Privacy Policy

1. Company & Scope

1.1 Data Protection Officer (DPO) or Privacy Contact

We currently do not have an official, separate DPO. However, you may contact us regarding any privacy matters at privacy@guaeca.fr. In some cases, our CEO also acts as the DPO for the moment.

1.2 Compliance with Major Privacy Laws

We comply with both the GDPR (General Data Protection Regulation) and the CCPA (California Consumer Privacy Act). We also process requests from users worldwide.

1.3 Global User Base

We process and store data for users from all around the world. By using our services, you acknowledge that your data may be transferred and processed globally, subject to the safeguards described in this Policy.

2. Data Collected & Method of Collection

2.1 Categories of Personal Data Collected

We may collect personal data such as payment information (via Stripe) and other data through Google Cloud services. This typically includes, but is not limited to, your name, email address, and payment details when you engage in transactions.

2.2 Sensitive Data

We do not intentionally collect any sensitive personal data (e.g., health information, biometric data). If you believe you have submitted such information inadvertently, please contact us at privacy@guaeca.fr to have it removed.

2.3 Methods of Collection

We collect data through forms, analytics tools, and cookies (if enabled). Payment details are processed via Stripe, while additional data may pass through Google Cloud APIs for storage or analytics.

2.4 Third-Party Services

We integrate with Stripe (for payments), Google (for analytics, hosting, and APIs), and other similar providers. These services may collect data in accordance with their own privacy policies.

2.5 Cookies & Cookie Policy

We use Google Analytics 4 to analyze website traffic and user behavior. This service uses cookies to collect anonymous usage data. We have configured Google Analytics with privacy-friendly settings including EU data residency, IP anonymization, and disabled advertising features. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

Beyond analytics cookies, we do not use any other tracking cookies. We only use essential cookies required for basic website functionality.

3. Purpose & Legal Basis for Processing

3.1 Purposes of Data Collection

We collect personal data for user account management, personalized services, analytics, security, and to process payments (if applicable).

3.2 Legal Bases (GDPR)

Our data processing is typically based on:

• Legitimate Interest for analytics, improvements, and providing a secure environment.
• Contractual Necessity when we create and maintain user accounts or process payment transactions.

In certain cases, we may also rely on Consent, especially for optional marketing.

3.3 Targeted Advertising & Marketing

We may send email marketing only to users who explicitly opt in. We do not engage with third-party ad networks for targeted advertising at this time.

3.4 "Sale" of Personal Data (CCPA)

We do not "sell" personal data under the CCPA. However, we may share usage data with analytics providers to help us improve our services.

4. Data Sharing & Disclosure

4.1 Third-Party Providers

We share certain personal data with our hosting provider (Google Cloud Platform), payment processor (Stripe), and Google Analytics.

4.2 Data Processing Agreements (DPAs)

We sign Data Processing Agreements with all providers that handle EU user data to ensure GDPR compliance.

4.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, user data may be transferred to a successor entity subject to this or an updated Privacy Policy.

4.4 Legal Requirements

We may disclose personal data to authorities if required by law, court order, or to protect our rights and comply with legal obligations.

5. International Data Transfers

5.1 Hosting Locations

We primarily host data in the EU. However, we may occasionally transfer user content or requirements to US servers for specific API or LLM-based operations.

5.2 Transfer of EU Personal Data Outside the EEA

We strive not to transfer identifiable EU personal data outside the EEA. If certain operations involve non-EEA servers, we implement appropriate safeguards, including Standard Contractual Clauses (SCCs).

5.3 Safeguards

All such transfers occur within the Google Cloud Platform environment, relying on updated SCCs for cross-border transfers, especially post-Schrems II rulings.

6. Data Retention

6.1 Retention Period

We keep user account data until deactivation, logs for around 3 months, and payment information for 1 year. These periods may be adjusted based on operational or legal requirements.

6.2 Different Retention for Certain Data

For instance, support tickets may be retained for up to 3 years to ensure quality service and to resolve any follow-up inquiries.

6.3 Deletion Requests

Users can request deletion of their personal data by emailing privacy@guaeca.fr or using any account deletion function if available in our settings. We will honor such requests promptly, except where retention is required for legal or regulatory reasons.

7. User Rights (GDPR & Other Jurisdictions)

7.1 Access, Correction, and Deletion

Users can log in to their accounts to correct data or email us for deletion requests at privacy@guaeca.fr. We will confirm your request and proceed if no overriding legal basis prevents it.

7.2 Restricting or Objecting to Processing

Currently, we do not offer an "opt-out" for certain analytics or marketing, but we may consider implementing it in the future. For questions regarding specific objections, please contact us directly.

7.3 Data Portability

Users may request an export of their data in machine-readable format (e.g., JSON, CSV) by sending a message to privacy@guaeca.fr.

7.4 Children's Privacy

Our Service is intended for 18+. We do not knowingly collect personal data from minors. If we discover such data, we will delete it immediately.

8. Security Measures

8.1 Encryption & Access Controls

We use encryption in transit and at rest within Google Cloud Platform. Hosting is managed via GCP, and we employ role-based access controls to limit internal data exposure.

8.2 Data Breach Response

If a data breach occurs that poses a risk to user privacy or data rights, we will promptly notify the affected individuals and relevant authorities (e.g., within 72 hours under GDPR requirements).

9. Updates to This Policy

9.1 Notification of Changes

We may update this Privacy Policy from time to time. In such cases, we will notify registered users via email and may post a banner on our website at least 15 days before the changes take effect.

9.2 Consent vs. Continued Use

If the changes are significant (e.g., new ways of processing your data), we may ask for renewed consent. Minor changes are typically deemed accepted through continued use of the Service.

10. Contact Information & Complaints

10.1 How to Reach Us

For privacy-related questions or complaints, you can reach us via email at:
privacy@guaeca.fr

10.2 Supervisory Authorities

If you reside in the EU and believe your rights under GDPR are not being upheld, you may contact the relevant Data Protection Authority. In France, this is the CNIL.

10.3 Data Protection Officer (DPO)

While not strictly required, we currently have our CEO fulfilling DPO functions for the interim. For more formal inquiries, write to eduardo@guaeca.fr.