Privacy policy

1. Data controller

This policy describes the personal data AudySpark processes, why it does so, who it is shared with, and how to exercise your rights.

It does not cover the third-party sites you ask us to audit: those remain governed by their own policies.

The controller is the publisher of this site, identified in the legal notice below. Any request about your data goes to the contact address given at the end of this page. No data protection officer has been appointed: the nature and volume of the processing do not require one.

2. Data we process

We collect only what the service needs in order to work. No special category data within the meaning of Article 9 GDPR is requested.

Account

Email address, first and last name when you provide them, interface language, and where applicable the brand name and logo used in your reports.

Audits

The URLs you submit, the public content retrieved from them, and the reports produced. A URL can identify you indirectly, so it is treated as personal data.

Payment

Payment is handled by Stripe. We never see or store a card number. We keep only the Stripe customer and subscription identifiers, along with the subscription status and renewal date.

Follow-up emails

Delivery status, open date and click date of our audit follow-up emails, so we do not chase someone who has already read the message.

Waitlist

Email address and the answers you volunteer (audit volume, budget, missing feature).

Technical data

IP address and browser type, used for rate limiting, abuse prevention and error diagnosis. Rate-limit counters expire automatically after one to twenty-four hours depending on the case.

Browser local storage

Your language and your cookie consent decision are stored in your browser's local storage. They are never sent to our servers.

3. Legal bases

Performance of a contract

Creating and running your account, performing audits, delivering reports, billing and managing subscriptions.

Legitimate interest

Service security, rate limiting, abuse prevention, technical diagnosis and product improvement.

Consent

Microsoft Clarity audience measurement and non-essential emails. You can withdraw it at any time, without affecting processing already carried out.

Legal obligation

Retention of accounting records tied to payments, for the period the law requires.

4. Subprocessors

We sell no data and share none of it for advertising. The providers below process it solely on our behalf and on our instructions.

This list is kept current. A change of provider is reflected here along with the last-updated date of this document.

5. Location and transfers

The database is hosted in the European Union. Some of the providers above are established in the United States: those transfers rely on the European Commission's standard contractual clauses and, where the provider is certified under it, on the EU-US Data Privacy Framework.

6. Retention periods

Account and reports

Kept for as long as your account exists. They are deleted within 30 days of your erasure request.

Technical caches

Retrieved content and intermediate analyses are cached for a limited time, then deleted automatically by a job that runs every six hours.

Accounting records

Kept for the statutory period applicable to accounting documents, regardless of account deletion.

Technical logs

Kept as long as needed for diagnosis and security, then erased under our hosting providers' own retention policies.

7. Your rights

Under the GDPR you have the following rights over your data:

• Access: obtain a copy of the data we hold about you.
• Rectification: correct data that is inaccurate or incomplete.
• Erasure: request deletion of your account and your reports.
• Restriction: ask us to freeze a processing activity while a dispute is examined.
• Portability: receive your data in a machine-readable format.
• Objection: object to processing based on our legitimate interest.
• Withdrawal of consent: at any time, for audience measurement and non-essential emails.

You exercise these rights by a plain email to the contact address. We answer within one month. These requests are handled manually: there is no self-service deletion screen today, and we would rather write that down than promise a button that does not exist.

8. Complaints

If our answer does not satisfy you, you may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, 75007 Paris, or with the supervisory authority of your country of residence.

9. Security

Traffic is encrypted in transit over HTTPS. Session tokens are stored in cookies that page JavaScript cannot read. Database access is restricted to the application services. No system is infallible, so we make no claim of absolute security.

10. Automated analysis

Audit reports are produced by automated processing based on language models. That processing looks at web pages, not at people: it produces no decision with a legal effect on you within the meaning of Article 22 GDPR.

11. Minors

The service is aimed at professionals and is not intended for anyone under sixteen. We do not knowingly collect their data; if it happened, it would be deleted once reported.

12. Changes

This policy may change as the service evolves. The last-updated date appears at the top of the page. A substantial change in the scope of processing will be notified by email if you hold an account.

13. Contact

For any question or request about your data, write to khalifa@audyspark.com.