Privacy policy
Last updated: 16 September 2026
This document says what Kaonty does with your data: which data, why, where it is stored, for how long, and what you can demand. It is written to be read, not to be accepted without being read.
Who is responsible
Kaonty MG — sole proprietorship
Antananarivo, Madagascar
contact@kaonty.mg
For any request concerning your data, write to that email address. The postal address will be published in the legal notice once registration is complete.
Two roles not to be confused
Kaonty handles two kinds of data, and its role is not the same for both:
- Your own data, as our subscriber: your account, your profile, your subscription. There, we are the data controller, and this document applies directly.
- Your clients' data, which you enter in order to invoice them: their name, their address, their telephone number, their email. There, you are the controller — you decide what you collect and why. We merely host it on your behalf, and never exploit it for ourselves.
What we collect
| Category | Contents | Why |
|---|---|---|
| Account | surname, first name, email address, password (hashed), two-factor authentication secret | to identify you and protect access |
| Issuer profile | business name, address, telephone, NIF, STAT, logo, stamp, bank details | to appear on the invoices you issue |
| Business data | your clients, your products, your stock, your invoices, your deeds of sale | the service itself |
| Subscription | due dates, payments made | to know what is owed, and when |
| Technical | server logs, IP address, date and time of logins | security and fault diagnosis |
We keep no payment card or account details. Payment for a subscription goes through a payment provider, on its own pages: your mobile money number or your card number never passes through Kaonty.
What we do not do
- We sell your data to no one, nor that of your clients.
- We display no advertising and install no advertising tracker.
- We do not measure your audience and do not follow your browsing.
- No other Kaonty user can see your data.
Where your data is stored
Kaonty is hosted by Simafri, a Malagasy company, but its servers are located in the United Kingdom. Your data is therefore stored outside Malagasy territory.
We tell you this plainly because it is a fact that matters, and because Law No. 2014-038 on the protection of personal data governs such transfers. The corresponding formalities with the CMIL (Commission Malagasy de l'Informatique et des Libertés) are under way; this page will be updated once they are completed.
Who else has access
- Simafri, our host, which stores the files and the database without exploiting them.
- Sentry, our fault-detection tool, configured to receive neither your identity, nor your IP address, nor the content of your requests — only the technical description of the error. No session recording, no journey tracking.
- Our payment provider, for subscription payments.
- Ourselves, for support, and only when it is necessary in order to answer your request.
How long we keep it
| Data | Period |
|---|---|
| Active account | as long as the account exists |
| After a deletion request | 30 days, then permanent erasure. This delay protects against a deletion made by mistake — or decided by someone who had got into your account without your agreement. |
| Inactive account with no subscription | deleted after 12 months without a login, with a warning 30 days before and a reminder 7 days before |
| Technical and administration logs | 12 months |
| Invoices Kaonty issues to you | 10 years — these are our own accounting records, kept independently of your account |
| Backups | according to our host's rotation cycle. Erased data may survive there for a few days before the copy is overwritten in its turn. |
Cookies
Kaonty places three things in your browser, all of them essential to running the service:
| Name | Role | Duration |
|---|---|---|
| kaonty_session | to keep you logged in from one page to the next | the session |
| XSRF-TOKEN | to prevent another site from performing an action in your name | the session |
| kaonty.locale | to remember the language you have chosen | until erased |
No consent banner, and that is deliberate. A banner exists to collect your agreement for cookies you might refuse — audience measurement, advertising, tracking. We place none of those. Asking your permission for a session cookie, without which logging in is impossible, would be offering you a choice that does not exist. The day we add audience measurement, a real banner will appear, with a real refusal available.
How your data is protected
- Everything goes over HTTPS, end to end.
- Passwords are never stored in clear text: only an irreversible fingerprint is. Nobody here can read your password.
- Two-factor authentication is mandatory for every account.
- Every request is checked on the server: one user cannot reach another's data, even by altering an address in their browser.
- Administration actions are logged.
Your rights
At any time you may:
- consult the data we hold about you;
- correct it, from your settings or by writing to us;
- obtain a copy of it in a usable format, including your clients and your history;
- ask for its erasure, under the conditions described above;
- object to a processing operation, or ask for it to be restricted.
One address for all of this: contact@kaonty.mg. We answer within 30 days. Write from the account's address — we check that it really is you before acting, precisely because “it's me, erase everything” is also what somebody else would say.
If your clients ask you for their data
Your clients address themselves to you, not to us: you are the one who recorded them. We help you find, correct or erase what concerns them if you cannot work out how.
Changes
This document will change along with the service. Any significant change will be announced to you by email. The date at the top of the page always indicates the version in force.