Privacy notice
This notice says what personal data Kalimbanumero processes, why, for how long, and your rights, as the Swiss Federal Act on Data Protection (FADP) requires, and the EU General Data Protection Regulation (GDPR) where it applies.
1. Who is responsible
Loïc Berthod, Rte de Nax 43, 3979 Grône, Switzerland — contact@kalimbanumero.com.
2. Without an account
You can read every tab, watch every video and download every PDF without an account or an email address. Then no personal data is stored about you.
- Anonymous counts. The site counts, per song and per day, how many times a video is started and watched to the end, a PDF is opened and a tab is copied: numbers only, without any cookie or identifier. Purpose: knowing which songs are used, to improve them and choose the next ones.
- Anonymous visit counts, without cookies. Each page tells our own server (in Switzerland) which page was seen, for how long, from which site you came (only its name, for example “instagram.com”), the tag of the link you followed if it has one (utm_source, utm_campaign, ref), and your device type (phone, tablet or computer), browser, system, language and time zone. To count a person once a day, the server makes a scrambled code from your IP address and your browser's identification string, mixed with a random key of the day; this code and the key stay in the server's memory only, are never written to disk, and are replaced each new day. Only totals per day are kept, never a list of visits or visitors. Your IP address is also used in memory for at most one hour to limit abuse. (Where the GDPR applies: legitimate interest, art. 6 para. 1 let. f GDPR.)
- In your browser. If you subscribe to the emails, a mark (
kn_news, local storage) keeps the form from being shown to you again. In the administrator's own browser only, a mark (kn_me) keeps their visits out of the counts. - No tracking. No advertising, no analytics company, no social network plugin, no fonts or scripts loaded from another company. The links to our pages on social networks are plain links: nothing is loaded from these networks unless you click them.
3. New tabs by email — only if you ask
If you give your email address in the “New tabs by email” form (or tick the box at sign-up or on your account page), we keep that address, the date, and where you said yes. Before the first email, we send one message to confirm that the address is yours (double opt-in); only once you click its link do we email you, about once a month at most, when new songs are added: nothing else, no advertising for others. Every email says who sends it and has an unsubscribe link: it opens a page where one button stops the emails (two clicks); mail apps that show an “ unsubscribe ” button use the same link.
How long. Without an account, we keep your address, the date and where you subscribed, and a random key for the links, until you unsubscribe; then they are erased. An address whose confirmation link is never clicked receives nothing more and is erased after 30 days. [TODO Loïc: the server does not erase unconfirmed addresses yet — add the 30-day purge, or change this sentence.] With an account, see section 4.
Sending service. The emails are sent through the mail servers of Infomaniak Network SA (Geneva, Switzerland), which handles them on our behalf as a processor, in Switzerland.
Email log. For each email sent we keep a copy in a log: the address, the kind of email, its subject and its text, the date, and whether it was sent or the error. Purpose: proving what was sent and to whom (your consent, the confirmation), and dealing with bounces and complaints. This log is kept for 2 years, then erased.
(Where the GDPR applies: your consent, art. 6 para. 1 let. a GDPR, which you can withdraw at any time.)
4. With an account
One account for Kalimbanumero, Pianumero and Typiano. The three sites are run by the same publisher on the same server, with the same accounts: you can log in on any of them with the same email and password. What you do on each site, and your email choices, are kept apart per site.
| Data | Why | How long |
|---|---|---|
| Email address | To log you in; to answer you if you write | Until you delete your account |
| Name you choose | To greet you | Until you delete your account |
| Password | To log you in. Only a scrypt hash is stored, never the password itself | Until you delete your account |
| The site where you created the account | To count new accounts per site | Until you delete your account |
| Session (a random token; only its hash is stored) | To keep you logged in | 60 days, or until you log out |
| Date of your last visit | To count active accounts | Until you delete your account |
| Your answer to “Email me new tabs” (yes or no, when, where, when confirmed) | To email you only if you said yes | Until you delete your account |
| If you said yes: a random unsubscribe key | For the unsubscribe link in each email | Until you unsubscribe or delete your account |
Legal basis where the GDPR applies: the performance of the service you asked for (art. 6 para. 1 let. b GDPR). Your data is never sold, rented, shared with third parties or used for advertising. There is no profiling and no automated decision about you.
5. Security logs and backups
To protect the site, the server records failed logins and refused requests, with the IP address and, for a failed login, the email address that was typed. These records are erased after 30 days. The database is backed up every night on the same server, readable only by the administrator; each backup is erased after 14 days. (Where the GDPR applies: legitimate interest in the security of the service, art. 6 para. 1 let. f GDPR.)
6. Who else sees your data
The administrator (Loïc Berthod) sees the list of accounts and subscribers to run the sites and answer you. Infomaniak Network SA (Geneva, Switzerland) hosts the site and sends the emails on our behalf, as a processor. Nobody else. Your data stays in Switzerland.
7. Cookies
One cookie only, pn_session, set when you log in: it keeps you logged in, is strictly necessary for
the account to work, is sent only to our own server (secure, not readable by scripts) and is deleted when you log
out. No cookie is set if you do not log in, so there is no cookie banner.
8. Security
Encrypted connections (HTTPS with HSTS), passwords stored as scrypt hashes, sessions stored as hashes, limits on login attempts, access to the server restricted to its administrator.
9. Your rights
- Access (FADP art. 25, GDPR art. 15) and portability (FADP art. 28, GDPR art. 20): My data, on your account page, downloads everything your account holds, in a common machine-readable format (JSON); without an account, write to us.
- Correction (FADP art. 32, GDPR art. 16): change your name on your account page; for anything else, write to us.
- Erasure (FADP art. 32, GDPR art. 17): Delete my account, on your account page, erases your account on all three sites at once. To be removed from the email list without an account, use the link in any email or write to us.
- Restriction (GDPR art. 18): you can ask us to keep your data without using it, for example while you contest it.
- Objection (GDPR art. 21): you can object at any time to the processing based on our legitimate interest (the anonymous visit counts and the security logs, sections 2 and 5); write to us and we stop it for you unless we have compelling reasons (such as defending against an attack).
- Withdrawing consent (GDPR art. 7 para. 3): unsubscribe at any time; what was done before stays lawful.
- You can write to contact@kalimbanumero.com for any request; we answer within 30 days.
- You can complain to the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch) or, in the EU, to your national data protection authority.
10. Representative in the EU
The publisher is in Switzerland and has not designated a representative in the European Union (GDPR art. 27): the site's processing is occasional, does not include sensitive data on a large scale, and is unlikely to result in a risk to people's rights (art. 27 para. 2 let. a). You can write to us directly at contact@kalimbanumero.com. [TODO Loïc: check this exemption once; designate a representative if the audience in the EU grows a lot.]
11. Children
The site is for everyone and can be used without an account. A child under 16 should give an email address or create an account only with the agreement of a parent or guardian.
12. Changes
If this notice changes, the new version is published here with its date.
Last updated 2026-10-24. Legal notice · Terms of use