Legal

Privacy policy

Last updated: 9 October 2026

In short: we use only what is strictly necessary to handle your request. No advertising, no resale, no advertising trackers; only anonymous, cookie-free audience measurement. You can ask us to erase everything at any time.

1. Controller

Kordix Studio, a sole proprietorship established in Switzerland, operated by , . Contact for any question about your data: .

Your data is processed in accordance with the Swiss Federal Act on Data Protection (FADP) and, because the website is also aimed at people in the European Union, the GDPR. It is hosted in the European Union (Germany), a country that Switzerland recognises as offering adequate protection.

2. Data used

What	Why	How long
Billing identity (when signing a quote): first and last name, billing address, country, and for a business the company name and its company number (SIRET, UID, VAT no.…)	Draw up the signed quote and invoices with the details required by law	Duration of the service, then 10 years (accounting records)
Your account: first and last name, display name (optional), email address (and whether it is verified), phone number if you provide it, hashed password (unreadable, even for the Studio), creation and last login dates, preferences (emails, DMs)	Log you in, secure your account, link your requests, notify you of your projects' progress	As long as your account exists; deleted on request or automatically after 3 years without login (if no order needs to be kept)
Login with Google (if you choose it): Google ID, email address, name and profile picture ("openid", "email", "profile" permissions only)	Log you in without a password	Same as your account
Login with Discord (if you choose it): ID, username, display name, avatar, and your Discord account's email address if Discord has verified it ("identify" and "email" permissions only)	Logging you in, linking your requests, sending you your quotes, invoices and codes by email, sending you DMs about your projects	Same as your account
Linked accounts (if you choose it in "My account"): link between your Kordix account and your Discord or Google account (their ID, and for Discord your username and avatar)	Logging in with several methods to the same account	Until you unlink it, or as long as your account
Verification codes: 6-digit code sent by email (stored in hashed form)	Verify your address, reset your password	15 minutes
Account security log: logins, failed logins, password or email changes (date and type, without IP address)	Protect your account, detect abuse	1 year
Your request: server name and link, number of members, project description, chosen plan and modules, timeframe, email if you provide it	Study your project, prepare and send the quote	3 years after the last exchange if no quote is accepted
Quotes, acceptance and messages: quote lines and amount, date and account of acceptance, messages exchanged	Perform the contract, keep proof of the agreement	Duration of the service, then 5 years (limitation period); accounting records 10 years
Signature and contract follow-up: signed version of the quote and its fingerprint, date and time, capacity (private individual or business), payments, cancellation period, refunds, contract status and reasons for any suspension, action log	Prove the agreement, perform the contract, handle cancellations and disputes, comply with the law	Duration of the service, then 5 years; accounting records 10 years
Promo codes: code used, discount, order concerned	Apply the discount, enforce its limits	Same as the order
Affiliate programme (if you apply): name or username, email, channel, platform, link, audience, statistics, commissions and payments	Review the application, manage the programme, pay commissions, fight fraud	Duration of the partnership, then 5 years; accounting records 10 years
Arrival through an affiliate link: affiliate ID (cookie), date of first login, age of your account (creation date, or derived from the Discord ID)	Attribute the order to the right affiliate, detect fake accounts and self-referral	Attribution period (60 days by default), then same as the order if there is one
Technical data: IP address in server logs, anti-spam limits in memory, counting of affiliate clicks (anonymous fingerprint recalculated every day, never stored on disk)	Website security, protection against abuse and click fraud	A few days at most
Anonymous audience measurement: pages viewed, time spent, scrolling, elements clicked and click position (never what you type), parts of pages viewed, quote steps, the site you came from, country (deduced without keeping the IP address), language, device type, browser and screen size. No link with your account; the visitor is an anonymous fingerprint recalculated every day	Understanding how the site is used and improving it	13 months

The Studio never receives your Google or Discord password, nor your Discord servers or messages. If your account already has an email address, the Discord one does not replace it; if an identical, verified address already exists on a Kordix account, your Discord account is linked to it automatically. The phone number is optional and is never used for advertising.

3. Legal bases

Performance of the contract and pre-contractual measures (account, request, quote, service, emails and DMs about your projects), the legal obligation to keep accounting records, and the Studio's legitimate interest in securing its site and accounts (security log, anti-abuse limits) and in anonymously measuring how the site is used in order to improve it. The Studio sends no advertising emails; emails about your projects can be turned off in "My account".

4. Who has access

Only the Studio team. An affiliate never sees the identity of the clients they referred (only amounts and dates). No data is sold or used for advertising. If you pay online, payment is processed by Stripe: the Studio never sees your card number. Technical providers necessary for operation:

IONOS SE (server hosting, in Germany: Elgendorfer Str. 57, 56410 Montabaur);
Cloudflare (routing and protection of the website, and supply of the library that creates the PDFs);
Discord (login with your account, and private messages from the bot about your projects, which you can turn off in your space);
Google (login with your Google account, if you choose it);
An email sending provider (sending verification codes and emails about your projects): ;
Stripe (online payment of invoices, if you choose this method);

Some of these providers may process data outside the European Union, with the safeguards provided for by the GDPR (standard contractual clauses).

5. Cookies

The website uses no advertising or audience measurement cookies. Only necessary cookies:

kordix_session: keep you logged in (30 days);
kordix_state and kordix_gstate: secure login with Discord or Google (10 minutes);
kordix_aff: only if you arrive through an affiliate's link. It contains only that affiliate's ID (nothing about you) and is used to attribute your possible order to them (60 days by default). You can delete it at any time in your browser.

During login, your form in progress is kept in your browser (session storage) so it isn't lost, then erased. PDFs are generated directly in your browser.

For audience measurement, a random visit identifier (with no link to you) is kept in your browser for as long as the tab is open (session storage), then deleted. Measurement is turned off if your browser sends the "Do Not Track" or "Global Privacy Control" signal.

6. Your rights

You can change your name, email and phone number, and delete your account yourself in "My account". You can also ask to access, correct, erase your data, restrict its use, object to it or retrieve it, by writing to or via the messaging in your space. Reply within one month. Data linked to an accepted quote may be kept for the period required by law. You can also lodge a complaint with a data protection authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the European Union, the authority of your country (the CNIL in France, the APD in Belgium, the CNPD in Luxembourg…).

7. Security

Encrypted connection (HTTPS), passwords hashed with scrypt and a unique salt, verification codes hashed and time-limited, temporary lockout after several failed attempts, signed session that you can end on all your devices, alert email when your password or address changes, admin access reserved for the Studio team (Discord login only), and no secrets (keys, webhooks) in the website's code.

8. Changes

This policy may change; the date at the top of the page shows the last update.