Who processes the data?
For account, billing, support, security and product-operation data, the entity operating ELTARA acts as controller. For some content and visitor data processed solely to publish a customer website, AJG may act as the customer’s processor.
Controller: To be completed before paid launch
Privacy contact: To be completed before paid launch
Data concerned
- Account and authentication: email, technical identifier and information required to sign in.
- Website creation: brand identity, copy, settings, drafts, domains and media you choose to save.
- AI: instructions, relevant context and content required for the requested generation, plus the generated response.
- Billing: Stripe references, plan, subscription status, dates and payment events; card data is handled by Stripe.
- Operations and security: product events, quotas, errors, technical metrics and data needed to prevent abuse.
Purposes and legal bases
- Provide ELTARA, publish websites, manage the account and subscription: performance of a contract or pre-contractual steps.
- Billing, accounting and regulatory obligations: legal obligation where applicable.
- Security, abuse prevention, operational improvement and usage measurement: legitimate interests, subject to individual rights.
- Non-essential communications and non-essential trackers: consent where required.
Main service providers
Current operation may involve Supabase (database, authentication and storage), Vercel (hosting and compute), Stripe (payments and subscriptions), Resend (transactional email), OpenAI (AI generation features), and Vercel Blob for some external backups.
Data sent to the OpenAI API is not used to train models by default. Depending on account and endpoint configuration, requests/responses or logs required for service operation and abuse prevention may be retained for up to 30 days. AJG limits data sent to what is useful for the requested generation.
Retention
Active data is retained while providing the service. An erasure request can be started from the “My data” area. Records that must be kept to meet legal, accounting or security obligations, or to establish legal rights, may be retained separately for a limited period. Detailed production retention periods will be published before paid launch.
Your rights
Depending on the processing involved, you may exercise rights of access, rectification, erasure, restriction, objection and portability. Users also have export and erasure-request tools in ELTARA. You may lodge a complaint with the French data protection authority, the CNIL.