Privacy policy
This policy explains how personal data is processed in the Kip service (the “Service”), in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act. It exists in several languages; if they differ, the French version prevails.
1. Who processes your data
Hostel Analytics SAS, 10 rue Blacas, 06000 Nice, France, publishes the Service. For any question about your data: contact@hostelanalytics.fr.
- Team data (staff profiles, announcements, procedures, training, messages, tickets, schedules…): the business that uses Kip (the “Customer”, your employer) is the controller; Kip processes it on its behalf, under the data processing agreement. If you are an employee, please address your requests to your employer first; we help them answer.
- Customer account, security and support: Hostel Analytics SAS is the controller.
2. Data processed
- Profile: name, e-mail address, role, departments, workspace, language, photo (optional).
- Content: what the team writes or uploads in Kip (announcements, procedures, lessons, messages, tickets and photos, shifts, checklists, etc.).
- Surveys: answers are stored without the name of the person answering.
- Technical data: connection and access log (date, IP address, browser), notification subscriptions, two-factor authentication settings.
- Support: your exchanges with support.
- Former members register: when someone deletes their account or is removed from a workspace, their name, e-mail address, the date they left and the list of what they created are recorded before their profile is anonymised. Only the workspace’s admins can read it; it is kept 1, 3 or 5 years as chosen by the workspace (3 years by default), then deleted.
3. Why, and on what basis
| Purpose | Legal basis |
|---|---|
| Creating and managing the Customer account, providing the Service, sending the necessary e-mails (invitation, password, notifications) | Performance of the contract |
| Service security, access log, abuse prevention | Legitimate interest in protecting the Service and its users |
| Support | Performance of the contract |
| Invoicing (once payment is switched on) | Performance of the contract; legal retention obligation |
For team data, the Customer sets the purposes; Kip acts only on its instructions. Kip sells no data and shows no advertising.
4. Translation and Ask Kip
When you ask for a translation or ask Ask Kip a question, only the texts needed are sent to Anthropic (translation, summaries) or OpenAI (search). Under their API terms, these texts are not used to train their models. No decision producing legal effects concerning you is taken by automated means.
5. Hosting and sub-processors
Data is hosted in Paris: Supabase database (Paris (eu-west-3)) and Vercel application functions (Paris (cdg1)). Only the following providers process it for Kip, each for its role:
| Provider | Role | Data concerned | Location | Safeguards |
|---|---|---|---|---|
| Vercel Inc. (USA) | Application hosting | Data passing through the application, technical logs | Functions: Paris (cdg1); page delivery: global network | Standard contractual clauses (SCCs); Data Privacy Framework where applicable |
| Supabase Inc. (USA) | Database, authentication, file storage | All Service data | Paris (eu-west-3) | SCCs |
| Scaleway SAS (France) | Sending e-mails (invitations, passwords, notifications) | E-mail address, name, e-mail content | France | Provider established in the EU |
| Anthropic PBC (USA) | Content translation, Ask Kip summaries | Texts sent for translation or summary | USA | SCCs; Data Privacy Framework where applicable |
| OpenAI (USA) | Ask Kip search | Procedure texts and questions asked to Ask Kip | USA | SCCs; Data Privacy Framework where applicable |
| Browser notification services (Apple, Google, Mozilla) | Delivery of push notifications | Technical device identifier, short notification text | Depends on the browser | Browser vendor’s terms |
Vercel, Supabase, Anthropic and OpenAI are US companies: any transfer outside the European Union is covered by the European Commission’s standard contractual clauses and, where applicable, the EU–US Data Privacy Framework. Data may also be disclosed to authorities where the law requires it.
6. Retention
| Data | Retention period |
|---|---|
| Procedures, lessons, recipes, roles, departments | As long as the workspace keeps them (no automatic deletion) |
| Messages and private conversations | As chosen by the workspace: 3, 6, 12 or 24 months, or no limit (default 6 months after sending) |
| Announcements | As chosen by the workspace: 3, 6, 12 or 24 months, or no limit (default 12 months after sending) |
| Resolved tickets and their photos | As chosen by the workspace: 3, 6, 12 or 24 months, or no limit (default 24 months after resolution) |
| Access log | As chosen by the workspace: 3, 6, 12 or 24 months, or no limit (default 12 months) |
| Former members register | As chosen by the workspace: 1, 3 or 5 years after the person left (default 3 years) |
| A user’s account | Until the account is deleted or removed from its last workspace: name, e-mail and photo are then erased; what the person created stays with the workspace, signed “Former member”. |
| All workspace data | An admin can export it at any time (Configuration → Data); deleted at the latest 90 days after the contract ends. |
| Technical error log | 90 days |
| Invoices | 10 years (legal obligation) |
| Push notification subscriptions | Until they are switched off or expire |
| Cookies | See the cookie policy |
7. Security
Encrypted connections (HTTPS), each workspace’s data kept separate in the database, two-factor authentication for managers, role-based access, access log. Kip support only enters a workspace when that workspace allows it, and every access is logged. In the event of a data breach, Kip informs the Customer and, where required, the CNIL within the GDPR deadlines.
8. Your rights
You can ask for access to your data, its rectification, erasure, restriction of processing or portability, object to processing based on legitimate interest, and give instructions on what happens to it after your death. Write to contact@hostelanalytics.fr; we answer within one month. For team data, we pass the request on to your employer and help them answer.
You can also lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr), or with the authority of your country.