Privacy
Privacy policy
What we process, why, where it goes and for how long. Written to be read, not skimmed.
Last updated: 2026-09-15
Who is responsible
The data controller is [Operator name — entrepreneur individuel], [Adresse professionnelle]. Contact for any privacy request: [contact e-mail].
What we process
Account data: e-mail address, authentication identifiers, plan and payment status (no card numbers; Stripe holds those).
Model metadata: table, column and measure names, DAX and Power Query code, relationships, report pages, visuals and filters. We do not read the business rows of your model: local cache files such as cache.abf are removed before upload.
Technical data: request timestamps used for rate limiting and abuse prevention.
Why and on what legal basis
Running the audit you request and showing you the results: performance of the contract (GDPR art. 6-1-b).
Billing, invoices and accounting records: legal obligation (art. 6-1-c).
Rate limiting, security and fraud prevention: legitimate interest (art. 6-1-f).
We do not use your models to train any model, and we do not sell or share data for advertising.
AI processing
When you choose the AI review, model metadata and code are sent to Google's Gemini API. Before sending, user names in file paths, server names, IP addresses and e-mail addresses are replaced by placeholders and restored only in the answer shown to you. The API is used under paid terms, under which Google does not use the data to improve its models.
Static audits never leave our infrastructure.
Where data is stored and who processes it
How long we keep it
Saved audits (findings, scores, model metadata): until you delete them or close your account.
Encrypted model source used by the fix workspace: 30 days, then deleted automatically.
Private (unsaved) audits: the result is held for at most 24 hours in a processing record so you can retrieve it, then deleted.
Rate-limit logs: 7 days. Invoices: 10 years (French accounting law).
Your rights
You can access, correct, export or delete your data, and object to or restrict processing, by writing to [contact e-mail]. You can delete any saved audit yourself from the app. You may lodge a complaint with the CNIL (cnil.fr).
Cookies
You can delete your account and all its data yourself from Settings → Delete my account; deletion is immediate. We only use strictly necessary cookies (your session). There is no advertising or third-party analytics cookie, which is why you do not see a cookie banner.
Security
Data in transit is encrypted (TLS). Model sources at rest are encrypted with AES-256-GCM. Access to production data is restricted to the operator. If a breach affects your data we will notify you within 72 hours as required by GDPR art. 33-34.