Privacy Policy

The data controller is Florian Lepage (FLORIAN LEPAGE KYN STUDIO). For any privacy request: contact@kynstudio.com.

Through the contact form we collect your name and email address, and — where you choose to provide them — your phone number, project details, message, and the email addresses of any guests you add to a meeting invitation. If you book an intro call, we also process your chosen date and time. We do not collect any special-category (sensitive) data.

We use this data solely to respond to your enquiry and to organise a requested intro call or meeting. The legal basis is your consent and the taking of steps at your request prior to entering into a contract (Article 6(1)(a) and (b) GDPR).

Your data is only accessible to KYN Studio. It is processed on our behalf by the following sub-processors: Amazon Web Services (static website hosting and content delivery) and Google (Google Calendar / Google Meet) when you book a call. We never sell or rent your personal data.

Contact and booking data is kept for the time needed to handle your request and our business relationship, and for at most 3 years from our last contact, after which it is deleted or anonymised.

To prevent duplicate contact inquiries, the form retains a random inquiry identifier, creation time and analytics-eligibility flag in session storage under kyn-contact-attempt. It does not save form contents there. The contact service stores retry and notification status, timestamps and an inquiry-specific digest in DynamoDB in AWS Paris. Original names, email addresses and messages are not stored in this metadata table. The digest and identifier are pseudonymous operational data. Attempts expire after seven days; AWS automatically removes expired records afterward, which can take additional days. Analytics still requires consent and receives neither the identifier nor the digest.

With your consent, KYN Studio uses PostHog, configured for its European region, to measure visits to public pages, selected interactions, contact inquiry outcomes and page performance (LCP, INP, CLS and FCP). Analytics starts only after acceptance. You can refuse or withdraw consent at any time using “Privacy preferences”. Withdrawal stops new captures and discards pending analytics batches and retries; a request already sent cannot be recalled. PostHog uses pseudonymous browser and session identifiers, local storage and cookies; the SDK cookie lifetime is configured to 365 days. We measure public page paths, the active site language, interaction identifiers, section visibility, scroll depth, article engagement and completion, form starts and confirmed submission outcomes, and page exits. Article engagement requires 30 seconds of active reading; hidden, unfocused or inactive periods do not count. Visibility does not prove reading. We do not send form values, names, email addresses, phone numbers or clicked email and phone destinations to analytics. Query strings, URL fragments, referrers, page titles and raw errors are excluded from event properties. Session recording, heatmaps, automatic interaction capture and named visitor identification are disabled. Requests necessarily reach the service with technical network information such as an IP address and browser headers. Analytics event and server-log retention are separate from browser cookie expiry; contact contact@kynstudio.com for information about the applicable service settings.

The browser stores your analytics choice in local storage under kyn-analytics-consent (accepted or rejected), shared across both languages, with no programmed expiry; it remains until changed or browser storage is cleared. The previous kyn-privacy-ack acknowledgement may remain in storage but is neither read nor treated as consent. If local storage is unavailable, analytics remains disabled. The contact form can read an existing kyn-cur currency cookie; this static site does not set it and otherwise derives currency from the browser locale. Its origin and expiry, if present, require confirmation. Embedded project websites and the separate client application have their own privacy practices.

Under the GDPR you have the right to access, rectify, erase, restrict and object to the processing of your data, and the right to data portability. You may exercise these rights at any time by emailing contact@kynstudio.com. You also have the right to lodge a complaint with the CNIL (cnil.fr).

We apply appropriate technical and organisational measures to protect your data. AWS content delivery infrastructure and Google services may process technical or meeting data outside the European Union. PostHog is configured for its European region. This configuration does not by itself guarantee that no provider processes technical data outside the European Union. Contact contact@kynstudio.com for details of applicable recipients, retention and contractual transfer safeguards.