Politique de Confidentialité
Version 2 — effective from 31/08/2026
Language : English
Last updated: 01/09/2025
Previous versions are available on request.
1. Who we are
Kuno is operated by Kuno SAS, 122 rue Amelot, 75011 Paris, France.
For privacy inquiries and to exercise your rights, contact: dpo@kuno-ai.com.
Lead supervisory authority: CNIL (France)
Data protection contact. Kuno has appointed an internal data protection contact, who can be reached at dpo@kuno-ai.com. Kuno is not required to designate a Data Protection Officer within the meaning of Art. 37 GDPR and has not done so.
2. Scope and roles
This Privacy Policy explains how Kuno processes personal data when you use our websites, learner application, company portal, and related services (together, the Services).
2.1 Dual role
We act in two capacities depending on the processing concerned.
Your account and your use of the Services themselves, our own communications and our relationship with our customers : We are the controller.
The learning data processed to deliver the programmes your organisation has assigned you : Your organisation is the controller. We act as processor under a Data Processing Agreement
Where we act as processor, your organisation determines the purposes of the processing and the lawful basis for it, and its own privacy notice applies alongside this one.
3. Personal data we process
Depending on how you use the Services, we may process :
Category | Examples |
|---|---|
Account & identity | Name, email, authentication identifiers (password hash, SSO / social login identifiers), role, job title, department and office location (learner, company admin, etc.) |
Profile & learning | Bio, photo/avatar, occupation, industry, skills, goals, language preferences, time zone, scheduling preferences |
Assessments | Assessments ; Your responses to learning-style questionnaires and the resulting trait scores, produced with our assessment provider BrainCore |
Sessions & media | Session metadata; transcripts and AI-generated summaries/feedback when AI recording is enabled |
Company content | Documents uploaded by company admins to company knowledge bases or programs (may contain personal data) |
AI outputs | Learning-profile narratives, session debriefs, program drafts, pathways, program diagnostics, translated / localized content |
Usage & device | Product analytics events, approximate device/browser metadata |
Diagnostics | Error and performance logs (minimized) |
Communications | Transactional emails (invites, notifications); marketing emails where consented |
We do not sell personal data.
4. How we collect data
Necessary for your account. Your email address and the authentication identifiers sent by your organisation's identity provider are necessary to create and secure your account. Without an email address we cannot give you access to the Services. In most cases these are provided by your organisation rather than by you.
Received from your organisation. Your name, job title, department and office location are sent to us by your organisation's identity provider when it signs you in, where your organisation chooses to share them. You do not enter them into Kuno, and whether they are shared is your organisation's decision.
Necessary to take part in a programme. You choose your role when you first set up your account. Completing the learning-style questionnaire is necessary before you can book or start a session: without it we cannot generate your learning profile or suggest peers to work with. You can still create and use your account without completing it.
Optional. Your photo, biography, skills, interests, learning goals and weekly availability are optional. You can complete them in the product or leave them blank.
Subject to your consent. Session recording, transcription and the AI-generated debriefs produced from them are subject to your prior consent. You may decline or withdraw it at any time; the session then takes place without those features.
5. Purposes and lawful bases
Our role differs depending on the processing concerned. The first table sets out the processing for which we act as controller, and the lawful basis we rely on. The second sets out the processing we carry out on behalf of your organisation.
