Privacy policy
Effective version dated 26 August 2026
Controller
Pacific Knowledge, VAANAIKI CHARLES MAGNUS PUNUAURA BROTHERSON (EI), at the address in the legal notice. Privacy contact: contact@pacificknowledge.dev. No DPO is currently appointed.
Data and purposes
Name, email, language, linked social accounts, sessions and terms acceptance provide and secure the account. Key prefixes, last use and counters authorise requests. Stripe customer/subscription references manage billing; no card data is stored. IP addresses and user agents may appear in security logs.
Legal bases
Contract performance covers the account, API and billing. Legitimate interests cover security, abuse prevention and reliability. Legal obligations cover accounting records. Consent is used only where genuinely freely given, including any future non-essential trackers.
Recipients and processors
Authorised Pacific Knowledge personnel and necessary providers: Vercel (web), Railway (API and database), Postmark (email), Stripe (payment), Sentry (application errors), and Grafana Cloud (traces and availability). Google and GitHub receive data only when users choose those sign-in methods.
Transfers
Some providers process data outside French Polynesia or the European Union. Pacific Knowledge relies on their contractual data-protection commitments and, where applicable, standard contractual clauses or recognised transfer mechanisms. The internal register records the declared provider list and locations.
Retention
Application and security logs are retained for no more than 30 days outside an incident. Account data is kept for the relationship and deleted within 30 days, except records isolated under a legal duty. Daily backups rotate after 14 days. Billing records are kept for the legally applicable accounting period.
Rights
You can access, correct and export data in the dashboard, then request deletion. You may request restriction, object or portability at contact@pacificknowledge.dev and complain to the CNIL. Proportionate identity verification may be required.
Cookies
V1 sets only cookies strictly necessary for authentication, security and language preference. No non-essential advertising or analytics tracker is active, so no consent banner is displayed. This policy must change before any tracker is added.
Automated decisions and security
No decision with legal effect is made solely automatically. Quotas mechanically enforce the selected plan. Full API key secrets are shown once and only an HMAC digest is stored.
Last updated: 26 August 2026.