Privacy Policy.

This Privacy Policy describes how KommIA SAS (hereinafter "the Provider" or "we") collects, uses, shares, and protects personal data in connection with the use of the SaaS service "KommIA", available through a mobile application (iOS and Android) and the kommia.com website.

The Provider is committed to ensuring that its processing activities comply with the General Data Protection Regulation (EU) 2016/679 (GDPR), the amended French Loi Informatique et Libertés, the ePrivacy Directive, and Regulation (EU) 2024/1689 on artificial intelligence (AI Act), to the extent applicable.

Data Protection Officer (DPO). As of today, KommIA has not designated a DPO within the meaning of Article 37 of the GDPR, as the conditions for mandatory designation are not met. For any question regarding your personal data, please contact: contact@kommia.com.

When using the KommIA service, the following categories of data may be collected:

• Identification data: last name, first name, business email address, phone number, job title, company name, and SIRET number where applicable.
• Billing data: postal address, intra-EU VAT number, payment method information (processed by Stripe; KommIA does not store your bank card details).
• Technical data: IP address, device type, operating system, connection logs, session identifiers, and application usage statistics.
• Social account data: public Instagram profile information (name, bio, profile picture, follower count), post statistics (reach, engagement, impressions), comments, direct messages (if the feature is enabled by the Customer), and post history.
• Data processed by AI: text and instructions entered by the Customer for content generation, content generated by the AI Features, and analytics and recommendation data.
• Cookies and tracker data: see Article 10 below for details.

The data collected is used for the following purposes:

The Service uses artificial intelligence technologies (large language models) to:

• generate content suggestions for social media;
• optimize text and visuals;
• recommend posting times;
• analyze post performance.

Underlying logic. The data you provide (instructions, text, social account data) is transmitted to third-party AI models that generate suggestions. These suggestions are automated proposals, not final decisions.

Human intervention. You retain full control at all times over the validation and publication of any content. No publication is made without your explicit action.

Right to object. In accordance with Article 22 of the GDPR, you may at any time request that certain processing not be subject to automated processing by contacting contact@kommia.com.

Data is hosted on the servers of:

The Provider warrants that primary hosting takes place within the territory of the European Union.

Personal data may be transmitted to the following subprocessors, exclusively for the purposes of the service:

KommIA will inform you of any addition or replacement of a subprocessor at least thirty (30) days before it takes effect, by email or in-app notification.

In accordance with the GDPR, you have the following rights:

• Right of access: obtain confirmation that your data is being processed and receive a copy of it.
• Right of rectification: have inaccurate or incomplete data corrected.
• Right to erasure: request the deletion of your data under the conditions provided in Article 17 of the GDPR.
• Right to object: object to processing based on legitimate interest.
• Right to restriction: request the restriction of processing in the cases provided in Article 18 of the GDPR.
• Right to data portability: receive your data in a structured, commonly used format.
• Rights related to automated decisions: not be subject to a decision based solely on automated processing, and request human intervention.
• Right to withdraw consent: at any time, without affecting the lawfulness of processing carried out before withdrawal (applicable to cookies and trackers).

How to exercise your rights. Submit your request to contact@kommia.com, specifying your identity and the right you wish to exercise. We may ask for proof of identity to verify who you are.

Response time. We will respond within one (1) month of receiving your request. This period may be extended by a further two (2) months in cases of complexity or a high volume of requests, in which case you will be informed within the initial one-month period.

Complaints. If you disagree with our response, you may lodge a complaint with the CNIL, the French data protection authority (Commission Nationale de l'Informatique et des Libertés): www.cnil.fr. UK residents may also lodge a complaint with the Information Commissioner's Office (ICO).

The Provider implements appropriate technical and organizational measures to ensure the security and confidentiality of data, in accordance with Article 32 of the GDPR, including:

• encryption of data in transit (TLS/HTTPS) and at rest;
• strict access control based on the principle of least privilege;
• secure user authentication;
• regular backups and a business continuity plan;
• logging of access to personal data;
• training of employees and subprocessors on security best practices;
• periodic security testing.

Breach notification. In the event of a personal data breach likely to result in a risk to your rights and freedoms, KommIA will notify the supervisory authority (CNIL) within 72 hours in accordance with Article 33 of the GDPR, and will inform you without undue delay if the risk is high in accordance with Article 34 of the GDPR.

The kommia.com website and the KommIA application may use cookies and similar technologies. In accordance with Article 82 of the Loi Informatique et Libertés and the recommendations of the CNIL:

• Strictly necessary cookies: placed without prior consent, they are essential for the website to function (session, security, cookie preferences).
• Audience measurement cookies: used to analyze website usage and improve the service. Tool: Google Analytics 4. Placed subject to your consent.
• Advertising / third-party cookies: the Meta (Facebook) Pixel is used to measure the performance of advertising campaigns. This tracker is activated only after your explicit consent is obtained through our cookie management banner.

Managing your preferences. You can change your cookie preferences at any time by clicking on Cookie preferences at the bottom of every page on the site. You can also configure your browser to refuse cookies.

Retention period. Cookies have a maximum lifetime of thirteen (13) months in accordance with the recommendations of the CNIL. Your consent is requested again every six (6) months.

Primary data hosting takes place within the European Union.

However, certain subprocessors (in particular AI providers and Meta for the advertising pixel) may process data in countries outside the European Union, in particular in the United States. In such cases, transfers are governed by:

• the Standard Contractual Clauses (SCCs) adopted by the European Commission (Implementing Decision 2021/914);
• and/or an adequacy decision of the European Commission (where applicable, the EU-US Data Privacy Framework).

A Transfer Impact Assessment is carried out for each subprocessor concerned. You can obtain a copy of the appropriate safeguards by contacting contact@kommia.com.

The Provider reserves the right to amend this policy at any time. In the event of a substantial change, users will be notified by email at least thirty (30) days before the changes take effect. The version in force is the one published on the kommia.com website and in the KommIA mobile application.

As part of developing its business, KommIA SAS carries out commercial prospecting by email aimed at professionals (independent professionals, very small businesses, SMEs) who may be interested in its service. This section concerns the people we contact, as distinct from the users of the application.

Source of the data. In accordance with Article 14 of the GDPR, we inform you that your business contact details were not collected directly from you, but from publicly available sources: online directories and business listings (for example Google Maps / Google Business), professional websites and professional profiles on social networks.

Data processed. Name of the business; first and last name of the business contact, where applicable; business email address; city; sector of activity; website and social media presence; public information related to the business (for example public ratings and reviews).

Purpose. To contact you by email for commercial purposes, in order to present the KommIA service in connection with your professional activity.

Legal basis. Legitimate interest (Article 6(1)(f) of the GDPR): prospecting professionals, in the course of their business and for a service related to it, constitutes a legitimate interest of KommIA. You may object to it at any time (see Article 08).

Recipients and subprocessors. Your data is processed by KommIA and its technical providers (email sending tool and CRM, in particular Smartlead and HubSpot). As some of these providers are located outside the European Union, in particular in the United States, these transfers are governed by appropriate safeguards (see Article 11).

Retention period. Your prospecting data is kept for a maximum of three (3) years from our last contact, or until you request its deletion or object to prospecting.

Your rights. You have the rights of access, rectification, erasure, objection (including to prospecting, at any time and without giving reasons), restriction and portability, as well as the right to lodge a complaint with the CNIL (the French data protection authority). To exercise them: contact@kommia.com. You can also unsubscribe immediately by replying “stop” to one of our emails.

© 2025–2026 KommIA SAS · All rights reserved.