Privacy Policy
Last updated: September 6, 2026
Article 1. Purpose and Scope
The purpose of this Privacy Policy is to inform users of the website and of the digital services offered by KADA & Associates, including the artificial intelligence solution Alim, of the conditions under which their personal data are collected, used, stored and protected.
KADA & Associates attaches particular importance to the confidentiality of the information entrusted to it and ensures that its processing complies with the provisions of Regulation (EU) 2016/679 of 27 April 2016, known as the General Data Protection Regulation (GDPR), as well as those of the amended French Data Protection Act (loi Informatique et Libertés) of 6 January 1978.
This Policy applies to any person accessing the website, using the features of Alim or holding a user account.
Article 2. Data Controller
KADA & Associates is the controller of the personal data processing operations carried out in connection with the operation of the website and the provision of its services, save for processing operations for which a service provider acts as an independent controller.
Any request relating to the protection of personal data may be sent to:
This address is the dedicated point of contact for questions relating to privacy and to the exercise of data subjects' rights.
Article 3. Categories of Data Processed
In the course of its digital activities, KADA & Associates may process the following categories of data.
3.1. Identification and Authentication Data
When a user creates an account, their email address is collected in order to identify and authenticate them by means of a secure sign-in link, known as a "magic link".
This address is also associated with the account in order to ensure its operation and continuity.
3.2. Data Relating to Interactions with Alim
The use of Alim involves the processing of the messages submitted by the user and of the responses generated by the artificial intelligence system.
For authenticated users, these exchanges may be stored in order to allow the conversation history to be consulted and to ensure continuity of the user experience.
For unauthenticated users, exchanges are not stored in an account history and are processed for the time necessary to produce the response, subject to the technical operations essential to the operation and security of the service.
3.3. Optional Contextual Information
Users may voluntarily enrich their requests by providing information relating in particular to their professional capacity, their business sector, their general geographic location, the size of their organisation or any other useful detail.
This information is stored temporarily in the browser's session storage (sessionStorage).
It is not stored in any KADA & Associates database and is normally deleted from this storage when the relevant tab or browsing session is closed.
Where it is included in a request submitted to Alim, it may nevertheless be transmitted to the technical systems required to generate the response.
3.4. Browsing Preferences
Certain strictly functional preferences, such as the choice to temporarily stop displaying an invitation to install the application, may be stored locally in the browser.
This preference is kept for a maximum period of fourteen days.
3.5. Technical Data
In order to ensure the operation, availability and security of the website, certain technical information may be processed, including IP addresses, connection logs, information relating to requests and the technical events required to detect anomalies or security incidents.
Article 4. Purposes and Legal Bases
Personal data are processed for specified, explicit and legitimate purposes.
| Purpose | Legal basis |
|---|---|
| Account creation and authentication | Legal basisPerformance of the contract or of pre-contractual measures |
| Provision of the responses generated by Alim | Legal basisPerformance of the contract or of pre-contractual measures |
| Storage and consultation of the conversation history | Legal basisPerformance of the contract |
| Taking into account optionally provided context | Legal basisPerformance of the service requested by the user |
| Management of functional preferences | Legal basisLegitimate interest in improving the user experience |
| Security, abuse prevention and maintenance of technical operation | Legal basisLegitimate interest in the security of the services |
| Compliance with applicable legal obligations | Legal basisLegal obligation |
| Payments, subscriptions, invoices and accounting | Legal basisPerformance of the contract and legal obligations (accounting records) |
| Attributing a sale to the associate whose code was used | Legal basisLegitimate interest (compensation of the associate network) |
KADA & Associates undertakes not to use personal data for purposes incompatible with those for which they were collected, except under the conditions permitted by applicable regulations.
Article 5. Use of Artificial Intelligence
Alim relies on automated language processing technologies that analyse users' requests and produce appropriate responses.
To enable this, the information provided in conversations may be transmitted to technical service providers specialising in artificial intelligence models.
Such transmissions are limited to the information necessary to provide the service concerned.
Users are invited to exercise discretion when providing confidential information, personal data relating to third parties or information of a particularly sensitive nature.
KADA & Associates endeavours to integrate the protection of personal data into the design and development of its digital services.
Article 6. Recipients of the Data
Personal data may be accessible, within the limits of their respective responsibilities, to:
- Authorised persons acting on behalf of KADA & Associates;
- Service providers responsible for hosting, authentication and data storage;
- Providers of the artificial intelligence technologies required for the operation of Alim;
- Technical service providers involved in the maintenance and security of the service;
- The payment provider Stripe (Stripe Payments Europe, Ltd., Ireland), which processes payment data (card, billing address) to carry out the payment and, on its own behalf, for fraud prevention and its legal obligations; KADA & Associates never has access to the full card number;
- The ConcordIA and Altrust applications, for organisations that subscribe to these options: organisation name, email addresses of its administrators and team members, rights granted and their end date;
- Administrative or judicial authorities, where disclosure is required by law.
