 44 to 49 of the GDPR.
9. Cookies and trackers
The site uses no cookies subject to consent. Audience measurement relies on cookieless solutions, exempt from prior consent within the meaning of the CNIL's guidelines:
- Umami Cloud: anonymised, cookieless analytics on EU servers.
- Cloudflare Web Analytics: server-side, cookieless, aggregated measurement.
- Ahrefs Web Analytics: anonymised, cookieless audience measurement.
The site also uses lemlist, a cookielessvisiting-company identification tool: it matches the connecting IP address to the corresponding company (reverse IP lookup), without identifying any natural person or placing any tracker on your device. Since it places no tracker, it does not require prior consent and relies on legitimate interest (art. 6.1.f GDPR). You can object to this processing at any time (see "Your rights").
The report forms use Cloudflare Turnstile to tell legitimate requests apart from automated submissions. Cloudflare processes technical connection and browser data for this purpose. This processing is strictly necessary to the security of the service and is not used by Krylli for targeted advertising.
For these reports, the personalised content passes through Resendfor transactional sending, which may keep it in its technical logs under its own retention policy. Resend also keeps the email address as a global Contact when a source segment is configured, without recording answers, indicators, qualification levels or follow-up angles there. For the quote-capacity calculator, Krylli records in Attio the email address and the calculated qualification indicators. For the AI diagnostic for distributors, Krylli records there the email address, the send date, the qualification level, the follow-up angle, the readiness profile, the workflow level that can be tested under supervision, the blocking foundations and the five structured answers on AI adoption, access to reference knowledge, retention of corrections, information gathering and validation controls. No full report, Turnstile token or raw IP address is sent to Attio. Krylli does not build a separate database for these forms. Attio may however enrich the contact record and keep an attribute history according to its own operation and technical retention periods.
An internal notification is sent to a private Slackchannel restricted to the people in charge of qualifying leads. It contains the business email address and a limited summary of the diagnostic or the calculated indicators. Slack receives neither the full report, nor the formulas, nor the Turnstile token, nor the raw IP address.
No digital fingerprinting is used for advertising tracking. No third-party advertising or social-network cookie is placed.
If a future feature required non-exempt cookies (for example Google Analytics or advertising pixels), a consent banner would be added and this policy updated accordingly.
10. Your rights
Under articles 15 to 22 of the GDPR, you have the following rights over your personal data:
- the right of access, rectification and erasure;
- the right to restriction of processing;
- the right to object on legitimate grounds;
- the right to data portability;
- the right to withdraw your consent at any time, without affecting the lawfulness of prior processing;
- the right to set directives on the retention, erasure and disclosure of your data after death.
These rights are exercised by email toprivacy@krylli.com, accompanied where appropriate by proof of identity in case of reasonable doubt about it.
11. Complaints to the CNIL
If, after contacting us, you consider that your rights are not being respected, you can lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 PARIS CEDEX 07, www.cnil.fr.
12. Changes to this policy
This policy may be amended at any time to reflect changes to the site, to the processors or to the regulations. The applicable version is the one in force on the date of your visit. In the event of a substantial change, a notice will be shown on the site.
This policy is governed by Droit français.
Contact
For any question about this policy: privacy@krylli.com.