Privacy policy

Account data: e-mail address, name (optional), password (stored in encrypted form), Google identifier if you sign in with Google, profile information you choose to provide (company, website, telephone), customer identifier with the payment provider, history of the diagnostics carried out.

Uploaded documents: the documents you upload to enrich a diagnostic (accounts, business plan, association project, activity report) are stored as extracted text, linked to the diagnostic concerned, and deleted together with it.

Company data: diagnostics relate to businesses and associations and rely on public data (data.gouv.fr registers, INPI, BODACC, RNA, JOAFE, France Travail, Aides-Territoires, OpenCorporates, public Google listings and reviews). These data concern the entity analysed, not your account; the directors who appear in them are taken from public registers.

The data are processed for: account management and authentication, producing diagnostics and keeping their history, billing, sending service and lifecycle e-mails, and compliance with legal and accounting obligations.

Legal bases: performance of the contract (provision of the Service and billing), legal obligations (retention of accounting records) and legitimate interest (lifecycle e-mails about your own diagnostics, limited in number and which can be switched off — see section 4).

The data are not sold. They are shared only with the providers needed to operate the Service:

• OVH SAS (France) — hosting, servers in the European Union.
• Stripe — payment processing; the Publisher never has access to full bank card details.
• Brevo — delivery of service e-mails.
• Google — OAuth sign-in (if you choose it) and public data on establishments (listings, reviews).
• Anthropic — generation of the analyses: the data collected on the entity analysed and extracts from uploaded documents are sent to this provider to produce the report.
• DataForSEO — collection of public reviews of the entity analysed.

Where transfers outside the European Union take place (Stripe, Anthropic, Google, DataForSEO), they are governed by the safeguards provided for in Chapter V of the GDPR (standard contractual clauses or an applicable adequacy decision).

The Service sends transactional e-mails (welcome, diagnostic ready) and, at most once a week, lifecycle e-mails about your diagnostics (action plan reminder, invitation to a progress review). The latter include a one-click unsubscribe link; unsubscribing takes effect immediately and does not affect strictly transactional e-mails.

Account data and diagnostics are kept for the duration of the contractual relationship; deleting a diagnostic deletes its collected data and associated documents. Accounting records are archived for the applicable statutory periods.

The Site uses a strictly necessary session cookie (sign-in), which is exempt from consent. No audience measurement or advertising cookie is currently set (see the legal notice).

In accordance with the GDPR and the French Data Protection Act (loi “Informatique et Libertés”), you have the rights of access, rectification, erasure, restriction, objection and portability of your data, which may be exercised by writing to contact@agencealps.com. You may lodge a complaint with the CNIL (French data protection authority, www.cnil.fr).