Privacy policy

Last updated on November 14, 2026

The French text of this document governs. This English text is a courtesy translation; French law and the French courts apply.

Who we are

This policy covers this website and the Cairn service. The controller of the personal data described here is KASOCORP SAS, 15 allée Gabrielle D’Estrées, 75019 Paris, France ("we", "us"). You can reach us at [email protected].

For the content that a customer puts into a Cairn workspace, the customer is the controller and we are its processor. The data processing agreement applies to that content.

This site

This site sets no cookie. It runs no script that tracks you and uses no analytics tool or advertising pixel. It is made of static files delivered by Cloudflare, Inc., which sees the IP address and the technical details of each request in order to deliver the page and keep the site secure.

If you write to us, we use your email address and your message to answer you.

The service

When you use Cairn we handle the following data.

Account data: your name, your email address, the identifier Google gives us for your account, the address of your Google profile picture and, for a Google Workspace account, the domain of your organisation.
Membership data: the workspaces you belong to, your role and your teams in each of them, and when you were last active there.
Workspace content: the projects, programmes, dates, owners, notes, share links and other content that you and your colleagues enter. The customer decides what goes in.
Records of actions: the log of changes that shows who changed what and when, and an audit record of sensitive actions such as creating a token or a share link.
Access data: sessions, API tokens and connections of agents. Sessions and tokens are stored as hashes, not in clear.
Billing data: when a workspace subscribes, our payment provider handles the payment details. We keep the identifiers of the customer and of the subscription, the plan and its status. We never see or store a full card number.
Technical data: our host and our application handle IP addresses and request details to deliver the service and to limit abuse.

Why we use it

To provide the service that you or your employer asked for (performance of the contract).
To secure the service and prevent abuse (our legitimate interest).
To bill, and to meet our accounting duties (contract and legal obligation).
To answer your messages (our legitimate interest).

We do not sell personal data and we do not use it for advertising.

You can sign in with Google. Cairn asks Google for your name, your email address and your basic profile, and nothing else. We do not read your Google mail, contacts, calendar or files. Google handles your Google account under its own policy.

Cookies

The service uses three cookies that are strictly necessary, and the site uses none. The cookies page lists them.

Who receives the data

We use the providers listed on the sub-processors page. The application and its database run at Fly.io, Inc.. We give a provider only what it needs to do its job, under a contract that protects the data.

Where the data is processed

The application runs in the Paris region, in France. Copies of the database (backups) are kept by Tigris Data, Inc. in Europe. Some providers are established outside the European Economic Area. When data goes to them, the transfer relies on an adequacy decision of the European Commission or on the standard contractual clauses.

How long we keep it

Sessions: up to 14 days after your last visit, and 30 days at most.
Agent connections: an access token lasts one hour, and a refresh token lasts 30 days from its last use.
Account and workspace data: for as long as the workspace exists. When a workspace is deleted its content is erased from the live database. Backups expire at the end of their retention period, which is 30 days.
Billing records: for the period that accounting law requires.

Your rights

You can ask for access to your data, for its correction or erasure, for a restriction of its use, for a copy in a common format, and you can object to its use. Write to [email protected]. We answer within one month.

If data about you sits in a workspace of your employer or of a client, ask that organisation first. We help it answer you.

If you think we handle your data unlawfully, you can complain to the CNIL, the French data protection authority, or to the authority of your country.

Changes

We update this policy when our practices change and show the date at the top of the page. Before a change that matters, we tell the owners of workspaces by email. We write from our own mailbox.