Privacy policy

Last updated: November 5, 2026

This English version is provided for convenience only. The French version is the only legally binding one and prevails in case of any discrepancy.

Who is responsible for your data

KOKONO TECHNOLOGY - Establishment (Abu Dhabi, United Arab Emirates), reachable by email at bonjour@kokono.tech, is the controller of merchants’ data (account and subscription).

For end-customer data recorded by a merchant as part of their loyalty program, the merchant is the controller and KOKONO acts as a processor, on their behalf and on their instructions.

Data protection contact: Anouar Moumen, bonjour@kokono.tech. All requests are handled by email.

Legal framework

Data is processed in accordance with United Arab Emirates Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.

Data collected

As part of the service, we process:

merchant data: name, email, phone, information about their business and subscription;
end-customer data, recorded by the merchant for the purposes of the loyalty program: name, phone number, and where applicable email, birthday and title (Mr / Mrs, declared by the customer);
anonymized audience-measurement technical data (see “Cookies and audience measurement”).

Legal bases for processing

Each processing activity relies on one of the following legal bases:

managing the merchant account and providing the service: performance of the contract;
recording of end customers by the merchant: the end customer’s consent, collected by the merchant;
special offers emailed on behalf of the merchant: the end customer’s express consent (optional box, unticked by default, at sign-up), which can be withdrawn at any time via the unsubscribe link in every email;
invoicing and accounting obligations: legal obligation;
security, fraud prevention and audience measurement: legitimate interest.

Purposes

Data is used solely to provide the loyalty service, manage the subscription, provide support and improve the service. It is never resold.

Recipients and processors

To provide the service, we use providers who only use the data on our instructions and are bound by confidentiality:

Supabase — database hosting and authentication (European Union region);
PostHog — audience measurement, European instance (cookie-free configuration);
Anthropic — AI generation of text suggestions;
Stripe — card payment processing;
Resend — email delivery;
technical providers for hosting and delivery of the application.

International data transfers

Customer data is hosted in a European Union region. As KOKONO is established in the United Arab Emirates, it accesses the data from there to provide the service, and some providers (e.g. Anthropic) may process data in the United States. These transfers are covered by appropriate contractual safeguards.

Retention periods

Retention periods are as follows:

merchant account data: for the duration of the contractual relationship, then 3 years for prospecting purposes, unless objection;
end-customer data: until deleted by the merchant or 3 years without interaction;
billing data: 7 years (accounting and tax obligations applicable in the United Arab Emirates);
audience measurement: 13 months.

Cookies and audience measurement

The site does not use advertising cookies or third-party trackers for marketing purposes. Audience measurement is carried out with PostHog in a cookie-free configuration (no data persisted on your device), which does not require a consent banner. Only cookies strictly necessary for operation (session, security) are set.

KOKONO Pro mobile app

The KOKONO Pro app is reserved for merchants and their employees. It uses the same account as the kokono.tech website: no account can be created in the app.

Camera: used only to read the QR code on a customer's loyalty card. No photo or video is stored or transmitted.
Face ID or fingerprint: unlocking is handled entirely by the phone's operating system. KOKONO never receives or stores biometric data.
On-device storage: the login session is kept in the phone's secure storage. Recently viewed data (24 hours at most) and visits scanned offline (12 hours at most, until they are sent) are kept temporarily and erased on sign-out.
No advertising tracking: the app contains no ads, no advertising trackers and no audience-measurement tools.
Account deletion: a request can be made in the app (Réglages, then « Supprimer mon compte ») or by email to bonjour@kokono.tech. It is processed within 30 days.

Your rights

You have the right to access, rectify, erase, restrict, object to and port your data. To exercise them, write by email to bonjour@kokono.tech: we reply within one month.

You may also lodge a complaint with the UAE Data Office.