Privacy Policy
Effective date: April 20, 2026
Last updated: April 20, 2026
Kicker is a message-testing platform that helps founders and entrepreneurs identify which value propositions resonate with real audiences. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and what rights you have over it.
Identity of the Data Controller
Billy SAS
SIREN: 905 149 316
Contact: contact@kicker.run
1. Scope of This Policy
This Privacy Policy applies to all users of the Kicker platform, accessible at kicker.run, regardless of their country of residence. It covers all personal data processed by Kicker when you create an account, use the platform, connect third-party services, or contact us. It does not apply to third-party services you may connect to Kicker, which are governed by their own privacy policies.
2. Data We Collect
2.1 Account data
When you create a Kicker account, we collect your full name, your email address, and your password. Your password is stored exclusively in hashed form. We never store or access your password in plaintext.
2.2 Usage data
When you use Kicker to create and run message tests, we collect and store the ideas, messages, and value propositions you submit for testing; your target audience configuration (sector, geography, and interests as defined by you); the results of your test campaigns (impressions, clicks, click-through rate, cost per result, and lead capture counts); and your subscription tier and credit balance.
2.3 Technical and log data
We collect standard server logs for security and debugging purposes, including IP address, browser type and version, pages and features accessed within the platform, and date and time of access. This data is never used for advertising, profiling, or any purpose beyond platform security and stability.
3. Purposes and Legal Bases
We process your personal data only for specific, explicit, and legitimate purposes. For each purpose we indicate the corresponding legal basis under Article 6 of the GDPR.
Operating your Kicker account and delivering the service you have requested.
Legal basis: performance of a contract (Art. 6.1.b GDPR).
Creating and running test campaigns on advertising platforms on your behalf, retrieving performance results, and displaying them in your dashboard.
Legal basis: performance of a contract (Art. 6.1.b GDPR).
Processing your subscription payments and managing your credit balance.
Legal basis: performance of a contract (Art. 6.1.b GDPR).
Sending transactional communications: account confirmation, campaign results, billing receipts, and service notifications.
Legal basis: performance of a contract (Art. 6.1.b GDPR).
Ensuring platform security, preventing unauthorized access, and maintaining system stability.
Legal basis: legitimate interest (Art. 6.1.f GDPR).
Complying with applicable accounting and tax obligations.
Legal basis: legal obligation (Art. 6.1.c GDPR).
Sending optional product updates or newsletters, where you have given your explicit consent.
Legal basis: consent (Art. 6.1.a GDPR). You may withdraw consent at any time without affecting the lawfulness of prior processing.
We do not use your data for behavioral advertising, automated profiling, or any decision-making that produces legal or similarly significant effects on you.
4. No Sale or Distribution of Your Data
Kicker does not sell, rent, license, trade, or otherwise distribute your personal data to any third party for their own commercial purposes, under any circumstances. This commitment is unconditional. It applies regardless of your subscription tier, your usage volume, or any commercial relationship we may have with third-party platforms. Your data exists in Kicker to power your tests and nothing else.
5. Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, subject to applicable legal obligations.
Account data (name, email): retained for the duration of your account, and for 3 years after account deletion for legal compliance purposes.
Usage and campaign data (ideas, messages, results): retained for the duration of your account. Deleted within 30 days of account deletion upon your request.
Billing records: retained for 10 years, as required by French commercial law (Code de commerce, Art. L. 123-22).
Server logs: retained for a maximum of 12 months.
You may request deletion of your account and associated data at any time by contacting contact@kicker.run. We will process your request within 30 days, subject to retention obligations required by law.
6. Your Rights
Under the GDPR and, where applicable, the French Data Protection Act (loi Informatique et Libertes), you have the following rights with respect to your personal data:
Right of access (Art. 15 GDPR): you may request a copy of all personal data we hold about you.
Right to rectification (Art. 16 GDPR): you may request correction of inaccurate or incomplete data.
Right to erasure (Art. 17 GDPR): you may request deletion of your data, subject to legal retention obligations.
Right to restriction of processing (Art. 18 GDPR): you may request that we limit how we use your data in certain circumstances.
