Privacy Policy

The data controller for personal data collected through https://fleuret.ai is:

FLEURET AI, a French SAS registered with the Paris Trade and Companies Register under number 999 515 604.

Registered office: 60 Rue François 1er, 75008 Paris, France

Email: privacy@fleuret.ai

We collect the following categories of data:

• Identification data: email address, name (if provided), account information.
• Usage data: pages visited, session duration, platform actions, IP address, browser type.
• Technical data: cookies and trackers (see section 7).
• Newsletter subscription: email address and your consent (with its version), and to measure where sign-ups come from: the sign-up page, the referring page (referrer), campaign parameters (utm_*), language, and a hashed fingerprint of your IP address (never the address itself).

We do not collect any sensitive data within the meaning of Article 9 of Regulation (EU) 2016/679 (GDPR).

Your data may be shared with the following processors, strictly for the purposes described above:

• Supabase Inc.: database hosting and authentication.
• Vercel Inc.: website hosting and deployment.
• Brevo (formerly Sendinblue): transactional and marketing email delivery.
• Resend Inc.: delivery of the monthly digest to newsletter subscribers and of transactional email (email address, subscription status).
• Scaleway SAS: hosting of the Fleuret platform (Paris, France).
• Google (Google Workspace): team email and calendar. Demo bookings (name, work email, company) are stored there, in the calendar invitation and the internal alert email.
• Attio Ltd: customer relationship management. Demo requests (name, work email, company) are recorded there, with how the visit started if you accepted ad measurement.
• Google LLC (Google Analytics 4): audience measurement, only if you accepted it.
• Microsoft Corporation (Clarity): heatmaps and session recording (mouse movement, clicks, scroll) used to understand journeys and fix friction, only if you accepted it. Form fields are masked by default.
• PostHog Inc. (PostHog): site usage analytics (clicks, journeys, conversions), only if you accepted it. Data goes through our proxy z.fleuret.ai and is hosted on PostHog's European instance.
• Google Ireland Limited (Google Ads): ad conversion measurement, only if you accepted ad measurement. No targeting, no remarketing.

We never sell or rent your personal data. If you accept ad measurement, Google receives the information needed to tell whether a demo booking followed a click on a Google Ads ad. No other data is shared for advertising, and we do not run remarketing.

Your personal data is retained for the time necessary to fulfill the purposes for which it was collected:

• Account data: duration of the contractual relationship, then 3 years after last activity for prospecting purposes.
• Billing data: 10 years in accordance with accounting obligations.
• Usage data and logs: 12 months maximum.
• Analytics cookies: 13 months at most after your last visit. They are deleted as soon as you withdraw consent, and when your choice expires (6 months), at which point you are asked again.
• Google Analytics 4 data: 14 months (maximum retention period GA4 allows for event and user data).
• Microsoft Clarity data: session recordings and heatmaps retained for 12 months maximum.
• Demo bookings: name, work email, company and, if you accepted ad measurement, how you reached the site (ad click ID, utm parameters, landing page). This lives in the Google Workspace calendar invitation, the internal alert email and our CRM (Attio). Kept 3 years after last contact. Deletion on request at privacy@fleuret.ai.

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15): obtain confirmation that your data is being processed and receive a copy.
• Right to rectification (Art. 16): correct inaccurate or incomplete data.
• Right to erasure (Art. 17): request the deletion of your data.
• Right to data portability (Art. 20): receive your data in a structured, interoperable format.
• Right to object (Art. 21): object to processing based on legitimate interest.
• Right to restriction (Art. 18): request the suspension of processing.
• Right to withdraw consent (Art. 7.3): at any time, for processing based on consent, without affecting the lawfulness of processing before withdrawal. For cookies, the "Cookie settings" link at the bottom of every page is enough (see section 7).
• Right to set post-mortem directives (Art. 85 of the French Data Protection Act): specify what happens to your data after your death.

To exercise these rights, contact us at privacy@fleuret.ai. We will respond within 30 days.

You also have the right to lodge a complaint with the French data protection authority (CNIL): www.cnil.fr.

The site uses three categories of cookies and trackers:

• Strictly necessary: language preference, storing your cookie choice (key fleuret_cookie_consent in local storage), authentication and service functionality. They do not require your consent.
• Audience measurement and usage analytics (consent-based, tool by tool):
  • Google Analytics 4: audience measurement. Cookies _ga, _ga_GCT3NK4C34.
  • Microsoft Clarity: heatmaps and session recording. Cookies _clck, _clsk.
  • PostHog: site usage analytics. Cookie and local storage ph_*.
• Google Ads measurement (consent-based, separate choice): the Google Ads click ID (gclid, gbraid or wbraid), kept for the life of the tab (fleuret_attribution in session storage), to tell whether a demo booking came from a Google Ads ad. If Google Analytics is also accepted, its _gcl_* cookies serve the same measurement. No targeting, no remarketing.

None of these tools is enabled until you accept it: before you choose, and after you refuse, your browser sends no request to Google Analytics, Microsoft Clarity or PostHog, none of their cookies is set, and the ad click ID is neither kept nor sent.

The banner offers "Deny" and "Accept All" in the same style, plus "Customize" to choose tool by tool. "Accept All" includes Google Ads measurement; "Deny" enables nothing and erases the ad click ID. Closing the banner the first time it appears counts as a refusal.

Withdrawing or changing your consent: the "Cookie settings" link at the bottom of every page reopens the banner. If you withdraw consent for a tool, its cookies and local storage on fleuret.ai are deleted and the page reloads without it. Other open tabs of the site reload immediately without that tool (a form you were filling in there is lost). If your choice expires while a tab of the site stays open, the tools stop there the next time you come back to that tab. Cookies a tool sets on its own domain (for example Microsoft Clarity on clarity.ms) are out of our site's reach: you can clear them from your browser. You can also open the cookie settings.

Your choice is kept for 6 months at most, then the banner asks again. It is also asked again if you clear the site's data in your browser.

Where each processor stands on transfers outside the European Economic Area:

• Scaleway: France. No transfer outside the EU.
• PostHog: data hosted in the EU (European instance). As PostHog Inc. is a US company, access from the United States remains possible: it is governed by Standard Contractual Clauses.
• Vercel, Supabase, Resend: US companies. Possible transfer to the United States.
• Attio Ltd: United Kingdom, covered by a European Commission adequacy decision.
• Google (Analytics 4, Ads and Workspace): possible transfer to the United States. Google LLC is certified under the Data Privacy Framework.
• Microsoft (Clarity): transfer to the United States. Microsoft Corporation is certified under the Data Privacy Framework.

These transfers rely on:

• The EU-U.S. Data Privacy Framework (European Commission adequacy decision of July 10, 2023), for certified companies.
• Standard Contractual Clauses (SCCs) adopted by the European Commission, in other cases.

We ensure that any transfer of data outside the European Economic Area benefits from appropriate safeguards in accordance with Chapter V of the GDPR.

We reserve the right to modify this privacy policy at any time. In the event of a material change, we will notify you by email or via a notice on the site. The last update date is indicated at the top of this page.

For any questions regarding the protection of your personal data, you can contact us:

Data protection contact: privacy@fleuret.ai

Supervisory authority: CNIL, www.cnil.fr