Privacy policy

Data controller

KRAKEN HOLDING, 450 avenue de Saint-Philippe, 06410 Biot, France. contact@krakenshield.eu

Browsing the website

The website uses no analytics or advertising cookies (the audience measurement described below works without cookies). A language preference cookie (ks_lang, 12 months) is set only if you choose a language; the client area uses a session cookie, required to sign in. Fonts and assets are served from our own servers: your visit sends no data to third parties.

Our hosting provider keeps technical logs (IP address, date, requested page), required for security and proper operation, for a limited period.

Browser local storage

Some features of the website keep small pieces of information in your browser’s local storage (localStorage and sessionStorage). They stay on your device, are used neither for audience measurement nor for advertising and are specific to each browser: nothing is shared between your computer and your phone.

• kc_guide_read: chapters of the A to Z guide read down to “Key takeaways”, to show “Read” in the table of contents.
• kc_quiz: Cyber Quiz progress (scores, medals, nickname, zen mode).
• ks-messages: references of your conversations with Belinda or Nestor (20 at most), to find them again when you come back.
• ks_signed_in: tells whether a session is open, to adapt the display without asking the server.
• ks_no_audience: your objection to audience measurement, if you expressed it.
• ks_admin_journal: layout chosen for the administration log (KrakenShield team).
• ks_academy_token, ks_academy_exam, ks_academy_preview (sessionStorage, cleared when the tab closes): Cyber Academy access link and exam in progress, to resume after a reload.
• This information is strictly necessary for the features you use and therefore requires no consent. You can erase it at any time by clearing the website’s data in your browser settings; private browsing does not keep it.

Audience measurement

• Data: pages viewed, site or campaign you came from (referring domain, utm parameters), country derived from the IP address, summarized device type, browser and system, language, time spent and scrolling, actions on the site (sign-up buttons, steps and errors of the sign-up form, never the values typed, opening the chat or the contact form, videos played).
• No cookie and no identifier stored in your browser: your visit is recognized by a non-reversible fingerprint of your IP address and browser, computed with a key destroyed every night. The IP address is not kept and never leaves our servers (the country comes from a local database); no third party receives this data and it is never matched with other websites.
• Purpose: traffic statistics and improving the website, for our sole use. If you create an account, the visit during which you created it is linked to it (source and journey), to measure what leads to signing up.
• Legal basis: legitimate interest in measuring our website audience (Art. 6.1.f GDPR), within the conditions of the French CNIL consent exemption for audience measurement.
• Retention: 13 months.
• Objection: browsers sending the Global Privacy Control or Do Not Track signal are not measured. You can also opt out from this browser: Stop measuring my visits

Customer account

• Data: name, work email, password (stored only as an argon2id hash), company name, country, VAT number, two-factor authentication settings (encrypted secret).
• Purpose: creating and securing your account, sending the emails the service requires (address confirmation, password reset, security alerts, one-off reminders: expiring Kredits, first domain to verify, messages from the KrakenShield team).
• Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
• Retention: for the lifetime of the account, then 3 years after it is closed.

Kredit purchases

• Data: buying account and organization, billing name and address, VAT number, pack purchased, amount, payment and invoice references. Your card details are entered on Stripe’s payment page: KrakenShield never has access to them.
• Purpose: collecting the payment, crediting your Kredits, issuing the invoice and keeping our accounts.
• Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and legal accounting and tax obligations (Art. 6(1)(c)).
• Provider: Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland) processes the payment and issues the invoice; it acts as an independent controller for payment data, under its privacy policy.
• Retention: 10 years for invoices and accounting records (Article L123-22 of the French Commercial Code).

Security log and activity tracking

• Data: sign-ins to the customer area, successful or refused (date, account or identifier typed, IP address, summarized browser and system, use of two-factor authentication), sign-outs, password and two-factor changes; for signed-in accounts, Cyber A to Z chapters and Cyber Quiz levels completed (score, medal). A visitor who is not signed in sends no progress.
• Purpose: protecting accounts (detecting intrusion attempts), providing support and following how the service is used.
• Legal basis: legitimate interest in securing and improving the service (Art. 6(1)(f) GDPR).
• Retention: IP addresses, typed identifiers and browsers erased after 90 days; events deleted after 13 months.

Domains, ownership proofs and authorization mandates

• Data: declared domains, proof of control (method, date), acceptance of the terms and of the authorization-to-test mandates (account, date, IP address, browser, fingerprint of the accepted text).
• Purpose: testing only systems you are entitled to have tested, and being able to demonstrate it.
• Legal basis: performance of the contract and legitimate interest in proving the authorization received (Art. 6(1)(b) and 6(1)(f) GDPR).
• Retention: 6 years after acceptance (limitation period), including after the domain or the account is deleted.

Contact form

• Data: a visitor’s name, email, organization (optional), country and message; for a signed-in account, the account details (name, email, organization, country, role, account security status, Kredit balance); the page the message is sent from.
• Purpose: answer you. The message reaches us by email at contact@krakenshield.eu; nothing else is ever sent to your address.
• Legal basis: pre-contractual steps or performance of the contract (art. 6.1.b GDPR); legitimate interest in answering requests (art. 6.1.f).
• Retention: 3 years from the last exchange.

Former demo requests

Demo requests received before online sign-up opened are kept for 3 years from the last contact, in order to answer them.

Virtual assistant (Belinda and Nestor) and Messages

Belinda and Nestor are AI-generated characters: answers in Messages are written by artificial intelligence, except those marked “Done, the Boss has sent the answer”, written by a person from our team.

• Data: the messages you write in Messages and the answers you receive, the page of the site you are on, the language; for a signed-in account, the link between the chat and the account. Your name and email address are never sent to the AI.
• Purpose: answer your questions (offer, account, support, cybersecurity) and, when the AI cannot answer, pass your question on to our team, who answers you in the same chat.
• Legal basis: pre-contractual steps or performance of the contract (art. 6.1.b GDPR); legitimate interest in informing a visitor who is not signed in (art. 6.1.f).
• Processor: answers are generated by Mistral AI (Paris), a European operator whose servers are in the European Union. Your messages do not leave the EU; Mistral AI does not use them to train its models and deletes them within 30 days.
• What never leaves KrakenShield: your domains, audit results, vulnerabilities, analysed code and reports are never sent to the AI provider and stay hosted in the European Union. Only the text you write in Messages is sent to it: do not paste vulnerability details, passwords or personal data there.
• Retention at KrakenShield: 90 days after the last message of the chat.

Recipients and location

Your data is accessible only to KRAKEN HOLDING staff and to our processors, all of them European: our hosting provider (IONOS), our artificial intelligence provider (Mistral AI) and our email provider (Brevo). It is hosted in the European Union and is never sold.

Kredit payments are processed by Stripe, as described under “Kredit purchases”.

Security

Traffic with the website is encrypted (HTTPS) and access to data is restricted to authorized people.

Your rights

You have the right to access, rectify, erase, restrict, object to and port your data, and to set instructions regarding your data after your death. To exercise them: contact@krakenshield.eu.

You may lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr).

KrakenShield platform

Data processed in the console (targets, analysis results) will be covered by dedicated contractual terms and a data processing agreement (DPA).