1. Who we are (data controller)
PrezKit is operated by Avy LOTATI EI, sole trader (entrepreneur individuel, micro-entreprise regime), trading as "EYA Concept" — SIREN 825 221 518, SIRET 825 221 518 00020, 9 Route principale de Mongadon, 86600 Lusignan, France. For privacy matters, contact legal@prezkit.com. We are the data controller for the personal data described here.
2. The people we handle data about
- You, the account holder (the creator who signs up).
- Visitors to public pages and our funnel (often pseudonymous).
- Non-users we scan in the free Diagnostic — creators who have not signed up (section 5).
- Third parties you publish — collaborators, band members, testimonial authors, people in your photos. You are responsible for having a basis to publish information about them.
- People who report a page, and people who are reported (section 6).
3. Account, profile & content — legal basis: contract
When you create and run a PrezKit page we process your account identity (email, account ID), your public profile and content (name, tagline, bio, links, sections, releases, events), your uploaded media, and your onboarding/notification state. We process this to provide the service you signed up for. Profile, link, release and event data is shown publicly on your page; everything else is visible only to you (and to us as operator where strictly necessary). Retention: for the life of your account, then deleted through our erasure process (section 9).
Help from PrezKit on your page. If you switch on "Let PrezKit help edit my page" in your editor, a named member of the PrezKit team may view your unpublished page and edit its content on your behalf, for a limited time (14 days at most, renewed only with your consent still on). They can never publish your page, change your username, email, payments, connected accounts or verification, or delete anything. Every view and every change is logged with who made it and when. You can see the full list in your editor, you get an email when this access starts and when it ends, and you can switch it off at any moment, with immediate effect. Legal basis: your consent, which you can withdraw at any time.
4. Identity verification — legal basis: contract + legitimate interest
A page only goes public once you verify the identity behind it by connecting at least one authoritative account (YouTube or Instagram). We store the connection record (platform, the account's immutable ID, the handle, and a match/state value) and a verification audit trail.
About access tokens: today the flow verifies once and does not store any access or refresh token— we read the account's ID and handle to confirm you control it, then discard the token. (A future token layer, if introduced, will be encrypted at rest and service-only; we will update this section when it ships.) Our legitimate interest is preventing impersonation and protecting the integrity of the verified-identity system.
5. The free Diagnostic — legal basis: legitimate interest
Our free Diagnostic lets anyone enter a creator's name or URL and see a "Presence Score." To produce it, we look at publicly available information about that creator — the same information any person could see — and compute aggregate scores. We do not access private or logged-in-only content, and we cache the result for a limited time only.
This can include creators who do not have a PrezKit account. We rely on our legitimate interest in offering a useful, free presence-analysis tool, balanced against the rights of the people scanned, with safeguards: aggregate-only output, service-only storage, short cache retention, hashed abuse-prevention identifiers, and a working opt-out.
If you've been scanned and don't have an account: you can ask us to remove your cached Diagnostic data and to not scan you again, by contacting legal@prezkit.com. This is your right to object (Art. 21).
6. Data about other people, reports & trust-and-safety
When you publish testimonials or content naming or depicting other people, you are publishing their personal data and you are responsible for having a lawful basis to do so. Separately, anyone can report a page they believe impersonates someone, infringes IP, squats a name, or is otherwise unlawful; a report stores the reporter's email, a hashed IP prefix, the reported page, the complaint, and our reasoned decision. We use this to run our notice-and-action process under the Digital Services Act — see our Report a page form and our terms.
7. AI features — legal basis: contract / legitimate interest
Some PrezKit features use AI to help with your presence. To do this we send relevant user/creator content to the Claude API operated by Anthropic (a sub-processor in the United States), under appropriate transfer safeguards, and we meter usage for billing and audit. AI outputs are assistive; decisions that affect you — in particular the verification/seal review — keep a person in the loop.
8. Sub-processors & international transfers
We use a small set of trusted providers, each processing data only on our instructions; for US-based providers we rely on Standard Contractual Clauses.
| Provider | What it does | Region / transfer |
|---|---|---|
| Supabase | Database + authentication | Europe (eu-central-2, Zurich — adequate country) |
| Cloudflare R2 | File / media storage | EU bucket |
| Resend | Transactional email | EU sending |
| Vercel | App hosting | US default — SCC |
| Stripe | Payments | EU entity |
| Anthropic (Claude) | AI features | US — SCC |
| Inngest | Background jobs | US default — SCC |
For the Instagram connector, when offered, we operate a data-deletion callback as Meta requires.
9. Your rights
You can exercise these by contacting legal@prezkit.com; many are self-service in the product.
- Access & rectification: view and edit your profile; request a full copy.
- Portability: request an export of your data.
- Erasure: delete your account; on request we delete your account data, remove your stored files, and disconnect your connected accounts. For a short backup-retention window, copies may persist in encrypted backups before they age out.
- Consent withdrawal: where we rely on consent (analytics, marketing emails), you can withdraw it at any time.
- Object / restrict: you can object to processing based on legitimate interest — including the Diagnostic scan if you are a non-user (section 5).
- Complain: you may lodge a complaint with the French supervisory authority, the CNIL (cnil.fr).
Privacy by design:we store IP addresses only as a hashed prefix, never in full; OAuth access tokens are not stored today; and each account's data is isolated at the database row level.
10. Consent, funnel & analytics
When you give us your email to see or save a Diagnostic result, we record your email plus the consent event. Any non-essential funnel/page analytics run only with your consent via our cookie banner — see the Cookie Policy. You can withdraw consent at any time.
11. Children
PrezKit is intended for adults / creators of contracting age. We do not knowingly process data of users below the applicable minimum age.
12. Changes
We'll update this policy as PrezKit evolves and as the law requires, and we'll give notice of material changes.