Privacy Policy

Data controller

• ✓Publisher: BREEXIO (digitalyser.io brand), SARL — 16 Allée des Fondeurs, 59000 Lille, France.
• ✓SIREN: 905 394 664 — SIRET (head office): 905 394 664 00023 — Lille Métropole trade register.
• ✓Data protection contact: privacy [at] digitalyser.io.

Data we collect

• ✓Identification data: first name, last name, email address, company name.
• ✓Audit technical data: website URL, public presence and visibility data.
• ✓Connection data: IP address, connection logs, session identifiers.
• ✓Analytics data provided via the sources you connect (e.g. Google Analytics).
• ✓Billing data when subscribing to a paid plan.

Processing purposes

• ✓Provide and run the requested audits and accompaniment.
• ✓Manage your account, projects, and subscription.
• ✓Improve the quality of the platform and our analyses.
• ✓Send you service-related communications (and marketing with your consent).
• ✓Comply with our legal and accounting obligations.

Legal basis and retention periods

• ✓Contract performance: account data kept for the duration of the relationship.
• ✓Consent: marketing communications, until consent is withdrawn.
• ✓Legal obligation: billing data kept for 10 years.
• ✓Legitimate interest: security logs kept for a maximum of 12 months.
• ✓After these periods, data is deleted or anonymised.

Feedback and satisfaction

• ✓Data subjects: the active owners of the account of a digitalyser.io client organisation.
• ✓Review request: we may invite you by email to leave a public review on digitalyser.io’s Google profile.
• ✓Satisfaction survey: about every 6 months, we email you a personal link, valid for 30 days, to a survey where you rate from 0 to 10 how likely you are to recommend digitalyser.io, with an optional comment.
• ✓Purpose and legal basis: this data is used solely to improve our service, on the basis of our legitimate interest in knowing our clients’ opinion.
• ✓Retention: your score and comment are kept for 3 years after your answer; an unused link is erased 30 days after it expires; the history of review requests (organisation, recipient, sending date) is kept for as long as your organisation exists, so that the request is not sent again.
• ✓Recipients: this data is not shared with any third party; emails are sent through our email delivery provider.
• ✓Your rights: you can object to these requests at any time, through the “Stop receiving these requests” link in each email, which stops these requests only, or by writing to privacy [at] digitalyser.io. You can also ask for your score and comment to be erased. Deleting your account or your organisation erases this data.

Deleting your account

• ✓Request: you can request the deletion of your account from your settings, “My account” tab, confirming with your password, or by writing to privacy [at] digitalyser.io.
• ✓Immediate effects: as soon as you request it, your account becomes inaccessible, your sessions and the authorisations you had given to external AI tools to access your account are revoked, and you are unsubscribed from our marketing communications.
• ✓Timeframe: the deletion becomes final one month after your request. An email confirms the request and the date on which it will take effect.
• ✓Cancellation: during this period, the link in that email lets you cancel the deletion without signing in; your account is then restored as it was. You remain unsubscribed from our marketing communications, which you can subscribe to again at any time.
• ✓Erased data: when the period ends, your account, your profile, your organisation memberships, your conversations with the assistant and your notifications are erased; your name is removed from the content and history of the organisations that are kept.
• ✓Organisations: an organisation of which you are the sole owner is dissolved when the period ends, together with its projects and their data, unless you designate a successor among its members, who becomes its owner as soon as you make your request. The other members of a dissolved organisation are informed by email, when you make your request and again when it is dissolved. An organisation that has another owner is kept.
• ✓Subscription and payment: the subscription of an organisation that will be dissolved is no longer renewed from your request onwards; it is cancelled when the period ends, with no refund for the current billing period, and the corresponding customer record with our payment provider is deleted. If you cancel the deletion before the end of its billing period, the subscription carries on as normal.
• ✓Anonymised data: your account’s security logs are anonymised when the period ends; only the type and date of each event remain, with no identifier, IP address, device or location, and they are deleted 12 months after the event.
• ✓Retained data: your invoices are kept for 10 years from the end of the financial year, detached from any organisation, under our legal retention obligation (GDPR art. 17(3)(b); French Commercial Code art. L123-22). A record that your request was handled, containing no data that can identify you (dates, number of organisations and projects deleted), is kept for 5 years so that we can demonstrate the request was processed.
• ✓Providers: when the period ends, our email delivery provider and our customer relationship management tool erase your contact. A last email confirms the deletion.

