Privacy policy

The controller

RETBA AI, 16 cours Albert 1er, 75008 Paris, France, registered under 933 650 418 R.C.S. Paris, is the controller of the processing described below. Questions go to contact@retba.ai.

Data processed

Depending on the relationship, RETBA AI processes:

• for a site visitor: technical connection data held in server logs, including a truncated IP address, the date and the page viewed;
• for a doctrine-letter subscriber: the email address and the date of sign-up;
• for a client: identity, address, email, billing data and, without ever passing through our servers, payment data handled by Stripe;
• for a Narval user: account credentials, the password digest, the questions put to the software and the history of files produced;
• for a Founding Circle subscriber: their answers to the weekly software evaluation questionnaire;
• for a person under watch: publicly available information about them, the publications that target them and the analysis drawn from both.

Purposes and legal bases

• performing the subscription contract and opening access to the software, under article 6.1.b of the Regulation;
• keeping accounts and meeting tax obligations, under article 6.1.c;
• securing the service and preventing abuse, under the legitimate interest of article 6.1.f;
• fixing and developing the software from the beta evaluation questionnaires, under the same legitimate interest;
• sending the doctrine letter, under the consent of article 6.1.a, which may be withdrawn at any time;
• carrying out the watch requested by the client on the figures under watch, under the legitimate interest of the client and our own, weighed against the rights of the persons concerned.

Where data falls within the special categories of article 9 of the Regulation, such as a political opinion or a health fact made public, it is processed only to the extent that the person has manifestly made it public, or where processing is necessary for the establishment, exercise or defence of legal claims.

Recipients

Data is disclosed only to those who need it:

• the associates and analysts of RETBA AI, bound to secrecy;
• Cloudflare, Inc., for hosting the site, the application functions and the databases;
• Stripe Payments Europe, Ltd, for payment and invoicing;
• the language-model providers that run the analyses, under contracts forbidding training on the data sent;
• open-source data providers and the specialist provider that measures the exposure of an identifier in leaks, all bound by confidentiality agreements;
• judicial or administrative authorities, on a proper request.

No data is sold or transferred for marketing purposes.

Transfers outside the European Union

Hosting, payment and the running of analyses may involve a transfer to the United States. Such transfers rely on the European Commission's standard contractual clauses and, where applicable, on the recipient's certification under the EU-US Data Privacy Framework.

Retention periods

• technical logs: twelve months;
• answers to evaluation questionnaires: three years;
• client account and file history: the term of the subscription, then twelve months;
• timestamped exhibits: five years, so that they remain available in the event of a dispute;
• accounting records and contracts: ten years, under the French Commercial Code;
• address on the doctrine letter: until consent is withdrawn, then three years.

Security

Passwords are stored as PBKDF2-derived digests. Sessions are signed and expire after twelve hours. Client accounts are partitioned, firm access is separate and separately revocable, and traffic runs over HTTPS.

Cookies

www.retba.ai sets no cookie. The Narval software sets a single session cookie, strictly necessary for authentication, lasting twelve hours, with no analytics and no advertising.

Persons under watch

A person whose name is under watch keeps all of their rights. No decision producing legal effects concerning them is taken on automated processing alone: every analysis is read by an analyst before it reaches the client.

Any request sent to contact@retba.ai is handled, and passed to the client acting as controller where the request concerns that client.

Rights

Everyone has the right of access, rectification, erasure, restriction, objection and portability, and the right to give directions on what becomes of their data after death.

These rights are exercised at contact@retba.ai. We answer within one month, extended to three months where the request is complex. A complaint may be lodged with the Commission nationale de l'informatique et des libertés, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.