Privacy Policy

1. Data controller

The controller of the personal data collected on kaissa.net and in the Kaissa application is:

• Pionics, an SAS with a share capital of 5,000 euros, RCS Toulouse 938 387 768
• 31 rue de Cugnaux, Bâtiment B, Appartement 66, 31300 Toulouse, France
• Personal data contact: rgpd@kaissa.net

This policy applies to all users of the Service, as well as to persons whose name appears in an imported game (section 4).

2. Data collected

Account. Username, email address, password (stored encrypted), interface language; first name and last name if you provide them. If you sign in with Google: email, first name, last name and Google identifier. Your Google profile picture is not retrieved and Google access tokens are not stored.

Content. Chess games (PGN format, including player names), annotations, analyses, Studies, collections, preferences.

Usage. Date of last sign-in, session history (dates only), server technical logs (IP address, timestamp, page requested).

Teams and billing. The Team's billing information (identity or company name, address, RNA or SIRET, billing email), history of assigned licences, invoices. Proof of consent for a Team payment: date, IP address, browser, accepted text. Card numbers and IBANs are collected directly by Mollie and do not pass through our servers; we keep only the payment method reference and its last characters.

Optional features. Photos of scoresheets that you submit for recognition, voice dictation audio recordings (section 6).

Newsletter. Your consent, its date, and your opens if you are subscribed.

3. Purposes, legal bases and retention periods

An account inactive for more than three years may be deleted after a one-month notice email that has gone unanswered.

Database backups are made daily and kept for 7 days; the data of a deleted account therefore disappears permanently from the backups within 7 days.

4. Imported games and third-party data

A chess game in PGN format contains the names or usernames of both players. When you import a game, your opponent's name is therefore stored with it, even if they are not a Kaissa user. This processing is based on our legitimate interest and yours in analysing your games, as it concerns information from a game that was played and is generally already public on the original platform or in the original tournament.

Imported games are private by default and visible only to you, unless you share them. Anyone whose name appears in a game may request to be anonymised by writing to rgpd@kaissa.net. Pionics examines each request in light of the public nature of the game (official tournament, online platform) and the legitimate interests at stake, and responds within one month; it may refuse when the game was played and published under the player's name in an official setting.

For imports from Lichess, the username you enter is sent to Lichess to retrieve your games. It is not stored on our servers; your browser remembers it locally to pre-fill the field, until you clear its data. No Kaissa data is sent to Lichess or Chess.com.

5. Teams

When you join a Team, its Administrator or Administrators have access to your username, your email address and the status of your Professional Account. They do not have access to your games, analyses or Studies, unless you share them with the Team. You may leave a Team at any time from your settings.

The Administrator who enters a Team's billing information does so on behalf of the organisation or person being invoiced; this information is used exclusively to issue invoices and is not visible to members.

6. Artificial intelligence features

Two optional features use artificial intelligence providers, only when you trigger them:

• Scoresheet recognition: the photo you submit is sent to Anthropic, PBC (United States) to extract the moves. We recommend that you photograph only the scoresheet, without any face or identity document.
• Voice dictation: the audio recording is sent to Mistral AI (France) for transcription.

In both cases, the file is sent solely for the requested processing and is not kept by us once the result has been obtained. These providers act as processors: Anthropic contractually undertakes not to train its models on content sent via its API, and the option to train on our data is disabled in our Mistral AI account.

The chess analysis engine receives only positions and moves, never personal data.

7. Recipients and processors

Your data is processed by the Pionics team and by the following processors, each for a specific purpose:

Lichess and Chess.com are independent third-party services, queried with the username you enter; they receive no other data.

Your data is neither sold nor transferred. It may be disclosed to the authorities where required by law.

8. Transfers outside the European Union

Your data is hosted in the European Union. Some processors are established in the United States (Google, Anthropic). These transfers are governed by the EU–US Data Privacy Framework where the provider is certified under it and, failing that, by the European Commission's standard contractual clauses. A copy of the safeguards can be obtained on request from rgpd@kaissa.net.

9. Cookies and local storage

Kaissa does not use any advertising, social network or audience measurement cookies.

Strictly necessary cookies and storage (exempt from consent, article 82 of the French Data Protection Act): session and authentication, interface language, display preferences, import username remembered locally. They are stored in your browser and you can clear them at any time.

reCAPTCHA (Google): the sign-in page uses reCAPTCHA to protect accounts against automated attacks. This service analyses browsing signals and may set Google cookies; it is loaded only on that page. Its use is based on our legitimate interest in security; you can read its privacy policy on Google's website.

Mollie payment page: Mollie's own technical cookies are set during payment, as they are necessary to secure the transaction.

10. Security

We implement appropriate technical and organisational measures: encryption of communications (HTTPS), passwords stored in hashed form, access to data restricted to authorised persons, regular backups in the European Union, no storage of banking data on our servers. In the event of a data breach likely to result in a risk to your rights, we will inform you in accordance with the GDPR.

11. Your rights

You have the following rights over your data: access, rectification, erasure, restriction of processing, objection, portability, withdrawal of consent at any time (newsletter), and instructions regarding what happens to your data after your death.

You can exercise most of these rights directly from your account: edit your information, export your games in PGN format, unsubscribe from the newsletter, delete your account. For any other request, write to rgpd@kaissa.net or by post to Pionics' address. We respond within one month; proof of identity may be requested if there is reasonable doubt as to your identity.

You may lodge a complaint with the CNIL (www.cnil.fr, 3 place de Fontenoy, 75007 Paris).

12. Minors

The Service is reserved for persons aged 15 and over. Below this age, registration requires the consent of a holder of parental authority. If we learn that an account has been created by a minor under 15 without this consent, we suspend it and erase the associated data. Parents can contact us at rgpd@kaissa.net.

13. Changes to this policy

We may amend this policy to reflect changes to the Service or to regulations. Any substantial change will be notified to you by email or in the application before it takes effect. The version in force is the one published on the website.