Privacy Policy

Solutio — Last update: March 17, 2026

Publisher: Solutio (micro-enterprise) — Theo Le Breton

Address: 1 bis Côte de la Maison Brûlée

SIREN: 853 851 335

Hosting: Supabase (region eu-west-1, Ireland) — Hostinger (website)

Contact / DPO: contact@solutio.work

1) Data we collect

a) Marketing website (solutio.work)

Browsing data (after consent) via Google Analytics 4
Affiliate data (CJ Affiliate / Reditus clicks) to track sales
Data submitted through contact forms (Formspree) and scheduling (Calendly)

b) Solutio Carto (diagnostic tool)

User account: email, name, hashed password, authentication provider (Google OAuth)
Diagnostic data: questionnaire responses, company description, industry, headcount
Generated data: AI analyses, maturity scores, organizational map, action plans
Payment data: processed exclusively by Stripe (we do not store card numbers)
Technical logs: IP addresses, user-agent, timestamps (security and debugging)

2) Purposes of processing

Provide the organizational diagnostic service (process responses, generate analyses)
User account management and authentication
Payment processing and subscription management
Audience measurement and site improvement
Affiliate remuneration (consented sales tracking)
Service-related communications (notifications, support)
Security, fraud prevention and technical logs

3) Legal basis

Contract execution: processing data necessary to provide the service (diagnostics, analyses)
Consent: analytics, affiliate and marketing cookies
Legitimate interest: security, fraud prevention, service improvement, technical logs
Legal obligation: retention of billing data

4) Recipients and processors

Processor	Purpose	Location
Supabase	Database, authentication, edge functions	EU (Ireland)
Anthropic (Claude)	AI analysis generation	USA*
Google (Gemini)	Fallback AI	USA*
Stripe	Secure payment	EU/USA
Google Analytics 4	Audience measurement (consent-based)	USA*
Hostinger	Website hosting	EU
Calendly	Appointment scheduling	USA*

* These providers are located in the USA and operate under the EU-US Data Privacy Framework or Standard Contractual Clauses (SCC) ensuring an adequate level of protection.

AI data processing

Diagnostic data is sent to Anthropic and Google APIs solely to generate the requested analyses. This data is not used to train AI models (Anthropic and Google do not retain API call data for training purposes). No personally identifiable information is transmitted — only questionnaire responses are sent, without email or user identifiers.

5) Data retention

Accounts and diagnostics: as long as the account is active. Deleted upon request.
Billing data: 10 years (legal obligation)
Analytics: 14 months maximum
Technical logs: 12 months
Contacts / forms: duration of request processing and business relationship

6) Your rights (GDPR)

Under the GDPR, you have the following rights:

Right of access: obtain a copy of your personal data
Right to rectification: correct inaccurate data
Right to erasure: request deletion of your data
Right to object: object to the processing of your data
Right to restriction: restrict the processing of your data
Right to portability: receive your data in a structured format (JSON/CSV)

To exercise your rights: contact@solutio.work

You also have the right to lodge a complaint with the CNIL (www.cnil.fr) or your local data protection authority.

7) Data security

Encryption in transit (TLS/HTTPS) and at rest
Secure authentication (bcrypt, JWT tokens)
Row Level Security (RLS) on all tables — each user can only access their own data
API keys stored in secure environment variables (not exposed to client)
Hosted in the European Union (Supabase eu-west-1)

8) Cookies

For details on cookies used, see our Cookies Policy.

You can change your preferences at any time via the "Manage preferences" button on the cookies page.