Privacy Policy

Article 1: Preamble

This privacy policy aims to inform website users about:

How their personal data is collected. Personal data includes any information that can identify a user, such as their first and last name, age, postal or email address, location, or IP address (non-exhaustive list);
The rights they have concerning this data;
The person responsible for processing the collected and managed personal data;
The recipients of this personal data;
The website’s policy on cookies.

This policy complements the legal notices and Terms of Use available to users at the following address:

https://ordalie.com/legal/cgu

Article 2: Principles Related to the Collection and Processing of Personal Data

In accordance with Article 5 of European Regulation 2016/679, personal data must be:

Processed lawfully, fairly, and transparently regarding the data subject;
Collected for specified, explicit, and legitimate purposes (see Article 3.1 below) and not further processed in a way incompatible with those purposes;
Adequate, relevant, and limited to what is necessary for the purposes for which it is processed;
Accurate and, when necessary, kept up to date. Reasonable steps must be taken to ensure that inaccurate personal data is rectified or erased promptly;
Retained in a form that permits the identification of the data subjects for no longer than necessary for the purposes for which the data is processed;
Processed in a manner that ensures appropriate security of the collected data, including protection against unauthorized or unlawful processing, accidental loss, destruction, or damage, using appropriate technical or organizational measures.

Processing is lawful only if, and to the extent that, at least one of the following conditions is met:

The data subject has given consent for one or more specific purposes;
Processing is necessary for the performance of a contract to which the data subject is a party or for pre-contractual measures at their request;
Processing is necessary to comply with a legal obligation to which the data controller is subject;
Processing is necessary to protect the vital interests of the data subject or another natural person;
Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller;
Processing is necessary for the purposes of legitimate interests pursued by the data controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, especially when the data subject is a child.

Article 3: Personal Data Collected and Processed During Website Navigation

Article 3.1: Collected Data

The personal data that may be collected and processed in connection with Ordalie’s services includes in particular:

identification and account data, such as first name, last name, email address, affiliated organization and certain account settings;
content entered, uploaded, generated or shared through the platform, such as documents, prompts, outputs, notes and other produced content;
usage and security metadata, such as technical logs, login events, information relating to the use of features and data required for fraud prevention and platform security;
where applicable, data strictly necessary for the operation of integrations activated by the user or their organization.

The collection and processing of this data notably serves the following purposes:

identification and authentication, in order to ensure secure and personalized use of Ordalie’s services;
provision, customization and improvement of subscribed services and features;
security, fraud prevention, technical supervision and service continuity;
management of the contractual relationship, assistance and support; and
audience measurement, usage analysis and service improvement, in compliance with applicable regulations.

Article 3.2: Data Collection Methods

While navigating ordalie.com, the following data is automatically collected:

Browser type and version;
Operating system;
Pages visited;
Duration of visits;
Traffic source;
Screen resolution;
Approximate geographic location.

These data are collected anonymously and cannot identify any individual. They are used solely to enhance the user experience and optimize the website. As such, no cookies are required for this data collection.

Data is retained securely for 12 months. Certain personal data may be retained beyond this period to fulfill legal or regulatory obligations.

Article 3.3: Data Hosting

The host of the ordalie.com website and its data is Scaleway, a Simplified Joint-Stock Company with a capital of €214,410.50, headquartered at 8 rue de la Ville l’Évêque, 75008 Paris, France.

Article 3.4: Data Transmission to Third Parties

Collected data may be transmitted to processors or technical service providers involved in the operation, security, hosting, payment or, where applicable, inference of the services.

As of the date of this policy update, these providers may notably include:

Scaleway, for the main hosting of infrastructure and data;
AI inference providers, including Azure France, contractually required to process data in France, not to reuse client data for training, and not to retain prompts, outputs or associated metadata;
Stripe, for payment processing;
where applicable, security, application delivery or integration providers strictly necessary for the operation of the service.

These providers act only to the extent necessary for their respective missions and are contractually bound in accordance with applicable regulations.

Article 3.5: Cookie Policy

Cookies used on ordalie.com are strictly for authentication purposes. Under the General Data Protection Regulation (GDPR), these cookies, essential for the site’s functionality and security, do not require explicit user consent. No tracking or advertising cookies are used on the platform.

Article 4: Data Controller and Data Protection Officer

Article 4.1: Data Controller

Personal data is collected by ORDALIE, a Simplified Joint-Stock Company with a capital of €2,000, registered under 953 262 508 R.C.S. Paris.

The data controller can be contacted at:

Address: 60 Rue François 1er, 75008 Paris

Email: [email protected]

Article 4.2: Data Protection Officer

For any question relating to the protection of personal data or to exercise your rights, you may contact Ordalie at: [email protected].

If you believe, after contacting us, that your data protection rights are not being respected, you may lodge a complaint with the CNIL.

Article 5: User Rights Regarding Data Collection and Processing

Under European Regulation 2016/679 and the French Data Protection Act (Law No. 78-17 of January 6, 1978), users have the following rights:

Right of access, rectification, and erasure (Articles 15, 16, and 17 of the GDPR);
Right to data portability (Article 20 of the GDPR);
Right to restriction (Article 18 of the GDPR) and objection to data processing (Article 21 of the GDPR);
Right not to be subject to a decision based solely on automated processing;
Right to determine the handling of their data after death;
Right to lodge a complaint with the supervisory authority (Article 77 of the GDPR).

To exercise these rights, contact ORDALIE at 60 Rue François 1er, 75008 Paris, or via email at [email protected].

The data controller may request certain information, such as your name, email address, or account details, to process your request.

Visit cnil.fr for more information on your rights.

Article 6: Changes to the Privacy Policy

The publisher of ordalie.com reserves the right to modify this policy at any time to ensure its compliance with applicable laws.

Modifications will not affect previous subscriptions, which remain subject to the policy accepted by the user at the time of subscription.

Users are encouraged to review this policy each time they use Ordalie's services.

This policy, published on 06/09/2023, was last updated on 09/19/2023.