Privacy Policy

1.1 From the website (account, billing, and contact)

• Account data: name, email, company name, billing details
• Payment data: processed by our payment provider (Mollie); we don’t store full card numbers
• Technical/website data: log files, device/browser info, and basic usage of the website and account areas (e.g. pages visited, login activity). If you accept analytics in the cookie banner, we also record anonymous usage events (pages visited, clicks such as Download, starting a checkout) under a random identifier that is not linked to your account
• Free plan usage: how many free audits you have run this month, and a hashed identifier of your computer (never the content of any audit) — used only to apply the monthly limit of the free plan
• Cookies: see our Cookie Policy

1.2 From the Service itself (your analysis data): we do not collect it

When you use Elenchos to check whether an analysis is trustworthy, the data and analysis details you submit are processed only transiently, in real time, to generate your result. We do not store, log, review, analyze, or reuse that data once your session ends, and we do not use it to train models, benchmark other users, or for any purpose beyond producing your immediate output.

We take this position deliberately: this data is often sensitive and proprietary to you, collecting or retaining it would create risk without any legitimate upside for you, and it wouldn’t meaningfully benefit us either — so we simply don’t.

1.3 Diagnostic reports (only if you choose to send one)

When something goes wrong in the software, it can prepare a diagnostic report. Nothing is sent automatically: you can read the full content of the report first, and it is only transmitted if you click Send. By clicking Send, you consent to us receiving and processing that report.

A report contains the name of the module concerned, a short summary of the problem, the version of the software, the operating system and Python version it runs on, and a technical payload describing what failed. No data, model or configuration appears in a report: error messages are stripped and free text has its values replaced before the report is built, because a message can quote your data.

A report is linked to your account, so that we can follow up and show you its status under “Error reports” in your profile. Reports are visible only to Elenchos developers, through an access-restricted page. Apart from your account and licence information — and, on the free plan, the usage count described in Section 1.1 — a diagnostic report is the only thing the software sends us, and the only thing from your use of it that we can see. We use reports solely to improve the audits and to find and fix bugs — never for advertising, profiling, or any other purpose.

A report is kept only until the issue it describes is resolved. Until then you can see it in your profile, you can ask us to delete it at any time, and deleting your account deletes all of your reports.

This section concerns the account, billing, and website data described above, and diagnostic reports (Section 1.3) — not your analysis data, which we don’t collect in the first place.

• To provide the Service and manage your subscription (performance of contract)
• To process payments and comply with tax/accounting obligations (legal obligation)
• To maintain and secure the website and account system (legitimate interest)
• To apply the monthly limit of the free plan and prevent its abuse (legitimate interest)
• To receive and act on a diagnostic report you choose to send, in order to improve the audits and fix bugs (consent — given when you click Send, and withdrawable at any time)
• Marketing emails, if any (consent — with an easy opt-out)

We share account, billing, and website data with the service providers who help us run the Service: Supabase (authentication and database hosting), Mollie (payment processing), Resend (transactional email), Vercel (website hosting and visit statistics), and PostHog (site usage analytics, only if you accept analytics in the cookie banner) — each acting under contracts that require them to protect your data. Diagnostic reports are stored with our database provider (Supabase) and seen only by our developers; they are not shared with anyone else. We don’t sell personal data. Since we don’t collect your analysis data (see Section 1), there’s nothing of that kind to share in the first place.

Some providers may be located outside the EU. Where that’s the case, we rely on Standard Contractual Clauses or an equivalent safeguard recognized under GDPR.

We keep personal data for as long as your account is active, plus 10 years afterward for legal/accounting obligations, unless you request earlier deletion (subject to those same obligations).

Diagnostic reports are not subject to that legal retention period: they are kept only until the issue they describe is resolved, then deleted (within 14 days of the fix) — or earlier, on request or when you delete your account.

Free plan usage records are not subject to that legal retention period either: they are kept while your account is active and deleted with it.

You have the right to access, correct, delete, or export your data, restrict or object to processing, and withdraw consent at any time. Contact pro.jeremy.andre@gmail.com to exercise these rights. You can also lodge a complaint with the CNIL (France’s data protection authority) at cnil.fr.

We use industry-standard technical and organizational measures (encryption in transit, access controls, etc.) to protect your data.

The Service is not directed at anyone under 18, and we don’t knowingly collect data from minors.

We’ll notify you of material changes to this policy by email at least 24 hours before they take effect.

Jeremy Andre — pro.jeremy.andre@gmail.com. No Data Protection Officer has been appointed; as sole data controller, Jeremy Andre handles requests directly.