Privacy Policy

Last updated: May 22, 2026

1. Data Controller

Data controller: Cyril Pereira, sole trader, 173 rue de Courcelles, 75017 Paris, France. SIRET: 482 287 166 00029. Contact: contact@podkstr.com. For GDPR requests: dpo@podkstr.com.

2. Data Collected and Purposes

We collect and process your personal data on the following legal bases:

  • Account data (name, email, hashed password). Legal basis: contract performance. Retention: for the life of the account, then 30 days after deletion.
  • Google OAuth authentication (Google ID, email, name, avatar). Legal basis: consent. Retention: for the life of the account.
  • Audio files (recordings, imports, exports). Legal basis: contract performance. Retention: for the life of the account.
  • Payment data, handled by Stripe. We store no card numbers. Legal basis: contract performance. Retention: 10 years, to meet accounting obligations.
  • Analytics data (pages visited, features used, user ID). Legal basis: legitimate interest. Retention: 12 months.
  • Application logs (IP address, user-agent, timestamps). Legal basis: legitimate interest in security. Retention: 90 days.

3. Optional AI Processing

AI processing features (echo removal, transcription, post-production) are triggered only by explicit user action, which constitutes explicit consent. Your audio files are transmitted to AI subprocessors only during these actions.

  • Transcription and post-production: Deepgram Inc. (USA), covered by the EU-US Data Privacy Framework.

4. Subprocessors

We use the following subprocessors to provide our services. Each has a signed Data Processing Agreement (DPA):

  • Netcup GmbH (Germany, EU): server hosting.
  • Cloudflare Inc.: CDN, DNS, and R2 storage, EU region.
  • Stripe Inc. (Ireland, EU): payments.
  • Mailjet SAS (France, EU): transactional emails.
  • PostHog Inc. (USA): product analytics, EU-US Data Privacy Framework.
  • Deepgram Inc. (USA): AI transcription, EU-US Data Privacy Framework.

5. Transfers Outside the EU

Some data is transferred to the United States to subprocessors certified under the EU-US Data Privacy Framework (DPF): Deepgram (audio transcription) and PostHog (analytics). These transfers are governed by the European Commission's adequacy decision of July 10, 2023. Audio rendering runs on Cloudflare, whose infrastructure may process the job in the United Kingdom. That transfer is governed by the European Commission's UK adequacy decision of 28 June 2023. No data is transferred to third countries without appropriate safeguards.

6. Your Rights (GDPR Articles 15-22)

Under the General Data Protection Regulation, you have the following rights which you can exercise at any time by contacting us at contact@podkstr.com:

  • Right of access: obtain a copy of your personal data
  • Right to rectification: correct inaccurate data
  • Right to erasure: request deletion of your data and account
  • Right to data portability: receive your data in a structured format (JSON)
  • Right to object: object to the processing of your data
  • Right to restriction: temporarily restrict processing
  • Right to withdraw consent: withdraw your consent at any time without affecting the lawfulness of prior processing
  • Right to lodge a complaint: file a complaint with the CNIL (www.cnil.fr) or your local data protection authority

7. Cookies and Trackers

On the landing site (podkstr.com) we use PostHog in cookieless mode. No cookie is set in your browser, and we use no fingerprinting and no advertising trackers. We use no advertising cookies and no third-party trackers for targeting: no Facebook pixel, no Google Ads, and no sale or sharing of data for advertising purposes. You can block or delete cookies from your browser settings (Chrome, Firefox, Safari, Edge). Blocking the BEARER cookie prevents login to the application. In the application (podkstr.app), once you are signed in, the following cookies and local storage entries are used:

  • BEARER (authentication / session): technical cookie, 7 days. Strictly necessary for login.
  • podcaster-lng: language preference, 1 year. Functional cookie.
  • podcaster-theme: light or dark theme preference, 1 year. Functional cookie.
  • ph_* (PostHog): session identifier tied to your account, 12 months. Internal product analytics, never shared with third parties.

8. Data Security

Your data is encrypted in transit and at rest, and passwords are hashed. We implement the technical and organizational measures appropriate under GDPR Article 32.

9. Invited Participants (Studio Recording)

When you invite a participant to a recording studio, they are informed that the session may be recorded. Their consent is obtained before joining. The studio host is responsible for informing their guests about how the recording will be used.

10. Contact

For any questions about this policy or to exercise your rights, contact us at: contact@podkstr.com. You can also file a complaint with the French Data Protection Authority (CNIL), 3 place de Fontenoy, 75007 Paris, France.