Where these service providers act as processors within the meaning of the GDPR, their services must be governed by appropriate contractual commitments, in particular with regard to confidentiality, security and purpose limitation.
KADA & Associates does not sell users' personal data to advertisers.
Article 7. Retention Periods
Personal data are kept for a period proportionate to the purposes for which they were collected.
Data relating to the user account and the conversation history are kept for as long as the account remains active.
When an account is closed, the associated data are intended to be deleted or anonymised, subject to legal retention obligations and to duly justified technical or litigation requirements.
Contextual information stored in the browser's session storage is kept for the duration of the session concerned, in accordance with the browser's technical settings.
Preferences relating to the display of the installation invitation are kept for fourteen days.
Technical logs are kept for a limited period, determined according to security and maintenance requirements and applicable legal obligations.
Billing data and accounting records (payments, invoices) are kept for ten years, in accordance with article L123-22 of the French Commercial Code, including after the account is closed, when they are no longer linked to it.
Article 8. Cookies and Local Storage Technologies
The website uses technologies that are strictly necessary for its operation, in particular the mechanisms used to maintain an authenticated session.
It may also use the browser's local storage features to temporarily remember certain preferences or contextual information.
Cookies and other trackers that are strictly necessary for the provision of a service expressly requested by the user may be exempt from prior consent, in accordance with applicable regulations.
As of the date on which this Policy was last updated, the website does not use advertising cookies or audience measurement trackers.
When a visitor arrives through an associate's link, the discount code of that link is kept for the visit in the browser's session storage, then linked to their account as soon as they sign in or sign up, so the requested discount is applied at payment. With their consent, the code is also kept in a site cookie for 90 days. The embedded payment form, provided by Stripe, sets its own cookies needed for payment security and fraud prevention.
The only cookie that requires your consent keeps an associate's discount code for 90 days. The banner shown on your first visit lets you accept or decline it just as easily; this choice is kept for six months and can be changed at any time from the "Manage cookies" link in the footer.
Article 9. Security and Confidentiality
KADA & Associates endeavours to implement technical and organisational measures appropriate to the risks presented by the processing of personal data.
These measures are intended in particular to preserve the confidentiality, integrity and availability of the information processed, to limit unauthorised access and to prevent security incidents.
Particular attention is paid to protective measures in connection with services that use artificial intelligence.
However, no computer system or data transmission mechanism can guarantee absolute security.
Article 10. International Data Transfers
The operation of digital services and artificial intelligence technologies may involve service providers established outside the European Economic Area.
Where personal data are transferred internationally, the transfer must be carried out in accordance with the provisions of Chapter V of the GDPR.
Depending on the circumstances, the applicable safeguards may in particular be based on an adequacy decision of the European Commission or on standard contractual clauses, supplemented, where necessary, by appropriate additional measures.
Users may request information on the safeguards applicable to transfers concerning them by writing to the dedicated data protection contact address.
Article 11. Data Subjects' Rights
In accordance with the provisions of the GDPR and the French Data Protection Act, users have the following rights, under the conditions laid down by law:
- Right of access: to obtain confirmation as to whether processing is taking place and to access the personal data concerning them.
- Right to rectification: to request the correction of inaccurate or incomplete data.
- Right to erasure: to request the deletion of their data where the legal conditions are met.
- Right to restriction: to request the suspension of certain processing operations in the situations provided for by the regulations.
- Right to object: to object, on grounds relating to their particular situation, to processing based on legitimate interest.
- Right to data portability: to receive certain data in a structured, commonly used and machine-readable format, where the legal conditions are met.
- Right to withdraw consent: to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing.
These rights may be exercised by sending a request to:
KADA & Associates responds to requests within the time limits laid down by applicable regulations, in principle within one month of receipt, subject to any extensions permitted by law.
In the event of any difficulty relating to the processing of their personal data, users may also lodge a complaint with the French Data Protection Authority (Commission nationale de l'informatique et des libertés, CNIL), at www.cnil.fr.
Article 12. Changes to this Privacy Policy
KADA & Associates reserves the right to amend this Policy to reflect changes in its services, its technical practices or the applicable legislative and regulatory framework.
The version in force is the one published on the website, together with the date on which it was last updated.
In the event of a substantial change affecting the conditions under which personal data are processed, users will be informed by appropriate means where required by the regulations.
Article 13. Contact
For any question relating to this Policy, to the confidentiality of information or to the exercise of data protection rights, users may contact KADA & Associates at the following address: