1. Data controller
ANDOXA (SAS)
Registered office: 18 rue du Général Leclerc, 93110 Rosny-sous-Bois
Email: contact@andoxa.fr
Phone: 07 67 06 88 12
2. User data: collection and purposes
We collect personal data about users of the Service in the context of the following activities:
| Activity | Data collected | Legal basis | Retention |
|---|---|---|---|
| User account | Name, email, authentication credentials | Performance of the contract | 3 years after the last access |
| Requests sent to the agent | Content of the messages describing the profile searched for | Performance of the contract | Lifetime of the account |
| Audience measurement | Aggregated browsing data (no cookies for visitors) | Legitimate interest | 13 months |
| Email contact | Name, email, message | Legitimate interest | 3 years |
Messages sent to the agent are transmitted to the artificial-intelligence model for processing; they are never used to train the models (see Section 5).
3. Company data
The Service builds company lists from French public registers released as open data under an open licence: INSEE Sirene (via the API Recherche d'Entreprises), INPI RNE and BODACC. These registers may contain personal data (company directors, sole traders). In accordance with Article 14 GDPR, we provide the following transparency about this processing:
- Provenance recorded value by value: every stored piece of information is accompanied by its source, the record identifier in the register of origin, its legal basis and its collection date.
- Partial disclosure honoured: people who have requested the partial disclosure of their data in the Sirene register are never displayed nor stored by the Service.
- No central personal-data database: any personal data is always attached solely to the account of the user who requested it, and is never pooled across accounts.
- Durable erasure register: objection and erasure requests are honoured durably via an erasure register that keeps only salted fingerprints (no clear-text data), to prevent the data from reappearing in later collections.
Some complementary lookups (Google Maps, job postings, the web, aggregated ads and reviews) are performed in real time at the moment of the request and are never stored by the Service.
4. Subprocessors and recipients
Data is processed by the following subprocessors, each within the limits of its purpose:
- Vercel — hosting of the website and the application (USA/EU; transfers governed by the Data Privacy Framework and the standard contractual clauses).
- Convex — database.
- Clerk — user account authentication.
- Upstash — technical cache.
- Anthropic (via Vercel AI Gateway) — AI processing of requests: the content of the messages is sent to the model to produce the response, and is never used to train the models.
- PostHog Europe — audience measurement, hosted in the European Union, configured without cookies for visitors; signed-in users of the application are identified by their account identifier.
- Resend — transactional emails (upcoming).
Where data is transferred outside the European Union, such transfers are governed by an adequacy decision (Data Privacy Framework) or by the European Commission's standard contractual clauses.
6. Your rights
In accordance with Articles 15 to 22 GDPR and Articles 48 et seq. of the French Data Protection Act (loi Informatique et Libertés), every data subject — whether a user of the Service or a person referenced in the public registers processed — has the following rights:
- Right of access (Art. 15 GDPR): obtain confirmation that your data is being processed and obtain a copy of it. On request, we produce a report listing the data concerning you, its source and its collection date.
- Right to rectification (Art. 16 GDPR): correct your inaccurate or incomplete data.
- Right to erasure (Art. 17 GDPR): request the deletion of your data. Erasure is made durable by our erasure register (salted fingerprints only).
- Right to restriction (Art. 18 GDPR): restrict the processing of your data.
- Right to data portability (Art. 20 GDPR): receive your data in a structured, readable format.
- Right to object (Art. 21 GDPR): object to the processing of your data; objections are honoured durably, including against future collections.
- Post-mortem directives (Art. 85 of the French Data Protection Act) : define what happens to your data after your death.
To exercise your rights, contact us at: contact@andoxa.fr.
You also have the right to lodge a complaint with the CNIL, the French data protection authority: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.
7. Data security
We implement appropriate technical and organizational measures to ensure the security and confidentiality of your personal data, in accordance with Article 32 GDPR.
8. Changes to this policy
We reserve the right to amend this privacy policy at any time. Any change will be published on this page with an updated date.
