This policy describes what data Stagenote processes, why, how long it is kept and what your rights are. It applies to the website and to the customer account. If anything is unclear, write to us.
1. Data controller
AI ROCKET, a sole proprietorship (entreprise individuelle) owned by François Hermand, SIREN 851 274 183, 1 rue du Seigneur Foulque, 60240 Parnes, France, email: fhermand.pro@gmail.com. No data protection officer has been appointed; requests are handled directly by the controller, at francois@rocket-ia.fr.
2. The data we process
Data processed by the website:
- photos of the rooms of your home (deleted after 30 days)
- IP address (hashed)
- orders
| Data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Email address, order contents, amount, proof of acceptance of the Terms | Perform the order, deliver, notify you, prove the sale | Performance of the contract | Unpaid orders: 30 days; paid orders: 10 years, then anonymised |
| Invoices | Accounting | Legal obligation | 10 years |
| Login codes (stored as a fingerprint), session token | Open and secure the customer account | Performance of the contract | Codes: 15 minutes; sessions: 90 days |
| IP address, as a hash | Security, abuse prevention | Legitimate interest | 30 days |
| Technical server logs | Security, diagnostics | Legitimate interest | 12 months |
| Random measurement identifier, pages viewed, order steps, origin of the visit | Audience measurement of the website | Legitimate interest (measurement exempt from consent) | 13 months |
| Your consent choice and its date | Prove your choice | Legal obligation | 13 months |
Payment is processed by Stripe: we neither receive nor keep your card details. Stripe acts as a data controller for the data needed for payment, under its own privacy policy.
3. What we do not do
- We do not sell or rent any data.
- We load no advertising tracker without your consent: if you decline, your browser contacts no third-party service.
- We do not send marketing emails without your consent; each one carries an unsubscribe link.
4. Audience measurement
To know which pages are useful and where visitors come from, we count visits ourselves. A random identifier is created in your browser on your first visit and kept for 13 months. It is only used to link your visits together on this website alone: it is not passed on to anyone and does not follow you to any other website.
We record the page viewed, the step reached in the order process, the language, the type of device and, where applicable, the campaign or website that brought you here. Your IP address is not kept: only a hash renewed every day tells two visitors apart, without making it possible to identify anyone. This measurement is limited to our own use, with no cross-referencing or transfer: it falls under the consent exemption provided by the French data protection authority (CNIL) for audience measurement. You can stop it by clearing this website's data in your browser.
5. Cookies and advertising trackers
Only with your consent, given in the banner shown on your first visit, does the website load the following trackers. Without your consent they are not loaded at all; declining changes nothing in how you can use the website.
- Google Ads (Google Ireland Limited): measuring that an order follows a click on one of our ads.
If you accepted, when an order is paid our server also reports the sale to Google (order number, amount, ad click identifier), so that the order can be matched to the ad. Without your consent, nothing is sent.
Your choice is kept for 6 months, then asked again. You can change it at any time with the "Manage cookies" link at the bottom of every page; withdrawal takes effect immediately.
6. What your browser keeps
Your browser's local storage keeps your language, your session if you sign in, your consent choice and the measurement identifier described above. These items are used only to make the website work.
7. Recipients and transfers
Processors, each limited to the data needed for its task and bound by a contract compliant with Article 28 of the GDPR:
- Hosting: OVH SAS.
- Email delivery: Brevo (Sendinblue SAS, France).
- AI reading of the uploaded room photos to produce the staging plan (photos only: no email, no payment data; not used for model training): Anthropic, PBC (United States, standard contractual clauses).
Recipients that process data on their own behalf (separate controllers, or joint controllers with us for collection by their tag):
- Payment: Stripe Payments Europe, Limited (Ireland); transfers to the United States are covered by the EU–US Data Privacy Framework and the European Commission's standard contractual clauses.
- Advertising measurement, only if you accepted it: Google Ireland Limited; transfers to the United States covered by the EU–US Data Privacy Framework.
We may be required to disclose data to the authorities where the law so requires.
8. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability of your data, the right to withdraw your consent where it is the basis of processing, and the right to give instructions on what happens to your data after your death. To exercise them, write to francois@rocket-ia.fr from the address concerned. We reply within one month. You may lodge a complaint with the CNIL (www.cnil.fr) or with the data protection authority of your country.
9. Security
Encrypted connections, restricted access to servers, one-time login codes, revocable sessions, encrypted backups. In the event of a data breach likely to put your rights at risk, we inform you and the CNIL within the legal time limits.
10. Changes
This policy follows changes to the website. Its version appears at the top; any new tracker leads to a new version and a new request for consent. The French version of this policy prevails in the event of any discrepancy.