Privacy policy
Working document requiring review before publication
Technical version dated 24 August 2026. It is not legal or tax advice and must not be published to production before review.
Controller
Pacific Knowledge, VAANAIKI CHARLES MAGNUS PUNUAURA BROTHERSON (EI), at the address in the legal notice. Privacy contact: contact@pacificknowledge.dev. No DPO is currently appointed.
Data and purposes
Name, email, language, linked social accounts, sessions and terms acceptance provide and secure the account. Key prefixes, last use and counters authorise requests. Stripe customer/subscription references manage billing; no card data is stored. IP addresses and user agents may appear in security logs.
Legal bases
Contract performance covers the account, API and billing. Legitimate interests cover security, abuse prevention and reliability. Legal obligations cover accounting records. Consent is used only where genuinely freely given, including any future non-essential trackers.
Recipients and processors
Authorised Pacific Knowledge personnel and necessary providers: Vercel (web), Railway (API and database), Postmark (email), Stripe (payment), and documented observability providers once enabled. Google and GitHub receive data only when users choose those sign-in methods.
Transfers
Some providers may process data outside French Polynesia or the European Union. Regions, transfer mechanisms and contractual safeguards must be recorded before production.
Retention
Assumptions to confirm: application and security logs up to 30 days outside an incident; account for the relationship then deletion within 30 days; short backup rotation; billing records for the applicable accounting period. Final periods require legal approval.
Rights
You can access, correct and export data in the dashboard, then request deletion. You may request restriction, object or portability at contact@pacificknowledge.dev and complain to the CNIL. Proportionate identity verification may be required.
Cookies
V1 sets only cookies strictly necessary for authentication, security and language preference. No non-essential advertising or analytics tracker is active, so no consent banner is displayed. This policy must change before any tracker is added.
Automated decisions and security
No decision with legal effect is made solely automatically. Quotas mechanically enforce the selected plan. Full API key secrets are shown once and only an HMAC digest is stored.