1. Data controller
Vincent Dorange (Editor of ACF Compliance), SIREN [to complete], located [address to complete]. DPO contact: dpo@acf-compliance.com.
2. Categories of data collected
Identification data (name, email, company, position). Connection data (logs, hashed anonymized IP, user-agent). Usage data (platform interactions, ACF Genius prompts). Billing data (via Stripe). Data submitted by the user (inventoried AI systems, fiches, documents).
3. Processing purposes
Providing the AI governance platform. Billing and accounting. Security (anti-spam, anti-fraud, rate limiting). Product improvement (on anonymized aggregated data only). Product communication (ACF Pulse newsletter, opt-in only).
4. Legal basis
Contract execution (service subscription). Legitimate interest (platform security, fraud). Consent (newsletter, non-essential cookies). Legal obligation (billing, security log retention).
5. Retention periods
Account data: contractual relationship duration + 3 years. Billing data: 10 years (legal obligation). Security logs: 12 months. Decision Engine audit trail: 7 years (AI Act compliance). Analytics cookies (Plausible): no cookies, aggregation only.
6. Sub-processors
Vercel Inc. (hosting, Frankfurt EU). Supabase (database, EU region). Anthropic (ACF Genius, Claude model, US — no training retention). Stripe (payment). Resend (transactional email). Plausible (aggregated analytics, no cookies, EU). Complete and up-to-date list available on request.
7. Your rights
You have rights of access, rectification, erasure, restriction, portability, and objection to processing. To exercise your rights: dpo@acf-compliance.com. You can also file a complaint with the CNIL (www.cnil.fr) or your local supervisory authority.
8. Security
ACF Compliance applies: TLS 1.3 encryption in transit, AES-256 at rest, IP hashing (GDPR), bcrypt for secrets, Supabase RLS, rate limiting, cryptographic audit trail. Annual external security audit planned.
9. Transfers outside EU
Data is hosted primarily in the EU (Vercel Frankfurt, Supabase EU). Use of Anthropic (Claude) implies a transfer to the USA, under Standard Contractual Clauses (SCC) European Commission 2021/914.
10. Updates
This policy may be updated. Major changes are notified by email to users at least 30 days in advance.