Privacy policy

Data controller

The data controller is Konect Group SAS, 8A rue de la Paix, 68120 Richwiller, France. For any question about your data or to exercise your rights: benjamin@krt-app.com.

Data we collect

• Account: name, email address, account type (creator, agency, brand) and password (stored only as a hash, never in clear text).
• Instagram data (if you connect your account): public profile (username, picture, follower count), your posts, stories and their statistics (views, reach, interactions). This data comes from Meta's official API, after your explicit authorisation.
• Technical data: IP address and browser type, for security and abuse prevention.

Legal basis and use of the data

We process your data to perform the contract between us (providing you the service) and on the basis of your consent for the Instagram connection. Your data is used only to display your statistics, calculate how your audience evolves and, where applicable, share those analyses with the agencies or brands you authorise. We never sell your data and never use it for advertising.

Sharing with third parties

Your Instagram data is only shared with the parties you explicitly authorise (for example an agency you grant access to your profile). Our technical subprocessors are our host (OVH, see legal notice) and, where applicable, our email delivery provider. We rely on Meta's API; your use of Instagram remains governed by Meta's terms.

Cookies

Klic only uses strictly necessary cookies to run (a session cookie that keeps you signed in). We use neither advertising cookies nor third-party trackers. These essential cookies do not require consent; a banner tells you about them on your first visit.

Retention period

Content statistics (including stories, which are ephemeral on Instagram) are archived for 60 days from the moment they are imported into Klic, not from their publication date: older content you have just connected therefore stays viewable for sixty days.

Content documenting a campaign you take part in is kept for 3 years: the results of an operation are asked for long after it ends, and Klic is the only record: Instagram archives nothing.

Your YouTube videos stay archived for as long as your channel is linked: they do not disappear from YouTube and keep gathering views.

After those periods, the archived data and images are deleted automatically. Only anonymous totals (number of items, cumulative views and interactions) stay attached to your account, so your overall figures don't drop. When you delete your account, or disconnect your Instagram account, everything is erased immediately.

Your rights

Under the GDPR, you have the right to access, rectify, erase, restrict, object to and port your data. To exercise those rights, write to us at benjamin@krt-app.com. You can also lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.

Deleting your data

You can request the deletion of all your data at any time:

• Disconnect your Instagram account from Settings → Instagram to revoke our access and delete the imported data.
• To delete your entire Klic account and the associated data, write to us at benjamin@krt-app.com from your account address, or through the Contact page. Your request is handled within 30 days.

You can also revoke Klic's access directly from the “Apps and websites” settings of your Instagram/Facebook account. Instagram then notifies us: your data is erased without anything else to do on your side, and the confirmation code Instagram shows you lets you check it on the Data deletion page.

Security

Passwords are hashed (bcrypt) and session tokens are stored as fingerprints, never in clear text. Instagram access tokens are encrypted at rest (AES-256-GCM). Traffic goes over an encrypted connection (HTTPS).

Contact

For any question about your data: benjamin@krt-app.com.