Kuno as controller
Purpose | Data | Lawful basis |
Authenticate you and manage your login credentials and sessions | Email, authentication identifiers, password hash, SSO identifiers | Our legitimate interest in operating the authentication layer of the Services (Art. 6(1)(f)) |
Secure the Services, detect and prevent fraudulent access and abuse | Authentication and connection logs, IP address | Our legitimate interest in the security and integrity of the Services (Art. 6(1)(f)) |
Monitor errors and maintain the performance of the Services | Error and performance logs, technical metadata | Our legitimate interest in maintaining a functioning service (Art. 6(1)(f)) |
Diagnose and resolve incidents affecting the Services, including access by authorised personnel | Any data necessary to resolve the incident | Our legitimate interest in maintaining the Services (Art. 6(1)(f)). Where the incident concerns your organisation's own use of the Services, we act as processor on its instructions |
Measure use of the Services in order to improve them | Usage events, approximate device and browser metadata | Your consent (Art. 6(1)(a) GDPR and Art. 82 of the French Data Protection Act), which you may withdraw at any time |
Send account and security messages: account creation, password reset, security alerts | Email, name | Our legitimate interest in operating and securing your account (Art. 6(1)(f)) |
Notify you of material changes to this Policy | Email, name | Compliance with a legal obligation (Art. 6(1)(c)) |
Communicate with our customers' contacts on contractual, billing and service matters | Email, name, role, message content | Our legitimate interest in managing the customer relationship (Art. 6(1)(f)) |
Send information about our services to professional contacts and prospects | Email, name, role, organisation | Our legitimate interest in promoting our services (Art. 6(1)(f)), where the content relates to your professional role. Sending is governed by Art. L34-5 of the French Post and Electronic Communications Code. You may object at any time, including via the unsubscribe link in each message |
Handle requests to exercise your rights | Identity and contact details, correspondence, record of the request | Compliance with a legal obligation (Art. 6(1)(c)) and our accountability obligation (Art. 5(2)) |
Manage the customer relationship, contracts and invoicing | Contract and billing records | Performance of our contract with your organisation (Art. 6(1)(b)) |
Keep accounting and tax records | Invoices, accounting records | Compliance with a legal obligation (Art. 6(1)(c)) |
Comply with our other legal and regulatory obligations, including responding to requests from competent authorities | Relevant records, correspondence | Compliance with a legal obligation (Art. 6(1)(c)) |
Establish, exercise or defend legal claims | Relevant records, correspondence, contract documentation | Our legitimate interest in defending our rights (Art. 6(1)(f)). |
Kuno as processor
Create, provision and deactivate user accounts, assign roles and organisational membership |
Deliver the peer-learning programmes assigned to you, including scheduling and running sessions |
Record and transcribe sessions, where recording is enabled |
Generate session debriefs and feedback from transcripts |
Generate your learning profile and related personalisation |
Translate and localise your organisation's content and generated materials |
Match you with peers |
Store and retrieve content from your organisation's knowledge base to support programme design |
Send programme notifications: invitations, assignments, session reminders, availability of debriefs |
Retain your data for the period configured by your organisation |
Assist your organisation in responding to your requests to exercise your rights |
6. Automated processing and Artificial intelligence
We use artificial intelligence to generate session debriefs and feedback, learning profiles, programme drafts and learning pathways, to suggest peer matches, to retrieve content from your organisation's knowledge base, and to translate and localise content. Inference is carried out through Amazon Bedrock within the European Union.
Learning profile. Your assessment responses and profile data are analysed automatically to produce a narrative describing your learning style, together with trait scores. This constitutes profiling within the meaning of Art. 4(4) GDPR. Your profile does not determine your access to a programme or module, your eligibility, or any decision relating to your work.
Peer matching. The system compares your assessment scores with those of other learners and generates the list of peers you can book sessions with. That list is generated automatically, and you can currently only book with peers on it. Your organisation's administrators can also create pairings themselves. No session is created automatically: bookings are always made by a person.
Special category data. AI-generated outputs may contain inferences about you. We do not design our systems to infer health, emotional state or any characteristic listed in Art. 9 GDPR.
Roles. Where AI processing is carried out to deliver a programme assigned to you by your organisation, including learning profiles, session debriefs and knowledge retrieval, we act as processor on its instructions (see section 2.1).
Your safeguards. If you disagree with an outcome produced by automated processing, or would like to work with someone who is not on your list, you can contact your organisation's administrator or write to us at dpo@kuno-ai.com. You may express your point of view and ask for a person to review your request. You may also request the correction or deletion of the personal data behind an AI-generated output.
