Privacy Policy

1. Who is responsible for your data?

The data controller is L'OURS DU MARKETING, a French SASU (single-shareholder simplified joint-stock company) with a share capital of €500.00, registered with the Paris Trade and Companies Register (RCS) under number 930 855 929, whose registered office is at 15 rue du Chalet, 75010 Paris, France, publisher of the Kapitaine service (hereinafter “we”). Contact for any question about personal data: contact@kapitaine.com. We have not appointed a data protection officer: all requests concerning your data are handled at this address.

Kapitaine acts in two capacities:

• Data controller for website visitors, for the accounts of agencies and their users, and for the billing of the Kapitaine subscription.
• Processor (Article 28 of the GDPR) for the data that agencies process about their own clients in the application: campaigns, results, creatives, reports, fee invoices, end-client access. The agency remains responsible for this processing and we act only on its instructions. These commitments are set out in the data processing agreement (DPA) provided for by Article 28 of the GDPR, incorporated by reference into the general terms of sale (in French) and provided on request at contact@kapitaine.com.

2. Data processed on the kapitaine.com website

The website is a static showcase. It has no form: if you write to us, you do so by email, and we process your address and the content of your message in order to reply. The website host (Vercel) records technical logs (IP address, date, requested page, browser) that are necessary for the security and proper operation of the service.

The website uses no audience measurement tool, no advertising pixel and no tracking cookie.

3. Data processed in the application

• User accounts: name, email address, password (stored as a hash, never in plain text), two-factor authentication secret (encrypted), role, notification preferences, login dates.
• Sessions and audit log: IP address, browser, sensitive actions performed and, in the case of “log in as”, the real identity of the person acting.
• Connections to ad platforms and tools: access tokens (encrypted with AES-256-GCM), identifiers and names of ad accounts, Business Managers and MCC accounts.
• Advertising performance data: spend, impressions, clicks, conversions and leads aggregated by campaign, ad set and ad.
• Creatives, briefs and brand kits: uploaded or imported files, comments and history.
• Billing: billing details, contracts and invoices, both for the Kapitaine subscription and for the fee invoices that agencies issue to their clients.
• Transactional emails: recipient address and deliverability events (sent, bounced).

No custom audience (list of individual customers or prospects) is stored in Kapitaine.

4. Data received from Meta, Google, TikTok, Canva and Google Drive

This data is obtained only when a user voluntarily connects an account, and only within the limits of the permissions they grant.

• Meta (Facebook Login or Business Manager system user token): Facebook user ID and name, list of Business Managers, accessible ad accounts and Pages, campaigns, ad sets, ads, creatives and statistics. Permissions requested: ads_read, ads_management, business_management, pages_show_list, pages_read_engagement. The ads_management permission is used solely to create the ads you publish from Kapitaine, always paused, and to apply the actions you trigger (pause, activation, renaming).
• Google Ads (OAuth): accessible accounts, including through a manager account (MCC), campaigns and statistics. Kapitaine currently only reads this data.
• TikTok Ads (TikTok for Business OAuth): identifiers and information of the authorized advertiser accounts (name, currency, time zone), campaigns, ad groups, ads, their delivery status and statistics. Authorizations requested: advertiser account management, ad management and reporting. Kapitaine currently only reads this data.
• Google Drive (read-only): the images and videos you choose to import into a client's library.
• Canva (read-only): the designs you choose to export as PNG, and their descriptive information.
• Sign in with Google: name and email address, to identify you.

Limited use. This data is used exclusively to provide the service to the agency that connected it: dashboards, alerts, reports, publishing and creative library. We do not sell it, do not rent it, do not use it for advertising, profiling or building audiences, and share it only with the subprocessors listed below, in order to operate the service. Only authorized members of our team can access it, for support at your request, for the security of the service or to comply with a legal obligation.

Kapitaine's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke this access at any time: by disconnecting the account in Kapitaine, or directly from the settings of the platform concerned (see data deletion).

5. Purposes and legal bases

• Providing the service (accounts, connection to ad platforms, synchronization, dashboards, alerts, reports, publishing, client space, invoices): performance of the contract.
• Securing the service (sessions, two-factor authentication, audit log, abuse prevention): legitimate interest.
• Sending transactional emails (invitations, alerts, report publication): performance of the contract; preferences can be set per user.
• Invoicing and bookkeeping: legal obligation.
• Replying to your messages: legitimate interest (or pre-contractual measures if you are considering subscribing).

6. Retention periods

• User accounts: for the entire life of the account, then deleted together with the agency's workspace.
• Sessions: 12 hours.
• Audit log: 24 months.
• Ad platform access tokens: until the account is disconnected or access is revoked from the ad platform.
• Advertising statistics: 36 months.
• Creatives, briefs and brand kits: until they are deleted by the agency or the client.
• Accounting records (invoices): 10 years, in accordance with the French Commercial Code.
• Transactional email events: 12 months.
• Email exchanges with us: 3 years from the last contact for prospects; for customers, for the duration of the contractual relationship and then 5 years (the ordinary statute of limitations), for evidentiary purposes.
• After the subscription ends: the data in the agency's workspace remains exportable for 30 days, and is then deleted; it disappears from backups within the following 30 days. Permanent deletion can be requested at any time: immediate purge from the database, purge from backups within 30 days.

7. Subprocessors

We use the following providers to operate Kapitaine:

When you connect an ad platform, the data published or read passes through Meta, Google and TikTok, which process it under their own terms and privacy policies.

Artificial intelligence. To suggest a draft report commentary or a client's weekly summary, Kapitaine sends to Anthropic's Claude API only campaign management information: the client's name and industry, campaign names, aggregated figures (spend, leads, costs, rates) and alerts for the period. No prospect or lead data (name, email, phone number) is transmitted. Under its commercial terms, Anthropic does not use this data to train its models. The texts produced are drafts: the agency reviews and approves them before anything is published to its client.

8. Transfers outside the European Union

The database, files and background processing are hosted in the European Union (Amsterdam). Some providers (Vercel Inc., Railway Corporation, Anthropic, PBC) are companies established in the United States; the web interface is served by Vercel's network. Any transfers of personal data to the United States are governed by the European Commission's standard contractual clauses, entered into with these providers as part of their data processing agreements. The transactional email provider, currently being selected, will be hosted in the European Union.

9. Security

Agency isolation at the database level (PostgreSQL Row-Level Security), encrypted tokens, two-factor authentication, audit log, files kept in private storage and served through signed links valid for 5 minutes. Details are on the security and GDPR page.

10. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability of your data, as well as the right to set instructions regarding what happens to it after your death. To exercise them, write to contact@kapitaine.com. We reply within one month, which may be extended by two months for a complex request; proof of identity may be requested if there is any doubt.

If you are the end client of an agency, please contact your agency first, as it is the data controller: we will help it respond to your request. Agency administrators can download a full export of their data (JSON format) at any time from Settings › Data.

You may lodge a complaint with the CNIL, the French data protection authority (cnil.fr), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

11. Cookies

• kapitaine.com website: no audience measurement cookie, no advertising cookie, no third-party tracker. No consent banner is therefore required.
• app.kapitaine.com application: only strictly necessary cookies, in particular the session cookie that keeps you logged in, which are exempt from consent. No third-party tracker is loaded.

Details are in the cookie policy (in French).

12. Changes

We may update this policy, for example when a subprocessor or a feature is added. The date of the latest update appears at the top of the page; in the event of a significant change, agency administrators are notified by email.