Referral programme

• ✓Data subjects: referrers and referred organizations.
• ✓Controller: Digitalyser.io.
• ✓Purposes: attributing referral benefits and checking that an organization does not refer itself.
• ✓Legal bases: performance of these rules for the attribution; legitimate interest in preventing fraud (GDPR, art. 6-1-f) for the self-referral rule.
• ✓The referred organization's data is the data it enters itself in the visibility audit (art. 13); nothing is collected from a third party (art. 14 ruled out).
• ✓Recipients: the Digitalyser.io team and its hosting, email, and customer relationship management technical processors.
• ✓Retention: the link between the referrer and the referred organization is kept for the duration of the contract, then 3 years; for a referred organization that does not become a customer, 3 years after its account is created.
• ✓Rights: access, rectification, erasure, and objection to processing based on legitimate interest (GDPR, art. 21), via the contact address in the privacy policy; a complaint may also be lodged with the CNIL.
• ✓The rules of the programme are published on the /parrainage page.

Processors and transfers

• ✓Hosting: infrastructure operated by BREEXIO, located in France.
• ✓Database: managed database service hosted in the European Union.
• ✓Network and site protection: content delivery and application security provider (CDN).
• ✓Payments: Stripe (card data processed directly by Stripe, PCI-DSS certified).
• ✓Transactional email: email delivery provider.
• ✓Audience measurement: cookie-less analytics solution operated by BREEXIO in the EU; no data shared with third parties.
• ✓AI model analysis: artificial-intelligence model providers, which may be established outside the EU; audit content only, with no reuse of your data to train third-party models.
• ✓For any transfer outside the EU, appropriate safeguards (standard contractual clauses) apply.
• ✓An up-to-date list of our processors, by name, is available on request at privacy [at] digitalyser.io.

Public data analysed by audits

• ✓Our audits analyse publicly available data about the audited business: website content, public reviews, rankings, online presence (art. 14 GDPR — data not collected directly from individuals).
• ✓This data is processed solely to produce the requested audit and related recommendations.
• ✓Any data subject can exercise their rights (access, rectification, erasure, objection) by writing to privacy [at] digitalyser.io.

Connected Facebook and Instagram accounts

• ✓When you connect a Facebook Page or an Instagram professional account to digitalyser.io (Meta login), we receive an access token, your app-scoped Meta account identifier, and the name and identifier of the Pages and Instagram accounts you allow us to access.
• ✓With your permission, we read the posts, comments and insights of those Pages and accounts, solely to produce your project’s audits, recommendations and performance measurement. This data is never sold, never used for advertising, and never shared with third parties other than our processors.
• ✓The access token is stored encrypted. Connection data is kept while the connection is active and deleted as soon as you remove it from your project.
• ✓Deletion: remove the connection from your project’s “Connections” page, or remove digitalyser.io from the apps authorised in your Facebook account settings (a deletion request is then sent to us and processed immediately), or write to privacy [at] digitalyser.io.

Automated decisions

• ✓Our analyses rely on automated processing (including AI models), but no decision producing legal effects or significantly affecting you is made without human involvement.

Cookies and trackers

• ✓Strictly necessary cookies: session and authentication, security, preferences (language, theme) — essential to the service, no consent required.
• ✓Audience measurement: our analytics tool, operated by BREEXIO, sets no cookies and collects no identifying data; statistics are aggregated and anonymous.
• ✓No advertising cookies or third-party tracking pixels to date; technical Stripe cookies may be set during checkout to secure the transaction.
• ✓Ad measurement (only with your consent): if you arrive from an ad, a banner offers to keep that click’s identifier to measure which campaigns convert — first-party cookies “dgl_consent” (your choice, 13 months) and “dgl_attr_first”/“dgl_attr_last” (campaign context, 90 days). If that click comes from a Google ad, our servers send Google Ireland Ltd, when you request an audit or pay, that click identifier and your email address (hashed), to link the request to the ad; Google may transfer data outside the EU (standard contractual clauses). If you decline, no advertising identifier is kept or shared.
• ✓You can delete or block cookies in your browser settings; blocking strictly necessary cookies may prevent you from signing in to the application.
• ✓Support chat: in the application, when you are signed in, the support widget (Chatwoot, hosted by BREEXIO) may load to suggest help articles matching the screen you are viewing and let you reach our team. It sets a “cw_conversation” cookie (conversation session, needed for the chat to work) and receives your identifier, name, email, organisation and plan so that our team knows who it is answering. On the digitalyser.io website, if you are signed in to the application, the same support is offered instead of the sales chat: signing in sets two strictly necessary cookies on the digitalyser.io domain, “dz_signed_in” (tells the website you are signed in) and “__Secure-dz_support” (secure session token, not readable by page scripts), which expire with your session and are deleted when you sign out. On the website, the widget only loads, and only receives your information, when you open it. These cookies are not used for advertising or audience measurement.

A question about your data?

Contact our data protection team at privacy [at] digitalyser.io.