Privacy policy

1. Data controller

The data controller is [Company name, legal form, share capital, registered office, trade register and company number, EU VAT number]. For any question about your data: [adresse email de contact].

2. Data processed and purposes

• Account: name, email address, password (stored hashed, never in clear text), language, email verification date. Purpose: create and manage your account (performance of the contract).
• Security: open sessions with IP address and browser, sign-in attempts. Purpose: protect your account and detect fraudulent access (legitimate interest).
• Sites: the configuration of the sites you create (texts, images, colours, sections). Purpose: save, publish and deliver your sites (performance of the contract).
• AI assistant: the text you enter in the assistant and the number of calls per day (IP address for visitors who are not signed in). Purpose: generate the requested content and enforce usage quotas (contract and legitimate interest).
• Payments: orders, offers bought, subscription status, invoices. Card details are entered at Stripe and never reach us. Purpose: invoicing and accounting obligations (contract and legal obligation).
• Emails: address verification, password reset, security alerts and information about your purchases (performance of the contract).

3. Recipients and processors

Your data is available to our team as far as their work requires, and to our processors:

• Stripe (payments and invoicing): Stripe Payments Europe Ltd., Ireland, with possible transfers to the United States under the European Commission's standard contractual clauses.
• Google (Gemini API, content generated by the AI assistant): Google LLC, United States, transfers under the Data Privacy Framework and standard contractual clauses. Do not enter sensitive personal data in the assistant.
• Hosting: [server hosting provider: name, address, country].
• Email delivery: [email delivery provider: name, country].

We neither sell nor rent your data.

4. Retention

• Account and sites: while the account is active, then deleted or anonymised when it is closed.
• Sign-in sessions: at most 30 days after last use.
• Orders and invoices: 10 years, for accounting obligations.
• AI assistant call log and technical logs: [duration to be confirmed].

5. Cookies and local storage

We use no advertising or audience measurement cookies. The only cookies set are needed for the service to work and therefore require no consent:

• sv_access: sign-in token, 15 minutes.
• sv_refresh: keeps you signed in, 30 days.
• NEXT_LOCALE: chosen language.

A site draft created before signing in is kept in your browser's local storage; it is only sent to us if you save it to your account.

6. Security

Encrypted connections (HTTPS), hashed passwords, sessions you can revoke at any time from your account, email alert when a session is used suspiciously.

7. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection, and the right to set instructions about your data after your death. To exercise them, write to [adresse email de contact]. We answer within one month.

If you believe your rights are not respected, you may lodge a complaint with the CNIL (www.cnil.fr) or your local data protection authority.

8. Changes

We may change this policy; the update date is shown at the top of the page. We will email you about any significant change.