Privacy Policy

Last updated: July 10, 2026. Kapari is operated from the European Union and built to the standard of the EU General Data Protection Regulation (GDPR). We offer GDPR-grade rights to every user, wherever you are.

Who we are

The service is operated by Pierre Barreaud, sole proprietor, 401 rue de Barbotte, 45160 Olivet, France. Contact: contact@kapari.eu. He is the data controller for the processing described here.

What we collect, and why

• Account data: email address and password (stored hashed, never in clear text), to create and authenticate your account.
• Your content: the context and decisions you type, the panels you compose, the simulations you save, to provide the service and let you save and share your work.
• Technical logs: IP address and timestamps, strictly for security, abuse prevention and service operation.
• Access requests: first name, last name, organization, role and email you submit through the access form, to process your request and manage the relationship.

We do not sell your data, and we do not share it for advertising purposes.

AI processing

To generate a simulation, the context and decision you type are sent to a model router, OpenRouter (United States), which routes the request to the model, Mistral AI, executed on infrastructure in the European Union. The router does not retain prompts (technical metadata only). Panel voices are synthetic sociological profiles: no real person is interviewed, and no identifiable individual is ever sent to the model. Optionally, the public-facts lookup ("actor memory") uses Google's Gemini service (United States) with the decision text only. Your content is never used to train a model, neither ours nor our providers'.

Processors and hosting

• Hosting: Hostinger International Ltd, VPS located in Paris, France.
• Database: Supabase (account and saved simulations).
• AI routing: OpenRouter (US); model execution: Mistral AI (EU). Public-facts lookup: Google Gemini (US).
• Public-facts search on your request ("Search public facts"): Perplexity, via OpenRouter (US). It receives only the search queries you reviewed and confirmed, never your documents.

Retention

• Account: kept while active, deleted after three years of inactivity.
• Saved simulations: kept until you delete them or delete your account. Facts extracted from an attached document travel with the saved simulation and disappear with it; the document itself is never transmitted nor kept.
• Folder notes: the analysis (dated facts, stakeholders, tensions) you choose to file into a folder is kept until you delete it, note by note or by deleting the folder; deleting the account erases everything. These notes may describe third parties: they remain private, visible, editable and deletable at any time from the app.
• Technical logs: twelve months.
• Access requests: for the duration of the commercial relationship.

Your rights

Wherever you are located, you can access, correct, export or delete your data, and object to or restrict its processing. Account deletion is self-service from your account page and cascades to your saved content. For anything else, write to contact@kapari.eu. If you are in the EU, you may also lodge a complaint with your supervisory authority (in France, the CNIL).

Security

Passwords are hashed, sessions use httpOnly cookies, transport is encrypted (HTTPS), and access to production data is restricted to the operator. No method of transmission is perfectly secure; we describe the chain as it is and fix what we find.

Changes

We will post any material change on this page with an updated date. The French version of this policy is available at kapari.eu/confidentialite.html.