Further information on where AI is used, what it does and how human oversight operates is set out in our AI transparency notice.
7. Where we process data (hosting)
We host the Services on Amazon Web Services within the European Union:
Primary application and database infrastructure: AWS eu-west-3 (Paris, France)
Company knowledge base and related document storage: AWS eu-central-1 (Frankfurt, Germany)
AI inference for learning and session features: Amazon Bedrock, eu-west-3 (Paris)
AI translation and localisation: Amazon Bedrock, eu-central-1 (Frankfurt)
Data flows between Paris and Frankfurt take place within the European Union and are not transfers to a third country within the meaning of Chapter V of the GDPR. We disclose them for transparency as to how the platform operates.
Certain service providers we use may process data outside the European Economic Area. Those arrangements are described in section 9 and in our subprocessor register.
8. Recipients and subprocessors
Subprocessors. We use the following service providers to operate the Services. Each acts as our subprocessor and processes personal data only on our documented instructions, under a data processing agreement.
Amazon Web Services — hosting, storage and AI inference (Amazon Bedrock, including the managed knowledge base and translation models)
Stream — video, chat and related media
PostHog — product analytics (EU cloud)
Sentry — error monitoring
Resend — transactional email
BrainCore — psychometric assessment, where used
Our subprocessor register, available at Subprocessors List, lists each provider, the processing it carries out, the countries in which it processes personal data and the applicable transfer mechanism. Customers may also obtain the then-current list under their Data Processing Agreement.
We will inform customers of any intended addition or replacement of a subprocessor at least 30 days before it takes effect, so that they may object in accordance with their Data Processing Agreement.
Other recipients. Where you sign in using a third-party account (Google, Apple) or your organisation's identity provider, that provider processes your data as an independent controller under its own privacy policy; we receive only the identifiers necessary to authenticate you. We may also disclose personal data to our professional advisers, auditors and insurers, and to public authorities where required by law.
Corporate transactions. In the event of a merger, acquisition, reorganisation, sale of all or part of our business, or insolvency proceedings, data for which we are the controller may be transferred to the entity concerned as part of that transaction. We will ensure that the recipient is bound to a level of protection equivalent to that described in this Policy. Data we process on behalf of our customers remains governed by the Data Processing Agreement concluded with each of them, which determines the conditions under which such a transaction may take place. Should a transaction result in a material change to the processing of your data, you will be informed in accordance with section 15.
Requests from authorities. We may be required to disclose data to a judicial or administrative authority. We review each request, verify its legal basis and formal validity, and disclose only the data legally required. Where a request concerns data we process on behalf of a customer, and unless we are legally prohibited from doing so, we inform that customer without delay so that they may exercise their rights. We challenge requests that are manifestly unfounded or that exceed what the law permits.
9. International transfers
Certain of our service providers may process personal data outside the European Economic Area, or may be established outside the EEA. Where this is the case, the transfer takes place on one of the following bases:
an adequacy decision of the European Commission recognising that the country concerned ensures an adequate level of protection;
the provider's certification under the EU–U.S. Data Privacy Framework, where applicable;
the Standard Contractual Clauses adopted by the European Commission, supplemented where necessary by additional technical and organisational measures identified through a transfer impact assessment.
The service providers we use, the countries in which they process personal data and the transfer mechanism applicable to each are listed in our subprocessor register, available at www.kuno-ai.com/subprocessors-list. That register is kept up to date and reflects our current arrangements.
You may obtain a copy of the safeguards relied upon for a transfer concerning you, or information as to where they may be consulted, by writing to dpo@kuno-ai.com.
10. Retention
We keep your personal data only for as long as necessary for the purposes described in this Policy.
Data processed on behalf of your organisation including your profile, assessment results, sessions, transcripts, AI-generated outputs and knowledge base content is retained for the duration of your organisation's contract with us, and in accordance with the retention period it configures. Your organisation determines how long this data is kept and may request its deletion at any time. At the end of the contract, we return or delete this data in accordance with our Data Processing Agreement.
