Privacy policy

This policy explains which personal data we process, why, for how long, and how to exercise your rights (General Data Protection Regulation, “GDPR”).

Data controller

[TO BE COMPLETED: company name, address] — data protection contact: [TO BE COMPLETED: dedicated e-mail address].

For the data of your customers and prospects (contacts, e-mails, sign-ups on your forms), you are the data controller and we act as a processor: see the data processing agreement (DPA).

Data processed, purposes and lawful bases

Processing	Data	Lawful basis	Retention
Creating and managing the account	e-mail, name, preferences, sign-in log	performance of the contract	lifetime of the account
Providing the Service (agents, websites, e-mails)	content of your businesses, ideas, documents	performance of the contract	lifetime of the account, or until the business is deleted
Billing and subscription	Stripe identifiers, credit history, invoices	legal obligation, contract	10 years for accounting records
Security and abuse prevention	audit log, IP addresses, request rate limiting	legitimate interest	12 months (rate-limit counters: 24 hours)
Moderation of projects	description of the idea, automatic classification	legitimate interest (compliance with the law and our terms)	lifetime of the account, then 12 months if a report is confirmed
Cookieless audience measurement	pages viewed, journey events, technical account identifier	legitimate interest	25 months
Audience measurement with a cookie	anonymous visit identifier	consent	13 months
Error tracking	error messages, without form data or IP address	legitimate interest	90 days
Service e-mails (summaries, approvals)	e-mail	performance of the contract	lifetime of the account

We sell no data and do no targeted advertising.

Artificial intelligence

Your content is sent to Anthropic’s Claude API so that the agents can work. Under Anthropic’s commercial terms, this data is not used to train its models. [TO BE COMPLETED AND CHECKED: retention period at Anthropic under the contract in force.] Each call is logged on our side (model, volume, cost) for transparency and billing.

Processors

Provider	Role	Data location
Supabase	database, authentication	European Union
Vercel	hosting of the app	United States and European Union
Anthropic	AI models (Claude)	United States
Stripe	payments, subscriptions, your businesses’ accounts	European Union (Ireland) and United States
Resend	sending and receiving e-mails	United States [TO BE CHECKED: region]
Inngest	running background tasks	United States
Sentry	error tracking	[TO BE COMPLETED: region chosen when the account was created]
PostHog	audience measurement	European Union
Google	sign-in with a Google account (if you choose it)	United States

Transfers outside the European Union are covered by the European Commission’s standard contractual clauses and, where applicable, by the EU–US Data Privacy Framework. [TO BE COMPLETED: check and list each provider’s safeguards.]

Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability. Directly from your workspace:

• Access and portability: “My account” → “Export all my data” (ZIP file).
• Erasure: “My account” → “Delete my account”. Deletion is immediate and permanent, except for the accounting records the law requires us to keep (invoices at Stripe) and the record of the deletion in our audit log.

For any other request: [TO BE COMPLETED: e-mail address]. You can also lodge a complaint with the CNIL, the French data protection authority (cnil.fr), or with the authority of your country.

Cookies

See the cookie policy.