Privacy policy

In short

Saisix keeps only what is needed to provide the service to you. Your documents are stored in the European Union, read in France, deleted automatically 30 days after they are uploaded, and are never used to train an AI.

This page explains which data we process, why, with whom, for how long, and how to exercise your rights, as required by Articles 13 and 14 of the General Data Protection Regulation (GDPR).

Who is responsible for your data

The controller is [RAISON SOCIALE], [ADRESSE DU SIÈGE], who can be reached at [E-MAIL DPO/CONTACT].

If you use Saisix for your professional activity, the documents you upload may contain data about your customers, employees or suppliers. For that data, you are the controller and Saisix acts as a processor, within the meaning of Article 28 of the GDPR: Saisix processes it only to fill your files, on your instructions. The terms and conditions of sale and use describe this commitment.

The data we process

Your account: your e-mail address, your password in encrypted form (a scrypt hash, never the password itself), your plan and its start date, your role in the application.

Your sessions: the documents you upload, the files to fill that you provide, the files Saisix fills, the values to check and your choices on those values.

Your usage: for each reading, the amount of text read and written by the model, the type of document and the date. These records contain none of the content of your documents.

Security: the number of failed login attempts per e-mail address, for 15 minutes, to block repeated password guessing. Our servers’ technical logs (IP address, pages requested, errors).

Audience measurement: pages viewed, referring site, type of browser and device, country. These statistics are anonymous and do not track you from one site to another.

Payment: your card details are entered directly with our payment provider, Stripe. Saisix never sees them: it only keeps the reference of your subscription and its status.

Why, and on what legal basis

Creating and managing your account, reading your documents, filling your files, calculating your monthly usage: this is necessary for the performance of the contract you enter into with us (Article 6(1)(b) of the GDPR).

Invoicing and keeping accounting records: this is a legal obligation (Article 6(1)(c) of the GDPR; Article L123-22 of the French Commercial Code (Code de commerce)).

Protecting the service against abuse and attacks, measuring the audience to improve the site, monitoring the cost of the service: this is our legitimate interest (Article 6(1)(f) of the GDPR). You may object to it at any time.

Saisix uses artificial intelligence to read your documents. It makes no decision concerning you: it copies information, and you check it before downloading. There is therefore no automated decision-making within the meaning of Article 22 of the GDPR.

Your documents are used only for you

Your documents are read by the Mistral Medium model, on Scaleway’s Generative APIs, in Paris. Scaleway undertakes not to use the data sent to train, retrain or improve its models, and not to make it accessible to the creators of the models.

Scaleway does not retain the content of requests. The only exception provided for in its terms: a request that causes a failure may be kept for no more than two weeks, for the time needed to fix the problem.

Saisix does not use your documents to train an AI either, nor for any purpose other than yours.

Who receives your data

Only the people at [RAISON SOCIALE] who need it to operate the service have access to it. We neither sell nor rent your data.

Cloudflare, Inc. (United States) hosts the site and the application, stores your files and the database in its European Union zone and resizes photos before reading. Because your requests pass through its global network, data may be processed outside the Union. These transfers are governed by the European Commission’s adequacy decision on the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795, Article 45 of the GDPR), to which Cloudflare adheres, and by the Commission’s standard contractual clauses (Article 46 of the GDPR).

Scaleway SAS (France) reads your documents with the AI model, in its Paris data centres. No transfer outside the Union.

Our audience measurement tool, Umami, is installed on our own server at [HÉBERGEUR DU VPS UMAMI], [PAYS DU VPS UMAMI]. No third party has access to it.

Stripe Payments Europe, Limited (Ireland) collects your payments and stores your payment method. Stripe may process this data in the United States, at Stripe, Inc.: these transfers are governed by the European Commission’s adequacy decision on the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795, Article 45 of the GDPR), to which Stripe adheres, and by the Commission’s standard contractual clauses (Article 46 of the GDPR). To fight fraud and meet its own legal obligations, Stripe also acts as a controller, under its own privacy policy.

Each of these providers is bound by a data processing agreement compliant with Article 28 of the GDPR.

How long we keep your data

Uploaded documents and filled files: 30 days after the start of the session, then deleted automatically. You may delete them yourself earlier, at any time, from the Library: deletion is immediate and permanent.

The files to fill that you provide: 30 days after their last use, or 1 day if they have never been used.

Your account and your usage records: for as long as your account exists, then deleted within [30] days after the end of your subscription.

Invoices: 10 years, as required by Article L123-22 of the French Commercial Code (Code de commerce).

Failed login attempts: 15 minutes. Technical logs: 7 days.

Audience statistics: [DURÉE, 25 MOIS AU PLUS].

Your rights

You may at any time access your data, have it rectified or erased, restrict its use, object to processing based on our legitimate interest, and obtain the data you have provided to us in a readable format (Articles 15 to 21 of the GDPR).

You may also tell us what we should do with your data after your death (Article 85 of French Law No. 78-17 of 6 January 1978, known as the “Informatique et Libertés” law).

To exercise these rights, write to [E-MAIL DPO/CONTACT] from your account’s e-mail address. We respond within one month (Article 12 of the GDPR). If there is any doubt about your identity, we may ask you to confirm it.

Your documents and filled files can also be deleted directly in the Library.

Complaint to the CNIL

If you believe that your rights are not being respected, you may lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or online at cnil.fr/fr/plaintes (Article 77 of the GDPR).

Cookies

Saisix sets a single cookie: “saisix_session”, which keeps you logged in for 30 days. It is strictly necessary for the service you request, it is used for nothing else and it can be read only by Saisix. It is therefore exempt from consent (Article 82 of the “Informatique et Libertés” law). It is erased when you log out.

Our audience measurement, Umami, uses no cookies and stores nothing on your device. It produces only anonymous statistics. That is why no banner asks for your consent.

No advertising cookies, no social networks, no third-party tracking tools.

Security

Your data travels encrypted (HTTPS) and is encrypted in our storage. Passwords are kept as hashes, never in plain text. Each account can access only its own files. Repeated password guessing is blocked.

In the event of a personal data breach presenting a risk to you, we notify the CNIL and, if the risk is high, we notify you as well (Articles 33 and 34 of the GDPR).

Changes

If this policy changes, the date at the top of the page changes too. For a significant change, we notify you by e-mail.