Privacy Policy

ARTICLE 1 - DATA CONTROLLER

[to be completed] ([to be completed]) is the data controller for the data relating to the relationship with the client boutique: account, billing, use of the portal by the boutique's staff. For the personal data of the boutique's customers processed through the Service (e-mails received and sent, hold, alteration or appointment requests, customer relationship book records), the boutique is the data controller and the Publisher acts as a processor within the meaning of article 28 GDPR, on behalf of and on the instructions of the boutique. A data processing agreement (DPA) is made available to clients. Contact: [to be completed].

ARTICLE 2 - DATA COLLECTED

In the course of operating the Service, the following categories of data are collected and processed:

• Boutique identification data: surname, first name, e-mail address, telephone number, trade name and company name
• Billing data: postal address, SIRET number, payment information (handled by Stripe when card payment is chosen)
• Connected mailbox credentials: app password or OAuth token, stored encrypted and never displayed
• Boutique customer data: content of e-mails received and sent, contact details provided by the customer, requests expressed (item, size, colour, time slot)
• Catalogue and boutique data: items, prices, stock, photographs, policies and documents uploaded by the boutique
• Usage data: login logs, usage statistics, browsing data on the dashboard

ARTICLE 3 - PURPOSES AND LEGAL BASES

The data is processed for the following purposes:

Performance of the contract: Operation of the Service (reading e-mails, drafting replies, tracking requests), user account management, billing.

Legitimate interest: Improvement of the Service, anonymised statistical analysis, prevention of fraud and abuse, security.

Legal obligation: Retention of invoices and accounting data in accordance with the applicable legislation.

ARTICLE 4 - PROCESSORS AND DATA TRANSFERS

The data is processed by the following processors, all contractually bound to comply with the GDPR and all established in the European Union:

The provider of the connected mailbox (for example Google, Microsoft or OVH) is not a processor of the Publisher: it is the boutique's own provider, chosen by the boutique, and the Service accesses it with the authorisations the boutique grants. No other transfer outside the European Union takes place.

• OVHcloud (OVH SAS, France): hosting of the application infrastructure and data (servers, database, cache, vector database, storage of photographs and documents) in a data centre located in France, and sending of the Service's transactional e-mails
• Mistral AI (France): language models and computation of vector representations for drafting replies and searching the knowledge base; no data is used to train models
• Stripe Payments Europe (Ireland): card payment processing, only when this payment method is chosen; as an international group, Stripe may carry out processing outside the European Union, governed by the European Commission's Standard Contractual Clauses (decision 2021/914)

ARTICLE 5 - RETENTION PERIOD

The data is retained for the following periods:

• Account data: for the whole duration of use of the Service, then deleted when the account is closed; upon an erasure request (art. 17 GDPR), as soon as possible
• E-mails and conversations handled by the assistant: 12 months after the last exchange
• Hold, alteration and appointment requests: 12 months after their closure
• Connected mailbox credentials: until the mailbox is disconnected, then deleted immediately
• Billing data: 10 years in accordance with accounting obligations
• Login logs: 12 months

ARTICLE 6 - RIGHTS OF DATA SUBJECTS

In accordance with the General Data Protection Regulation (GDPR), you have the following rights, to be exercised with [to be completed]; a customer of the boutique exercises their rights with the boutique, which the Publisher assists:

• Right of access: Obtain a copy of your personal data
• Right to rectification: Correct inaccurate data
• Right to erasure: Request the deletion of your data
• Right to portability: Receive your data in a structured format
• Right to object: Object to the processing of your data
• Right to restriction: Request the restriction of processing