Privacy Policy
Last updated: June 7, 2026
BBCONCEPT S.A.S.U. ("we", "us", "our") operates the Kribbean mobile application and website (collectively, the "Service"). This Privacy Policy explains how we collect, use, and protect your personal data, and your rights under the General Data Protection Regulation (GDPR) and applicable French law.
1. Who we are
Data Controller:
BBCONCEPT S.A.S.U.
Beauregard, 41 route Morne Mulâtre — 97240 François, Martinique, France
Registered: R.C.S. Fort-de-France, 805 061 603
Contact: privacy@kribbean.com
2. Data we collect
2.1 Account data
When you create an account, we collect:
- Email address
- Display name (optional)
- Authentication method (email/password or social login)
2.2 Preference data
To personalise your experience, we store:
- Language preference (EN/FR)
- Preferred Caribbean zones (e.g. Martinique, Guadeloupe, Jamaica…)
- Preferred music genres
- Theme preference (light/dark)
2.3 Push notification tokens
If you enable push notifications, we store a device token to deliver notifications. You can disable this at any time in your device settings or in Profile → Notifications.
2.4 Usage data
We do not operate our own analytics platform. Our infrastructure providers (listed in §5) may collect standard server logs (IP address, request timestamps, device type) for operational purposes.
2.5 Ticket purchase data
If you purchase tickets through Kribbean, we store the following for order management and legal compliance:
- Event name, ticket type, quantity, and amount paid
- Order status and QR code reference
- Your email address (to send the confirmation)
Payment card data is processed exclusively by Stripe and never reaches our servers. See §5 for details.
2.6 Data we do NOT collect
- We do not collect payment card numbers or banking information
- We do not collect precise geolocation
- We do not create advertising profiles
- We do not sell your data to third parties
3. Legal basis for processing
| Data | Legal basis |
|---|---|
| Account data | Performance of contract (Art. 6(1)(b) GDPR) |
| Preferences | Legitimate interest — personalisation (Art. 6(1)(f)) |
| Push tokens | Consent (Art. 6(1)(a)) — you opt-in via system prompt |
| Server logs | Legitimate interest — security and operations (Art. 6(1)(f)) |
4. How we use your data
- Account data — to create and manage your account, authenticate you, and allow account deletion
- Preferences — to personalise the content, language, and layout of the app
- Push tokens — to send you notifications about events, releases, and editorial content you've opted in to receive
- Server logs — to maintain security, diagnose issues, and ensure service continuity
We do not use your data for automated decision-making or profiling with legal or similarly significant effects.
5. Third-party services and data transfers
We use the following sub-processors. All are bound by data processing agreements:
| Provider | Role | Location |
|---|---|---|
| Supabase | Database, authentication, storage | EU (Europe West) |
| Vercel | Web hosting | EU / Global CDN |
| Stripe | Payment processing for ticket purchases (card data never reaches our servers) | USA (Standard Contractual Clauses) |
| Resend | Transactional email (ticket confirmations, event reminders) | USA (Standard Contractual Clauses) |
| Apple | iOS push notifications, App Store | USA (Standard Contractual Clauses) |
| Android push notifications (FCM) | USA (Standard Contractual Clauses) |
Music platforms (Deezer, Apple Music, iTunes, YouTube, SoundCloud): when you play a preview or access a playlist, your request may be processed by these platforms under their own privacy policies. Kribbean does not share your personal data with music platforms.
6. Data retention
| Data | Retention period |
|---|---|
| Account and preferences | Until account deletion, then 30 days for backup purge |
| Push tokens | Until you disable notifications or delete your account |
| Server logs | 90 days rolling |
When you delete your account (Profile → Delete account), we delete or anonymise all personal data within 30 days, except where retention is required by law.
7. Your rights (GDPR)
You have the right to:
- Access — obtain a copy of your personal data
- Rectification — correct inaccurate data
- Erasure ("right to be forgotten") — request deletion of your data
- Portability — receive your data in a structured, machine-readable format
- Restriction — ask us to limit processing of your data
- Objection — object to processing based on legitimate interest
- Withdraw consent — at any time, for consent-based processing (push notifications)
To exercise any of these rights, contact us at privacy@kribbean.com. We will respond within 30 days.
You also have the right to lodge a complaint with the French data protection authority: CNIL — cnil.fr — 3 Place de Fontenoy, 75007 Paris, France.
8. Children's privacy
The Service is not directed to children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us at privacy@kribbean.com and we will delete it promptly.
9. Local storage
The app stores preference data and a cache of recently viewed content in your device's local storage to enable offline access and faster loading. This data does not leave your device unless synced to your account.
10. Security
We implement appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS/TLS), access controls, and regular security reviews. No system is perfectly secure; we will notify you of any data breach as required by law.
11. Changes to this Policy
We may update this Privacy Policy. Material changes will be communicated via the app or by email. The date of the last update is shown at the top of this page. Continued use of the Service after changes constitutes acceptance.
12. Contact
privacy@kribbean.com
BBCONCEPT S.A.S.U. — Beauregard, 41 route Morne Mulâtre — 97240 François, Martinique, France.
BBCONCEPT S.A.S.U. — Beauregard, 41 route Morne Mulâtre — 97240 François, Martinique, France
privacy@kribbean.com
