Privacy policy
Last updated: 26 October 2026
This English version is provided for convenience. The French version (/confidentialite) is the reference text and prevails in case of discrepancy.
In short
Your work data (clients, jobs, time, rates, costs) stays on your computer: we never receive it. Our server only knows what is needed to manage your account, your subscription and your computers. The plugin sends no usage data.
Data controller
Reality Design — Alan GRAND-GIRARD EI, 4 chemin de Framont, 88600 Fontenay, France. Contact: contact@chroko.fr.
Data processed and purposes
| Data | Why | Legal basis |
|---|---|---|
| E-mail address, password (never readable by us), address confirmation, creation date | Creating and securing your account | Performance of the contract |
| Plan, status and dates of the subscription | Authorizing the use of the plugin | Performance of the contract |
| For each activated computer: computer name, operating system, Adobe app and plugin version, device public key, machine fingerprint (hashed, irreversible), date of last contact | Limiting the subscription to 3 computers, letting you manage them, preventing account sharing | Performance of the contract; legitimate interest (fraud prevention) |
| Stripe customer and subscription identifiers, amounts paid or refunded, dates | Managing the subscription and accounting (your bank card is processed by Stripe, never by us) | Performance of the contract; legal obligation |
| Hourly rate calculator (French version, /taux-horaire), if you ask for your report: e-mail address, date of your consent, figures entered in the calculator | Sending you your report, then 4 tips on pricing (including the presentation of ChroKo); stopped as soon as you become a customer | Consent (checkbox), which you can withdraw at any time with the link in each e-mail |
| Log of operations on the account (activations, deactivations, support actions, with their reason) | Security, handling of complaints | Legitimate interest |
| Website chat, automatic assistant: it answers in your browser, nothing is sent to us; only unanswered questions reach us (text of the question, language, page), with no name, address or identifier | Completing the assistant’s answers | Legitimate interest |
| Website chat, if you write to the team: messages exchanged, prior exchange with the assistant, first name and e-mail address (if given), page you write from, account if you are signed in; your message is passed on to the team by e-mail | Answering you, in the chat or by e-mail | Pre-contractual measures or performance of the contract; legitimate interest (support) |
Recipients and processors
- OVHcloud (OVH SAS, France): hosting of the website, the license server and its database, in France.
- Google (Firebase Authentication): account creation, sign-in, address confirmation and forgotten password e-mails. Some operations may be processed by Google outside the European Union, under the European Commission’s standard contractual clauses.
- Stripe (Stripe Payments Europe, Ireland): payment, subscription, invoices and payment e-mails.
- Browser notification services (Apple, Google, Mozilla or Microsoft, depending on the team’s device): delivery of chat alerts to the team’s devices, end-to-end encrypted; they cannot read their content.
No data is sold or used for advertising.
Retention periods
- Account, subscription and computers: as long as the account exists.
- Rate calculator: the figures entered are deleted as soon as you unsubscribe; the address is deleted 3 years after the last contact (or on simple request).
- Chat: conversations are deleted 12 months after the last message (or on simple request, or with your account); unanswered questions are deleted after 90 days; the address of a conversation reported as spam is kept for 12 months as an unreadable hash, to block further messages from it.
- After the account is deleted: payment records and the audit log are kept under a pseudonym, with no address or identifier, for 10 years, the retention period for accounting records (article L123-22 of the French Commercial Code). Stripe keeps its own payment records according to its policy.
Your rights
You can access your data, correct it, erase it, object to processing based on legitimate interest, restrict its processing and port it. From My account: “Download my data” (JSON file) and “Delete my account” (immediate, subscription cancelled). For any other request: contact@chroko.fr. You can also contact the French data protection authority, the CNIL (cnil.fr).
Security
Encrypted connections, passwords handled by Firebase Authentication (never seen by us), digitally signed offline authorizations, administration access protected by two-factor authentication and recorded in a log, no work data stored on our servers.