In short
- We only collect what is needed to run your account and your analyses.
- We never sell your data and we do not use advertising cookies.
- Audience measurement only starts if you accept it.
- You can export your data or delete your account yourself, at any time, from your settings.
1. Data controller
The data controller is [to be completed], [to be completed] ([to be completed]). For any question about your data: legal@airbopti.celarli.com.
2. The data we process
| Category | Examples | Where it comes from |
|---|---|---|
| Account | Name, email address, Google identifier, language | Your Google sign-in |
| Security | Verified phone number, IP address, sign-in logs, API token | You and your browser |
| Billing | Company name, address, VAT number, SIRET, subscription history | You and Stripe (we never see your card number) |
| Analyses | Listing link, text and photos, property details, down payment, loan term and rate, tax bracket, notes, your client's name (businesses) | What you import or enter |
| Team and referrals | Email address of colleagues you invite or people you refer | You |
| Messages | Support messages, reviews and testimonials, survey answers | You |
| Audience measurement | Pages viewed, device, approximate country | Your browser, only with your consent |
We do not collect special-category data under article 9 GDPR. Please do not enter any in your notes.
Chrome extension: it only reads the listing page you are viewing (address, text, photos) when you click "Analyze". It does not record your browsing and does not read any other site.
3. Why we use it
| Purpose | Legal basis (GDPR, art. 6) |
|---|---|
| Create and run your account, produce your analyses and PDF memos | Performance of the contract |
| Take subscription payments, issue invoices, keep accounts | Performance of the contract and legal obligation |
| Send service emails and texts (sign-in, codes, invoices, end of trial) | Performance of the contract |
| Help you during the trial and offer to continue | Legitimate interest (you can object at any time) |
| Keep the service secure, prevent fraud and abuse | Legitimate interest |
| Answer your messages and handle your requests | Legitimate interest or performance of the contract |
| Measure site audience | Consent |
| Improve our estimation models using aggregated, anonymous statistics | Legitimate interest |
4. Artificial intelligence
To write parts of the analysis, the listing's text and photos are sent to Gemini models through Google Cloud Vertex AI, acting as our processor. We access it through workload identity federation, with no key stored on our servers. Under Google Cloud's terms, this content is not used to train Google's models. AI output is a suggestion: no decision producing legal effects about you is made by automated means (article 22 GDPR).
5. Who can access it
Your data can be accessed by our team, only as their work requires, and by our processors, bound by a data processing agreement (article 28 GDPR), who may only use it to provide their service to us:
| Provider | Role | Data location |
|---|---|---|
| [to be completed] | Website and database hosting | [to be completed] |
| Google (Google Cloud, Vertex AI, Firebase, Google sign-in) | Sign-in, phone verification, AI, encrypted backups | European Union and United States |
| Stripe | Payments and invoicing | Ireland and United States |
| Twilio | Sending text messages | United States |
| Mailjet (Sinch) | Sending service emails | European Union |
| Google Analytics | Audience measurement, only if you accept it | European Union and United States |
If you are a business and store data about your own clients, our data processing agreement applies. When you share an analysis by link, anyone with the link can view it. We may also disclose data to authorities when the law requires it.
6. Transfers outside the European Union
Some providers may process data in the United States. These transfers rely on the EU-US Data Privacy Framework adequacy decision and, failing that, on the European Commission's standard contractual clauses.
7. How long we keep it
| Data | Retention |
|---|---|
| Account, analyses and photos | As long as your account is used. Deleted as soon as you delete your account |
| Inactive accounts | Deleted after 3 years without a sign-in, after a warning email at 2 years (unless a subscription is running) |
| Encrypted backups | 30 days, then erased automatically |
| Invoices and accounting records | 10 years (legal obligation, article L123-22 of the French Commercial Code) |
| Technical logs (AI, email and text delivery) | 12 months |
| Messages sent to support | 3 years after receipt |
| Consent choice cookie | 6 months |
| Audience measurement cookies | 13 months maximum |
These periods are enforced automatically every day.
8. Security
Encrypted connections (HTTPS), Google sign-in with no password stored by us, secure cookies, an encrypted sign-in cookie, access tokens you can regenerate at any time, encrypted backups, limited and logged internal access. As no measure is foolproof, we will inform you and the CNIL if a breach puts you at risk.
9. Your rights
You have the right to access, correct, erase, restrict, object to and port your data, and to withdraw your consent at any time.
- Export your data: Settings → "Data Privacy" → "Download my data" (JSON file).
- Delete your account: Settings → "Delete my account". Your subscription is cancelled and your data erased.
- Withdraw cookie consent: "Cookies" link at the bottom of every page.
- For any other request: legal@airbopti.celarli.com. We reply within one month.
Under French law, you can also leave instructions about what happens to your data after your death.
If you believe your rights are not respected, you can lodge a complaint with the CNIL (cnil.fr), the French data protection authority.
10. Minors
The service is for adults only. We do not knowingly collect data about minors.
11. Changes
We will update this policy if our processing changes. For significant changes, we let you know by email. The last update date is shown at the top of the page.
The French version of this policy prevails in case of discrepancy.
See also: cookie policy · terms · legal notice.