Website privacy policy

Data controller

Mindlapse SAS, 9 rue des Colonnes, 75002 Paris, France, RCS Paris 939 571 535. Contact: dpo@mindlapse.ai.

What we collect, and why

• · Form data (demo, contact): identity and professional contact details you submit, processed to answer your request, on the basis of pre-contractual measures or our legitimate interest. Answering you never depends on your cookie choice.
• · Marketing opt-in: if you tick the box on a form or subscribe to the newsletter, we record that consent together with the exact wording you were shown, so we can prove it and you can revoke it.
• · Marketing data (only with your consent via the cookie banner): interactions measured by our CRM (HubSpot) to follow up commercially. Consent can be withdrawn at any time.
• · Consent proof: when you make a cookie choice we record a random identifier, the date, the categories chosen and the policy version, on our own EU servers. It is required of us by article 7-1 GDPR and is linked to nothing else.
• · Audience statistics: collected without cookies and without personal identifiers by our host (Vercel Web Analytics and Speed Insights): anonymous aggregated metrics, exempt from consent.
• · Statistics with Google Analytics (only with your consent via the cookie banner): visits and pages viewed, with shortened IP addresses and without advertising signals. Consent can be withdrawn at any time.
• · Anti-abuse: our form relay counts requests per sender to stop flooding. The IP address is hashed on arrival with a secret salt and is never stored in clear text: legitimate interest in securing the service.
• · Technical logs strictly necessary to operate and secure the site.

Newsletter and marketing communications

The newsletter uses double opt-in: after subscribing you receive an email asking you to confirm, and nothing is sent until you do. Marketing communications tied to a demo or contact request are only sent if you tick the dedicated box. Leaving it unticked has no effect on how we handle your request.

Every message carries an unsubscribe link and a link to your subscription preferences, which you can change at any time without contacting us. Your choices, and the exact wording you agreed to, are recorded in our CRM.

Retention

• · Prospect and contact data: up to 3 years after our last interaction.
• · Newsletter data: until you unsubscribe.
• · Consent proof: 3 years from the date of the choice (CNIL recommendation).
• · Anti-abuse counters: 10 minutes, in memory only; nothing is written to a database.
• · Technical logs: 24 months maximum.

Recipients & processors

Data is processed by Mindlapse staff who need it, and by processors bound by GDPR-compliant agreements. We never sell or rent personal data.

• · Vercel Inc. (United States): website and CMS hosting, served from EU regions (Paris); cookieless page-view and performance measurement.
• · HubSpot Inc. (United States): CRM and forms, with European data residency enabled.
• · Google Ireland Ltd (Ireland): Google Analytics, only after your consent; possible transfer to the United States under the EU-US Data Privacy Framework.
• · Resend Inc. (United States): transactional email for form notifications and confirmations.
• · Neon / Vercel Postgres (EU, Frankfurt): database for the CMS and the consent proof log.

Transfers outside the EU

Data is stored in the European Union. Several of our processors are incorporated in the United States, which means access from outside the EEA cannot be entirely ruled out even when storage is European. Those relationships are governed by the European Commission’s Standard Contractual Clauses, supplemented by the processors’ own technical measures. The list above tells you exactly which ones are concerned.

Your rights

You may access, rectify, erase, restrict or object to the processing of your data, request portability, and withdraw consent at any time: write to dpo@mindlapse.ai. You may also lodge a complaint with the CNIL (cnil.fr). A dedicated page explains how, and how long we take.

Exercising your rights Cookie settings