Your data
Privacy policy
Who is responsible
AGENCEO SAS, 200 rue de la Croix Nivert, 75015 Paris, publishes this site and is responsible for the data it collects, including the diagnostic's.
For the data in your tools, when we work for you, your company remains responsible for its data: we process it on its behalf, following its instructions, under a data processing agreement.
When you visit the site
Our host, Vercel, processes the technical information of each visit (network address, browser, page requested) to serve the site and protect it.
The site uses no audience measurement or advertising cookie. One cookie remembers the language of the pages you read, for one year.
The diagnostic
The diagnostic asks you about fifteen questions and gives you a personal report. Here is what it collects and what we do with it.
- The data collected
Your answers to the questions, including what you write freely, and the answers left unfinished (without an e-mail address).
Your first name, your company's name and your e-mail address, work or personal; a personal address (Gmail, Outlook…) is accepted and flagged as such to our team. A simplified form of the address (without "+tag") and its fingerprint are used to recognise it.
The report computed from your answers: score, map of your tools, estimate, recommendations and scenarios (written by the AI, with the model's name and the amount of text exchanged, or chosen from our library), with the versions of the questions and rules that produced it.
What comes with your diagnostic: the type of device (phone, tablet or computer), where your visit came from (utm_* parameters of the address and the name of the site you came from), the time taken to answer, the language, how many times the report was opened and the date of the first time, the number of PDF downloads, the date and origin of a call booked, the date of an unsubscription, the date and version of your agreement to follow-up messages if you ticked the box provided, two flags (sent too fast, so likely a robot; address deleted before), the list of e-mails sent or to be sent with their dates, and an opaque reference given to the calendar.
Your network address, never in clear: only as a fingerprint, to limit the number of requests from one connection. These counters are erased after a day, as new requests come in.
- Why
To prepare your report, show it to you and send it to you by e-mail, at your request.
To let our team know a diagnostic has arrived, with your answers and contact details, so we can reply to you personally if your situation calls for it.
If you tick the box provided, to send you at most three follow-up messages within ten days; each one lets you unsubscribe in one click.
To let you book a call.
To protect the service against abuse (limits per connection and per address, robots) and keep anonymous figures on the use of the diagnostic.
- On what basis
The report and its sending: your request, when you send the form.
The alert to our team and our possible personal reply, the protection against abuse and the anonymous figures: our legitimate interest in answering companies interested in our services and in protecting the site.
The follow-up messages: your consent, given with the form's optional box. You can withdraw it at any time, with the unsubscribe link of each message or by writing to us.
- For how long
Answers left unfinished, without an e-mail address: erased after 30 days.
A complete diagnostic: kept 24 months, then erased.
The link to your report: valid for 90 days. The unsubscribe and deletion links of our e-mails stay valid as long as your data is kept.
The alert received by our team in its mailbox (Google Workspace) stays there until we delete it; we delete it on request.
If you delete your answers with a link of our e-mails: a fingerprint of your address, which cannot be read back, is kept 36 months, so as not to write to you again. If you unsubscribe: such a fingerprint is kept 36 months, so as not to send you follow-up messages again.
When a diagnostic is deleted, our team receives, to find and delete the matching alert, the company's name, the date and the score: these three items are kept 30 days at most in our database, and the e-mail carrying them stays in our mailbox until we delete it.
A fingerprint of your e-mail address also counts the reports of the day: it is erased within two days.
Brevo, which sends our e-mails, keeps its own history of what it sends, for its own retention periods.
- Who receives it
Our team, and these providers, for the service described only: Supabase (database, in Frankfurt), Vercel (hosting of the site), Brevo (sending e-mails), Google Workspace (our mailbox, which receives the alert of each diagnostic) and iClosed (booking: as soon as you show the calendar, the anonymous reference of your diagnostic and your browser's technical data, such as its network address; then what you enter if you book a call).
Anthropic writes the scenarios of your report from your answers only, without your first name, your company or your e-mail address; Anthropic keeps these answers for up to 30 days, longer for content flagged under its usage policies. Avoid writing personal information in the free answers.
The e-mails sent to the address entered repeat nothing written in the form: no first name, no company, no free answer, no text written by the AI. Your full report stays on its page.
- Outside the European Union
Anthropic processes your answers in the United States.
Vercel, which hosts the site, is an American company (Vercel Inc.): pages are computed in Frankfurt, and the site's public files are served by its worldwide network.
Supabase hosts the database in Frankfurt; the company we contract with, Supabase Pte. Ltd., is established in Singapore.
For Google Workspace and iClosed, the place of processing is being checked.
The safeguards framing these transfers are being checked: until they are established, the register of subprocessors shows them as "to be confirmed".
- Cookies
A strictly necessary cookie keeps your diagnostic in progress while you answer: it lasts 30 days at most, and it is erased when you send the diagnostic.
A cookie remembers the language of the pages you read: it lasts one year from when it is written, and it is written again when you read a page in another language.
The booking calendar loads only after a click on the button provided; once shown, iClosed may set its own cookies, whose list and duration we do not control.
- Your rights
You can access your answers and have them deleted at any time, with the "Delete my answers" link in your report and our e-mails, or by writing to privacy@centralbrain.ai.
Unsubscribing stops the follow-up messages; your answers stay kept for their duration. Deleting your answers erases the diagnostic from our database; from a link of our e-mails, every diagnostic sent with your address is erased.
On request, we also delete the copy of the alert kept in our mailbox.
When we work for you
Before accessing your tools, we sign a data processing agreement with your company. It sets the data concerned, what we do with it, where it is hosted and how long we keep it.
The people on your team who use your central brain have an account: name, e-mail address, language, password kept as a hash, two-factor authentication. Sign-ins and sensitive actions are written to a log.
At the end of our work together, we remove our access to your tools.
Artificial intelligence
For our clients' central brain, our rules reserve production for AI models called in the European Union (AWS Bedrock), with only the data the person asking is allowed to see.
One exception, limited to this site's diagnostic: the writing of the scenarios by Anthropic, from your answers only, described above.
Your rights
You have the right to access, correct, erase, restrict, object to and port your data, and to withdraw your consent at any time.
You may also lodge a complaint with the CNIL (cnil.fr), the French data protection authority.
Write to us
To exercise your rights or ask a question about your data, write to privacy@centralbrain.ai
Our providers
They process data on our behalf, only for the service described. For each one, the subprocessors registry gives its role, the data processed, where, and whether it is already in service.
- SupabaseIn use
- VercelIn use
- BrevoIn use
- Google WorkspaceIn use
- iClosedIn use
- AnthropicIn use
- NangoIn use
- Amazon Web Services (AWS Bedrock)Planned, not in service yet
- LangfusePlanned, not in service yet
Security
Our security measures are described on their own page. See the security page