Snapshot 259116
Normalized text
Scripts and page chrome removed; this is what change detection compares.
1. Who is responsible for what Klibon is operated by Uneed Platform, 20 rue du calvaire de grillaud, 44100 Nantes, France, which also operates Uneed (uneed.best). Data moving between Klibon and Uneed stays with the same company. Uneed Platform is the data controller for account data — your email, your profile, your programs and your statements — and for the recruiting data described below. For visitors to a merchant's website, the relationship is different. The _klb cookie is a first-party cookie set on the merchant's own domain, on pages the merchant serves. The merchant is the controller for it and is responsible for declaring it in their cookie notice and obtaining consent where consent is required. Klibon acts as their processor for that data. 2. What we collect From account holders Email address, and a display name if you provide one. Sign-in sessions (a session token, its expiry, the IP and user agent that created it). Your selected payout method and encrypted payment destination, revealed only to you and merchants who owe you a statement. If you use managed payouts: for a merchant, the identifier of your Stripe customer and the brand, last four digits and expiry of the card you saved; for an affiliate, the identifier of your Stripe account, its country, and whether Stripe currently allows it to be paid. The card number, identity documents, tax details and bank account you give during those setups go to Stripe and never reach Klibon. A record of each managed payout: what was charged, what was transferred, to whom and when. Subscription state mirrored from Creem. We never see or store card details. When you start a merchant program, we send you a short series of onboarding emails about finishing its setup and finding your first affiliates, for up to 60 days. To time them, our email provider receives your name, your email address, your program's name and links, and how far its setup has gone (which checks pass, whether it is live, how many affiliates and sales it has). Every one of these emails has a link to stop them. From visitors who click a tracked link The referral code, the destination, and the time of the click. A salted hash of the IP address and of the user agent — never the values themselves. They are used to deduplicate repeated clicks and flag fraud, and cannot be reversed back to an IP address. The referring page and the country derived from the request. From people who ask for a listing to be removed What you type in the form, and the email address you give us with the request. A salted hash of your IP address, used only to limit abuse of that public form. Never the address itself. From payment processors Payment amount, currency, type (sale, renewal, refund) and a customer identifier. Which product was bought, so the right commission rate applies. A salted hash of the customer's email address, used to detect self-referral. We do not store the address itself. If the merchant supplies a read-only API key: the names and prices of the products they sell. For Stripe, the key can also be how Klibon receives the payments above: it then reads the merchant's sale, renewal and refund events, and the checkout of a one-off sale to see which product was bought. Stripe's permissions let such a key read other events on the merchant's account too; Klibon does not request them. A merchant who prefers not to grant that access can send the same events by webhook instead. From creators we may invite to an affiliate program Klibon helps merchants find people who could promote their product. To do that it reads public information, and only that: Pages that link to software products: the page's address and title, the text around the link, and an estimate of the site's traffic. The contact details a site publishes on its own pages (an email address, a contact form, an X or LinkedIn profile). We never guess an address. For makers who list a product on Uneed: their public Uneed profile and products (bio, public links, followers, category, tags and Domain Rating). Their email address stays with Uneed until an invitation is actually sent; Klibon then keeps it on that one invitation, so that joining from it is recognised. An AI model judges from that information whether a program could interest someone, and writes the first message, which a person at Klibon reviews before anything is sent. The legal basis is our legitimate interest, and the interest of the person contacted, in hearing about a program related to what they already publish or build. Every message carries a way to stop them. Anyone who unsubscribes or asks to be erased stays on a suppression list so they are never contacted again: an email address as a hash with a masked hint (j***@site.com), a site or an account by its name. 3. Cookies we set on klibon.com A session cookie, so you stay signed in. Strictly necessary. A short-lived cookie remembering where you were headed before signing in. A short-lived cookie carrying an Uneed product identifier, when you arrive through "Continue with Uneed", so we can pre-fill your product. We use OpenPanel for privacy-friendly analytics on our own site. It sets no advertising cookies and builds no cross-site profile. 4. Who we share with Merchants — an affiliate's email address and profile, once they join or ask to join the merchant's program, and their payment details when a statement is due. Creem — our merchant of record for subscription billing. Stripe — only if you use managed payouts. Stripe charges the merchant, verifies the affiliate and pays them. It receives your email address and what it collects from you directly, and handles that data as an independent controller under its own privacy policy. Kula — email delivery: account and transactional emails, and merchant onboarding emails. Anthropic — the AI model that judges recruiting prospects and drafts messages, from the public information above. DataForSEO — finding public pages that link to a product, and estimating their traffic. For recruiting — a merchant whose cold campaign you are part of receives your name, site and the contact details published on it, to write to you from its own mailbox. A maker invited through Uneed is written to by Uneed, and the merchant never receives their address; a merchant sees anyone only once they join or ask to join its program. Supabase — database hosting, in the European Union. Cloudflare and our hosting provider — serving the application. We do not sell personal data, and we do not share it for advertising. 5. How long we keep it Account data is kept while your account exists, then deleted within 30 days of a deletion request — except records we must retain for accounting purposes. Click records are kept for 24 months; the hashes they contain are not reversible in any case. Raw payment events are kept for the life of the program so commissions can be audited and recomputed. Records of managed payouts are financial records and are kept for the period accounting and tax law require, including after an account is closed. Recruiting data about a creator is kept until they ask us to stop contacting them or to erase it; an erasure removes the pages, contacts and messages we hold about them, and leaves only the suppression entry that keeps them off our lists. 6. Your rights If you are in the EU, UK or a jurisdiction with comparable law, you may request access to your data, its correction, its deletion, or a portable copy, and you may object to processing. Write to [email protected] — we respond within 30 days. You also have the right to complain to your local supervisory authority. 7. Security Payment-processor credentials — signing secrets and any read-only API key — are encrypted at rest with AES-256-GCM and are never returned to a browser. Personal identifiers used only for comparison are stored as salted hashes. Traffic is served over TLS. Access to the production database is limited to the operator. 8. Contact Questions about this policy: [email protected].