Privacy policy

Last updated: 18 September 2026

Controller

KIPDEV SAS, 4 rue des Frênes, 33700 Mérignac, France — contact@allergen-matrix.com.

What we collect, why, and for how long

Email form (if you use it): your address, the page it came from, the date and the exact text you agreed to. Purpose: send what you asked for and at most 2 follow-up messages. Legal basis: consent. Kept until you unsubscribe, and no longer than 3 years after our last contact.
Purchases: email, product, amount, Stripe payment reference. Purpose: give you access and keep proof of the sale. Legal basis: contract; accounting records are kept for 10 years (legal obligation). Payments are processed by Stripe; your card details never reach our servers.
Unfinished payment: if you enter your email on the payment page and do not complete the payment, we may send a single reminder with a link to resume the order. Legal basis: legitimate interest; you can object by replying to it.
Subscriber area: your email, a one-time sign-in link (valid 20 minutes) and a session cookie (30 days). Your subscription status is read from Stripe. Legal basis: contract.
The matrix you build without an account: Dishes, ingredients and ticks stay in your browser (local storage) and are never sent to us, unless you ask for the PDF by email: the matrix is then sent to our server once to make the PDF, emailed, and not kept. We keep the email address, the date, the number of dishes and the business type you chose, to count requests and prevent abuse (12 months).
Pro workspace: Your sites, matrices, published versions (with the name of the person who signed them off), label settings and the public menu page you choose to publish. Purpose: provide the service and keep the history you rely on for inspections. Legal basis: contract. Kept while you subscribe, then 12 months after the end of the subscription so you can export it, then deleted.
Business evidence at checkout: Business name, and your VAT number or another proof that you buy as a business (Companies House number, food business registration or website). Purpose: sell to businesses only and apply the right VAT treatment. Legal basis: legal obligation (tax records, kept 10 years).
Audience measurement (kipstats, operated by KIPDEV SAS): pages viewed, referrer and funnel events (clicks, checkout started, purchase). No cookie. Your IP address is not stored: only the country and city derived from it, and a fingerprint hashed with a salt renewed every day. Legal basis: legitimate interest.

Recipients and processors

Cloudflare, Inc. (United States): hosting of the pages and of the database.
Stripe: payment processing.
Resend, Inc. (United States): delivery of emails, through the mail gateway operated by KIPDEV SAS.

Transfers outside the European Union rely on the safeguards provided by the GDPR (EU-US Data Privacy Framework or standard contractual clauses). Your data is never sold.

Cookies and local storage

This site sets no advertising or analytics cookie, which is why it shows no consent banner. What may be stored on your device is limited to:

__Host-sid — cookie set only if you sign in to the subscriber area; 30 days; strictly necessary.
socle-acces:* (local storage) — keeps your access after a purchase; strictly necessary.
am-matrice (local storage) — the matrix you are building, so it is still there when you come back; delete it with the “Start again” button.
am-etiquette (local storage) — the last label you designed without an account.
kp-emis:* (local storage) — prevents counting the same purchase twice in audience measurement; contains no personal data.
kp_ignore (local storage) — only if you ask to be excluded from audience measurement.

The payment page is hosted by Stripe (checkout.stripe.com), which applies its own cookie policy.

Your rights

You can access, correct, delete, restrict, object to the processing of, and port your data, and withdraw your consent at any time (the unsubscribe link in every email works in one click). Write to contact@allergen-matrix.com. You may lodge a complaint with the CNIL (cnil.fr) or with your local data protection authority.