Privacy policy

The data controller is Sébastien Verbeke, sole trader operating under the business name Cyralis (SIRET 537 375 594 00042), whose registered office is at 54 Traverse de Chante Perdrix, 13010 Marseille, France. For any question about your personal data, contact us via the online contact form.

Data detection, redaction and verification run entirely in your browser (WebAssembly technologies). No document, no file name and no data it contains is ever sent to, stored on or logged by our servers. The publisher therefore receives no personal data contained in your documents and does not act as a processor with respect to them.

Apart from documents, we process only the data strictly necessary to run the service:

• Account — your email address, for passwordless magic-link sign-in. Purpose: create and secure your access. Lawful basis: performance of the contract (art. 6-1-b). Retention period: as long as the account exists, then deletion on request.
• Billing — information related to your subscription or Pass (customer ID, status, receipts), handled by our payment provider Stripe — we neither see nor store your card data. Purpose: collect and evidence payment. Lawful basis: performance of the contract and legal accounting obligation (art. 6-1-b and 6-1-c). Retention period: the statutory retention period for accounting records (10 years).
• API waiting list — your email address and, if you provide it, your use case. Purpose: notify you when the API opens. Lawful basis: consent (art. 6-1-a), which you can withdraw at any time. Retention period: until you withdraw your consent or the service opens.
• Session cookie — a single strictly necessary cookie, set only if you sign in, to keep your session. Purpose: session security. Lawful basis: legitimate interest; a strictly necessary cookie exempt from consent. Retention period: for the duration of the session.

We never sell or rent your data. It is shared only with the processors essential to the service, bound by contract to protect it and to use it solely on our instructions:

• Stripe — payment and billing (Stripe Payments Europe, Ltd — Ireland).
• Brevo — sending transactional emails — sign-in links, receipts (Sendinblue SAS — France).
• Hosting — the service is self-hosted by the publisher, on its own infrastructure located in France.

The service and email delivery are hosted within the European Union. Only payment processing by Stripe may involve a transfer of data outside the European Union (in particular to the United States); such a transfer is then governed by the European Commission’s standard contractual clauses and, where applicable, the Data Privacy Framework, in accordance with Article 46 of the GDPR.

Under Articles 15 to 22 of the GDPR, you have the following rights over your personal data:

• Right of access and right to rectification (art. 15 and 16)
• Right to erasure of your data (art. 17)
• Right to restrict processing (art. 18)
• Right to data portability (art. 20)
• Right to object, including to any direct marketing (art. 21)
• Right to withdraw your consent at any time, where processing relies on it (art. 7-3)

To exercise your rights, contact us via the online contact form. We respond within one month of the request (art. 12-3). For the avoidance of doubt, Occulteo carries out no direct marketing and sends no newsletter.

If you believe your rights are not being respected, you may lodge a complaint with the French supervisory authority, the CNIL (3 Place de Fontenoy, 75007 Paris — cnil.fr).

Occulteo makes no automated decision producing legal effects concerning you and carries out no profiling within the meaning of Article 22 of the GDPR.

We implement appropriate technical and organisational measures (HTTPS encryption, data minimisation, no storage of documents whatsoever). In the event of a personal data breach likely to result in a risk to your rights and freedoms, we undertake to notify the CNIL within 72 hours (art. 33) and, where the risk is high, to inform the individuals concerned (art. 34).

Given the nature and volume of our processing, appointing a data protection officer (DPO) is not mandatory and no DPO has been appointed. Your data-protection requests are handled directly by the publisher, via the contact form above.

Occulteo uses no advertising cookie, no third-party tracker and no audience-measurement tool. Only a strictly necessary cookie (session) is set if you sign in to an account — so no consent is required to browse the site.

This policy may be updated to reflect changes to the service or to applicable law. The last updated date appears at the top of the page; in the event of a significant change, we will inform you by an appropriate means.