Right to data portability (Art. 20 GDPR): you may request your data in a structured, commonly used, and machine-readable format.
Right to object (Art. 21 GDPR): you may object to processing based on our legitimate interest.
Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, contact us at contact@kicker.run. We will respond within 30 days of receiving your request. If you are not satisfied with our response, you have the right to lodge a complaint with the competent supervisory authority:
Commission Nationale de l'Informatique et des Libertes (CNIL)
3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07
www.cnil.fr
7. Data Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of all data in transit using TLS 1.2 as a minimum, encryption of data at rest, hashed password storage with no plaintext equivalent retained, OAuth 2.0 token-based access for connections to third-party advertising platforms with no permanent storage of your credentials, access to personal data restricted to authorized personnel on a strict need-to-know basis, and regular review of our security practices.
In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay in accordance with Art. 34 GDPR.
8. Cookies
Kicker uses strictly necessary cookies to maintain your authenticated session. These cookies are essential to the operation of the platform and cannot be disabled without preventing you from using the service.
We do not use third-party tracking cookies, advertising pixels, or analytics tools that share your data with external parties. If we introduce optional analytics in the future, we will update this policy and request your prior consent where required by applicable law.
9. Minors
Kicker is intended for use by adults only. The platform is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that a minor has provided us with personal data without appropriate consent, we will delete that data promptly. If you believe a minor has created an account, please contact us at contact@kicker.run.
10. Sub-processors and Third-Party Platforms
To operate the Kicker service, we work with a limited number of carefully selected sub-processors. Each sub-processor is bound by data processing agreements consistent with GDPR requirements. We do not allow any sub-processor to use your data for their own commercial purposes.
10.1 Infrastructure: Supabase
Supabase, Inc. provides the database and authentication infrastructure that powers Kicker. Your account data, usage data, and campaign results are stored in Supabase. Where available, data is stored in EU-region servers. Supabase processes your data solely on our instructions and in accordance with our data processing agreement.
Supabase privacy policy: supabase.com/privacy
10.2 Payments: Stripe
Stripe, Inc. handles all payment processing on behalf of Kicker. When you purchase a subscription or credits, your payment details are entered directly into Stripe's secure environment. Kicker does not receive, store, or process your card number or any payment instrument details. Stripe provides us only with a transaction confirmation and your subscription status.
Stripe privacy policy: stripe.com/privacy
10.3 Advertising platforms
Kicker creates and runs test campaigns on advertising platforms on your behalf. To do so, Kicker connects to the API of the platform you have chosen, using the credentials you provide via OAuth. Kicker accesses only the data strictly necessary to create the campaign and retrieve its performance results. We do not access your personal profile, your contacts, your messages, or any data beyond campaign management and metrics.
The advertising platforms currently supported by Kicker include Meta (Facebook and Instagram), Google Ads, and LinkedIn. Each platform governs its own data practices through its own privacy policy and terms of service, which apply independently of this document. We encourage you to review them:
Meta: facebook.com/privacy/policy
Google: policies.google.com/privacy
LinkedIn: linkedin.com/legal/privacy-policy
Kicker does not store your advertising platform credentials beyond the duration of your active session. OAuth access tokens are stored securely and used exclusively to execute the test campaigns you have configured.
11. International Data Transfers
Some of our sub-processors are based in the United States. Where your personal data is transferred outside the European Economic Area (EEA), we ensure that appropriate safeguards are in place in accordance with Chapter V of the GDPR. These safeguards include Standard Contractual Clauses (SCCs) approved by the European Commission, and adequacy decisions issued by the European Commission where applicable.
You may request a copy of the applicable transfer mechanisms by contacting contact@kicker.run.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, our service, or applicable law. When we make changes, we will update the effective date at the top of this document. Where changes are material, we will notify you by email at least 14 days before they take effect. Your continued use of Kicker after that date constitutes acceptance of the updated policy. If you do not agree with the changes, you may delete your account before they take effect.
13. Contact
For any question, request, or complaint relating to this Privacy Policy or the processing of your personal data:
contact@kicker.run
Billy SAS, SIREN 905 149 316