🔒 DATA PROTECTION

Privacy Policy

How Publinov protects your personal data (GDPR)

Last updated: 29/06/2026

This is an English translation provided for convenience. The French version is the legally binding reference.

📑 Contents

Data controller
Data collected
Purposes and legal bases
Data recipients
Transfers outside the EU
Retention periods
Your rights
Cookies and trackers
Security
Contact and complaints

🛡️ Our commitment: Your personal data is valuable. Publinov is committed to protecting it in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.

1. Data controller

The controller of personal data is:

Name: ITROPIX
Address: 114 Rue Marceau, 93100 Montreuil, France
Email: privacy@publinov.com
SIRET: 89765180800031

2. Data collected

2.1 Registration and account data

Email address (required)
Display name (if provided)
Password (encrypted and managed by Clerk, never accessible to the Publisher)
Unique Clerk identifier
Google data (if signing in via Google): email, name, profile picture

2.2 Payment data

Bank details are processed directly by Stripe and are never accessible to the Publisher
The Publisher retains: transaction history, amounts, dates, customer Stripe identifier

2.3 Service usage data

Brand(s) provided: name, description, target audience, budget, objective, website URL
Generated content: texts, prompts, images, videos
Generation history: dates, platforms, formats, credits used
Technical logs: IP address, browser, connection dates

2.4 Technical data

Session cookies (authentication)
IP address (server logs for security)
Browser type and operating system

3. Purposes and legal bases

Purpose	Data concerned	Legal basis
Account creation and management	Email, password, Clerk ID	Performance of the contract
Content generation	Brand data, prompts, content	Performance of the contract
Billing and payment	Stripe transaction data	Legal obligation + contract
Customer support	Email, account history	Legitimate interest
Security and fraud prevention	Logs, IP address	Legitimate interest
Service improvement	Anonymised usage data	Legitimate interest
Marketing communications	Email	Consent

4. Data recipients

Your data may be shared with the following technical providers, acting as processors within the meaning of the GDPR:

Provider	Purpose	Country
Clerk Inc.	Authentication	United States
Stripe Payments Europe Ltd.	Payments	Ireland (EU)
Anthropic PBC	AI text generation	United States
BytePlus (ByteDance)	AI image and video generation	Singapore
Railway	Application hosting	United States

The Publisher does not sell, rent or transfer your data to third parties for commercial purposes.

5. Transfers outside the European Union

Some of our processors (Anthropic, Clerk, BytePlus) are established outside the European Union. These transfers are governed by:

The European Commission's Standard Contractual Clauses (SCCs)
The EU-US Data Privacy Framework (DPF) for certified US providers
Additional technical and organisational measures (encryption, data minimisation)

⚠️ Important note on generative AI: The data sent to Anthropic and BytePlus for content generation (prompts, brand descriptions) is not used by these providers to train their models, in accordance with their B2B terms.

6. Retention periods

Data type	Retention period
Active user account	Until account deletion
Generated content (texts, images, videos)	For the subscription period + 30 days after cancellation
Deleted / inactive account	30 days then permanent deletion
Invoices and accounting data	10 years (French legal obligation)
Security logs	12 months
Session cookies	Session duration

7. Your rights

In accordance with the GDPR, you have the following rights over your personal data:

👁️ Right of access

Obtain confirmation that data concerning you is being processed and access it.

✏️ Right to rectification

Request the correction of inaccurate or incomplete data.

🗑️ Right to erasure

Request the deletion of your data ("right to be forgotten").

⏸️ Right to restriction

Request the suspension of the processing of your data.

📦 Right to portability

Receive your data in a structured, machine-readable format.

🚫 Right to object

Object to the processing of your data on legitimate grounds.

↩️ Withdrawal of consent

Withdraw your consent at any time where it is the basis for processing.

⚰️ Post-mortem directives

Define what happens to your data after your death.

To exercise your rights, contact us at: privacy@publinov.com

You will receive a response within a maximum of one month from receipt of your request.

8. Cookies and trackers

8.1 Types of cookies used

Strictly necessary cookies: session, authentication, security (no consent required)
Functional cookies: user preferences (no consent required)

🍪 Publinov does not use advertising or third-party tracking cookies. Only cookies essential to the operation of the Service are used.

8.2 Managing cookies

You can delete cookies at any time via your browser settings. Please note: deleting essential cookies may affect the operation of the Service (logout, etc.).

9. Data security

Publinov implements technical and organisational measures to protect your data:

Encryption of data in transit (HTTPS/TLS)
Encrypted passwords (never stored in plain text, managed by Clerk)
Payments processed exclusively by Stripe (PCI-DSS certified)
Limited data access: only the Publisher has access to the database
Regular backups
Regular security updates

⚠️ In the event of a data breach: Publinov undertakes to notify the CNIL within 72 hours and to inform the affected users as soon as possible if the breach is likely to result in a high risk to their rights and freedoms.

10. Contact and complaints

For any question about this policy or the processing of your data: privacy@publinov.com

If you believe your rights are not being respected, you have the right to lodge a complaint with the CNIL (French Data Protection Authority):

Website: www.cnil.fr
Address: 3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07, France