Privacy policy

Koragence only collects the data needed to answer requests, process applications, secure forms, manage the newsletter, and measure website usage after consent. Forms are stored in a PostgreSQL database, technically delivered through Mailgun, and protected by anti-spam checks. Audience measurement and session replay rely on PostHog Cloud hosted on its European services, only after explicit consent.

Data controller

KORAGENCE SASU, 47 boulevard de Courcelles, 75008 Paris, France. Contact: contact@koragence.com.

Data collected

• Contact, project, newsletter, or application forms: name, email, company if relevant, profile link, subject, free-form message, project information, and data you choose to send.
• Security and anti-spam: IP address, user agent, referrer, language, timestamp, limited technical fingerprint, anti-spam check result, and information needed to limit abuse.
• Audience measurement after consent: acquisition source, UTM parameters, pageviews, clicks, scroll depth, language, browser, device type, viewport size, and a pseudonymous visitor identifier.
• Session replay after consent: visual reconstruction of navigation, with form fields masked and areas marked as sensitive excluded.
• No banking data is collected on this website.

Purposes and legal bases

• Answering your requests, preparing a commercial exchange or a pre-contractual relationship: GDPR Article 6(1)(b).
• Processing an application submitted through the website: pre-contractual measures or legitimate interest depending on the context.
• Managing newsletter subscription: consent, GDPR Article 6(1)(a).
• Measuring audience, understanding journeys, and improving the site with PostHog: consent, GDPR Article 6(1)(a).
• Securing forms, limiting spam, preventing abuse, and keeping necessary technical proof: legitimate interest, GDPR Article 6(1)(f).

European PostHog Cloud, cookies, and session replay

PostHog Cloud is used on its European services for audience measurement, journey tracking, conversions, and session replay. It does not start before explicit analytics consent through the cookie banner. If consent is refused, the website only stores the consent choice locally so the same decision is not requested again immediately.

After acceptance, PostHog may use local storage and cookies needed for consented measurement. The configuration masks form fields, excludes sensitive areas marked in code, removes free-form content, phone numbers, and plain-text emails from analytics events, and allows consent withdrawal at any time from the “Cookies” link in the footer.

Retention periods

• Commercial requests and forms: up to 3 years after the last meaningful exchange.
• Applications: up to 2 years after the last contact, unless earlier deletion is requested or a contrary obligation applies.
• Newsletter: until unsubscribe or consent withdrawal, with limited retention of necessary proof.
• Technical anti-spam and security data related to forms: up to 12 months, except in case of incident, abuse, or evidentiary obligation requiring longer retention.
• Audience measurement data: up to 13 months after collection.
• Session replay: up to 3 months.
• Cookie consent choice: stored locally for 6 months before asking for your choice again.

Recipients, hosting, and transfers

The data is intended for Koragence and its strictly necessary technical subprocessors: website hosting, database, technical form delivery, security, and consented analytics. The website notably uses Vercel for hosting, a PostgreSQL database for requests, Mailgun for form delivery, and PostHog Cloud hosted on its European services for audience measurement after consent.

Some subprocessors or their own providers may be located outside the European Union. In that case, Koragence relies on appropriate safeguards under the GDPR, including standard contractual clauses where necessary.

Security and minimisation

Koragence limits collected data to what is useful for the requested processing or website security. Forms are marked to avoid automatic capture by analytics tools, sensitive fields are masked in session replay, analytics events are filtered, and data access is restricted to people or providers who need it.

Your rights

You may exercise your rights of access, rectification, deletion, restriction, objection, portability, and withdraw analytics consent at any time by writing to contact@koragence.com or by using the “Cookies” link in the footer.

You may also lodge a complaint with the CNIL.