1. Data controller
Obsidev
2 rue de la Paix, 75002 Paris, France
Contact for any privacy question or request: kat.multiply147@passinbox.com.
2. Data, purposes and legal bases
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email, technical identifier, hashed password, creation date | Create, secure and administer your account | Performance of the requested service | Lifetime of the account |
| Display name, avatar and links you add | Display your public profile | Performance of the requested service | Lifetime of the account or earlier removal |
| Setups, equipment, pictures, dates, reviews, ratings, favourites and collections | Publish and organise your content and provide community features | Performance of the requested service | Lifetime of the account or earlier deletion |
| Reports and moderation decisions | Prevent abuse and enforce service rules | Legitimate interest in securing and moderating the service | Pending reports: no more than 730 days; resolved cases: 365 days |
| IP address temporarily used by the rate limiter | Prevent automated attacks and abuse | Legitimate interest in securing the service | Not deliberately persisted by the application; maximum control window of one hour |
| Technical logs (internal identifiers, errors, security events and connection data processed by the host) | Diagnose incidents and protect the service | Legitimate interest in maintaining a reliable and secure service | No more than 30 days |
Required fields are necessary to create the account or publish the requested content. Optional social links, dates, notes, captions and pictures may be omitted.
3. Visibility and recipients
Your email and authentication information are never displayed publicly. Your display name, avatar, profile links and published content are public and may be indexed by search engines. Favourites and collections remain private.
Data is accessible to authorised personnel of Obsidev, hosting provider Railway (Netherlands), and service moderators only when needed.
International transfers: Our hosting provider is located in the Netherlands, a country of the EEA. Data is not transferred outside the EEA.
We do not sell personal data. We perform no profiling or automated decision-making that produces legal effects.
4. Cookies and local storage
KitAndTell currently uses no advertising or audience-measurement trackers, so no consent banner is displayed.
- the authentication cookie maintains your session and expires after at most 14 days when “remember me” is used;
- the anti-forgery cookie protects forms and ends with the session;
- the language cookie stores your choice for one year;
- browser local storage contains only your light or dark theme until you clear it.
These mechanisms are strictly necessary for the service or an interface preference you request. Any optional tracker added later must remain disabled until you consent.
5. Your rights
You can access and rectify your data, download a structured copy and delete your account from your account area. You may also request erasure or restriction, or object to legitimate-interest processing, by emailing kat.multiply147@passinbox.com.
We normally respond within one month, after verifying your identity where necessary. You may lodge a complaint with the CNIL.
6. Deletion, backups and security
Deleting your account immediately removes the related profile, content, images, reviews, ratings, favourites, collections and reports from the active database. Residual copies may remain in encrypted backups for no more than 30 days and are not restored to production except for disaster recovery.
Production traffic uses HTTPS. Passwords are hashed, cookies are secure and unavailable to JavaScript, data-protection keys are stored in a controlled manner, and write access is restricted.