Privacy Policy

Last updated: October 31, 2026

1. Data Controller

Data controller: Cyril Pereira, sole trader, 173 rue de Courcelles, 75017 Paris, France. SIREN: 482 287 166. Contact: contact@podkstr.com. For GDPR requests: contact@podkstr.com.

2. Data Collected and Purposes

We collect and process your personal data on the following legal bases:

  • Account data (name, email, hashed password). Legal basis: contract performance. Retention: for the life of the account, then 30 days after deletion.
  • Google OAuth authentication (Google ID, email, name, avatar). Legal basis: consent. Retention: for the life of the account.
  • Audio files (recordings, imports, exports). Legal basis: contract performance. Retention: for the life of the account.
  • Payment data, handled by Stripe. We store no card numbers. Legal basis: contract performance. Retention: 10 years, to meet accounting obligations.
  • Audience and usage measurement of the application (pages visited, clicks, session recordings), by PostHog, linked to the account: user identifier, email and name. In session recordings, all displayed text is masked and images are excluded; the superadmin, studio, editing and publishing pages are not recorded. Legal basis: consent, collected by a banner in the application and changeable in the account settings. Retention: 12 months, 30 days for session recordings.
  • Application logs (IP address, user-agent, timestamps). Legal basis: legitimate interest in security. Retention: 90 days.
  • Log of consents and security actions (sign-ins, acceptance of the terms, age declaration, recording consents, rights declarations, payment consents, withdrawals, account deletion), with IP address, browser and date. Legal basis: legitimate interest, the proof of the consents given. Retention: the life of the account, then 5 years after its deletion (general limitation period).
  • Required data: the name, e-mail address and password (or Google sign-in) are needed to create the account, and payment data to subscribe; without them, the service or the subscription cannot be provided. Audience measurement is optional.

3. Optional AI Processing

AI processing features (echo removal, transcription, post-production) are triggered only by explicit user action, which constitutes explicit consent. Your audio files are transmitted to AI subprocessors only during these actions.

  • Transcription and post-production: Deepgram Inc. (USA), covered by the EU-US Data Privacy Framework.

4. Subprocessors

We use the following subprocessors to provide our services. Each has a signed Data Processing Agreement (DPA):

  • Netcup GmbH (Germany, EU): server hosting.
  • Cloudflare Inc.: CDN, DNS, and R2 storage, EU region.
  • Stripe Inc. (Ireland, EU): payments.
  • Mailjet SAS (France, EU): transactional emails.
  • PostHog Inc. (USA): product analytics, EU-US Data Privacy Framework.
  • Deepgram Inc. (USA): AI transcription, EU-US Data Privacy Framework.
  • Functional Software Inc. (Sentry), data hosted in Germany (EU): error tracking, with the signed-in user's identifier, email and name.

5. Transfers Outside the EU

Some data is transferred to the United States to subprocessors certified under the EU-US Data Privacy Framework (DPF): Deepgram (audio transcription) and PostHog (analytics). These transfers are governed by the European Commission's adequacy decision of July 10, 2023. Audio rendering runs on Cloudflare, whose infrastructure may process the job in the United Kingdom. That transfer is governed by the European Commission's UK adequacy decision of 28 June 2023. No data is transferred to third countries without appropriate safeguards.

6. Your Rights (GDPR Articles 15-22)

Under the General Data Protection Regulation, you have the following rights which you can exercise at any time by contacting us at contact@podkstr.com:

  • Right of access: obtain a copy of your personal data
  • Right to rectification: correct inaccurate data
  • Right to erasure: delete your account from the account settings, or ask us to
  • Right to data portability: export your data in JSON format from the account settings
  • Right to object: object to the processing of your data
  • Right to restriction: temporarily restrict processing
  • Right to withdraw consent: withdraw your consent at any time without affecting the lawfulness of prior processing
  • Right to lodge a complaint: file a complaint with the CNIL (www.cnil.fr) or your local data protection authority
  • Users residing in Taiwan: you also have the rights set out in article 3 of Taiwan's Personal Data Protection Act (to view your data, obtain a copy, supplement or correct it, stop its collection, processing or use, and have it deleted), exercised at the same addresses.

7. Cookies and Trackers

On the landing site (podkstr.com) we use PostHog in cookieless mode. No cookie is set in your browser, and we use no fingerprinting and no advertising trackers. A link to the application may carry a random identifier, so the visit can be tied to an account created afterwards. We use no advertising cookies and no third-party trackers for targeting: no Facebook pixel, no Google Ads, and no sale or sharing of data for advertising purposes. You can block or delete cookies from your browser settings (Chrome, Firefox, Safari, Edge). Blocking the login cookies prevents access to the application. In the application (podkstr.app), the following cookies and local storage entries are used:

  • manda_token and manda_refresh: login, 7 and 30 days. Strictly necessary.
  • podcaster-lng: language, local storage. Functional.
  • podcaster-theme: light or dark theme, local storage. Functional.
  • podcaster-analytics-consent: analytics choice, local storage, 6 months. Strictly necessary.
  • ph_* (PostHog): audience and usage analytics, only after consent, 12 months.

8. Data Security

Your data is encrypted in transit and at rest, and passwords are hashed. We implement the technical and organizational measures appropriate under GDPR Article 32.

9. Invited Participants (Studio Recording)

When you invite a participant to a recording studio, they are informed that the session may be recorded. Their consent is obtained before joining. The studio host is responsible for informing their guests about how the recording will be used.

10. Contact

For any questions about this policy or to exercise your rights, contact us at: contact@podkstr.com. You can also file a complaint with the French Data Protection Authority (CNIL), 3 place de Fontenoy, 75007 Paris, France.