11. Your rights
Under the GDPR and the French Data Protection Act (loi n° 78-17 du 6 janvier 1978), you have the following rights in respect of your personal data :
Access : obtain confirmation as to whether we process your data and receive a copy of it (Art. 15)
Rectification : have inaccurate or incomplete data corrected (Art. 16)
Erasure : have your data deleted where one of the grounds in Art. 17 applies
Restriction : have processing restricted in the circumstances set out in Art. 18
Portability : receive data you have provided in a structured, commonly used and machine-readable format, and have it transmitted to another controller, where processing is based on consent or contract and carried out by automated means (Art. 20)
Objection : object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Art. 21(1))
Withdrawal of consent : withdraw your consent at any time, as easily as it was given, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3))
Post-mortem directives : issue directives on the retention, erasure and communication of your data after your death (Art. 85 of the French Data Protection Act)
Direct marketing. You may object at any time and without justification to the processing of your data for direct marketing purposes. You may do so using the unsubscribe link in any marketing email, or by contacting us at the address below.
How to exercise your rights. Write to dpo@kuno-ai.com. We may ask you for additional information to verify your identity where we have reasonable doubts as to who you are, we will not use that information for any other purpose.
Response times. We respond free of charge within one month of receipt of your request. That period may be extended by a further two months where the request is complex or where several requests have been received, in which case we will inform you within the first month and explain why. Where a request is manifestly unfounded or excessive, in particular because of its repetitive character, we may charge a reasonable fee or refuse to act, giving reasons.
Employee data. Where your employer is the controller, in particular for programmes, assessments, sessions and learning profiles, we act as processor and cannot act on your request on our own initiative . Please contact your employer directly. If you write to us, we will forward your request to them without undue delay, inform you that we have done so, and assist them as required under our Data Processing Agreement.
Complaints. You may lodge a complaint with your local supervisory authority. Our lead supervisory authority is the CNIL: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr.
12. Cookies and similar technologies
We use cookies and similar technologies. Some are necessary for authentication, security and the proper functioning of the Services; others, such as analytics, are placed only with your consent.
Full details. The trackers we use, their purpose and lifespan, and how to give or withdraw your consent are set out in our Cookie Policy.
13. Security
We implement appropriate technical and organizational measures, including TLS in transit, encryption at rest on major AWS data stores, access controls and role-based permissions, network controls, logging/monitoring, and vendor DPAs. No method of transmission or storage is 100% secure; we continuously improve our controls.
Access by our teams to your data
Our engineering and support teams may access your data where necessary to resolve an incident, respond to a support request or maintain the Services.
Such access is limited to authorised personnel and to the data strictly necessary, subject to confidentiality obligations. It is not used for any other purpose.
Where we act on behalf of your organisation, such access takes place under our Data Processing Agreement.
14. Children
The Services are intended for use by professionals within organisations and are not available to individuals under 18 years of age. Under their agreement with us, customers undertake not to provision users below that age.
We do not knowingly collect personal data relating to persons under 18. If we become aware that such data has been collected, we will delete it without undue delay and inform the relevant customer.
If you believe that a person under 18 has been given access to the Services, please contact us at dpo@kuno-ai.com.
15. Changes
We may amend this Policy from time to time. The amended version will be published on this page with a revised "last updated" date and will take effect upon publication, save where a longer period is required by applicable law or by contract.
Where an amendment materially affects the processing of personal data, and in particular where it introduces a new purpose, a new lawful basis, a new category of recipient or an extension of the retention period, we will provide prior notice by email or through the Services within a reasonable period before the amendment takes effect. Where such an amendment relies on consent, we will obtain that consent before the processing begins.
Where we act as processor on behalf of a customer, amendments to this Policy do not vary the terms of the applicable Data Processing Agreement, which prevails.
Previous versions are available on request.
16. Contact
Kuno SAS
122 rue Amelot, 75011 Paris, France
dpo@kuno-ai.com