Privacy policy
Last updated: 29 September 2026.
Controller
Mahé Chadeffaud, entrepreneur individuel, Stonetotem, 7 rue Marie-Thérèse Hermann, 74000, Annecy, France; SIREN 109 270 363. Contact [email protected] or +262 693 65 63 70 for all data protection questions.
Data and purposes
To compare the options of a decision, the service processes the decision you describe: its name, the names of the options and the figures you give. They are sent to the engine, which computes the comparison and returns it. This processing is necessary to supply the service you request (GDPR article 6(1)(b)). Do not provide personal data about other people.
A random browser identifier connects requests. Account and invoicing information is processed for approved accounts, for the contract and applicable accounting obligations (articles 6(1)(b) and 6(1)(c)). Technical request information, including IP addresses, supports security and abuse prevention (legitimate interests, article 6(1)(f)). Support messages are used to answer your request.
Recipients and international transfers
- Hosting and storage: Contabo GmbH, Aschauer Straße 32a, 81549 Munich, Germany (Amtsgericht München HRB 180722); region: Germany (European Union).
- AI language processing: Nebius B.V., Burgerweeshuispad 101, 1076ER Amsterdam, The Netherlands, through its Nebius Token Factory public serverless endpoint, running an open-weights DeepSeek model (DeepSeek-V4-Flash); the endpoint's region is Global, so processing may take place in EU or US data centres, is not pinned to one region and can change without notice; Zero Data Retention is enabled on our Nebius account, so inputs and outputs are not stored after each request is processed. When a feature that uses a language model is used, the text it needs is sent to this provider over an encrypted connection and may be processed in the EU or in the United States. The official DeepSeek API, operated from China, is not used. Nebius also states that its group entities in the United States, Israel and Serbia may access data for administration, maintenance and support; see its Token Factory subprocessor list.
- Accounts: Supabase Pte. Ltd (Singapore) for sign-in and the account database; our project is in the eu-west-3 region (Paris, France). If you choose Google or GitHub sign-in, that provider authenticates you under its own privacy policy.
- Network: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, United States, for DNS, TLS, tunnels and content delivery; traffic may be handled in its data centres worldwide.
- Email delivery: Plus Five Five, Inc. (Resend), United States, for sign-in emails, sent from the AWS eu-west-1 region (Ireland), Resend stating that its primary processing takes place in the United States; Google Ireland Limited (Google Workspace) for correspondence.
Access requests
Access to the service is by request. The access form collects five fields: your work email, your company, your role, the domain you are interested in and a short description of your use case. They are used only to assess the request and answer it (steps taken at your request before a contract, article 6(1)(b), and our legitimate interest in admitting organisations, article 6(1)(f)). The request is sent by email to the publisher through Plus Five Five, Inc. (Resend), United States, for sign-in emails, sent from the AWS eu-west-1 region (Ireland), Resend stating that its primary processing takes place in the United States; Google Ireland Limited (Google Workspace) for correspondence; it is not stored in a database by the website. A hidden field and a limit per network address protect the form against automated abuse; the IP address is used for that limit only, in memory. Requests are kept for 12 months at most, then deleted, unless an account is opened. You can ask for deletion at any time at [email protected].
Measurement tag on a customer's site
A business customer can install the Stonetotem measurement tag on its own site or app. On that site, the tag sends page views, funnel steps, referring sites and UTM tags, prices shown on pricing pages, page speed and device class to Stonetotem. It sets no cookie and writes nothing on the visitor's device. A visitor is counted with a daily hash of a random salt, the site, the IP address and the browser; the salt is destroyed each day, and the IP address and the browser string are not stored. When the browser sends Global Privacy Control or Do Not Track, the tag sends nothing. Paths are sent without their query string, except UTM tags on the first page of a visit. Audience data is kept for 25 months at most.
A customer can also send revenue events from its server: its own identifiers, amounts, currencies and dates. Customers are asked to send no email address or name in an event. The respective roles of the customer and Stonetotem for these data, and the terms that govern them, are not set out in this policy. Visitors of a customer's site can contact that customer or [email protected].
The site serves Inter Tight and Geist Mono from its own origin. Loading these fonts does not send a request to an external font provider.
Processor contracts and any safeguards for transfers outside the EEA must cover the actual deployed services. Safeguards stated in each provider's data processing terms: Nebius B.V.: EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) incorporated through section 6.2 of the Nebius DPA for transfers to countries without an adequacy decision, and its US entities Nebius Inc. and ADC Tech Inc. are covered by its EU-US Data Privacy Framework certification; Resend: EU Standard Contractual Clauses (Module Two) incorporated in the Resend DPA, which also sets out its EU-US Data Privacy Framework commitments; Supabase: EU Standard Contractual Clauses incorporated in the Supabase DPA; Cloudflare: EU-US Data Privacy Framework, and EU Standard Contractual Clauses (Module Two) in the Cloudflare DPA for any transfer it does not cover; Google Workspace only (Google Ireland Limited): under Google's Cloud Data Processing Addendum, transfers to Google LLC in the United States rely on its EU-US Data Privacy Framework certification, and other restricted transfers to its subprocessors on the Standard Contractual Clauses in that Addendum. An unresolved transfer is not authorised merely by describing it here or by obtaining health consent. You can obtain a copy of the applicable transfer safeguards from [email protected]; see also the Nebius, Resend, Supabase, Cloudflare and Google Cloud data processing terms.
Retention and operational verification
Applicable retention periods, including conversations, learning records, consent evidence, logs, account data and backups: Conversations and results: until you delete them or your account; account and profile: until deletion, erased immediately by self-service deletion; visitor cookie: 365 days; sign-in cookies: up to 30 days; AI provider: no retention (Zero Data Retention); provider backups and logs: per each provider's terms, being documented.
Verification of consent, withdrawal, deletion and processor arrangements: 26 September 2026: Nebius Zero Data Retention enabled; processor DPAs accepted through each provider's terms (Nebius, Resend, Supabase, Cloudflare, Google Workspace); self-service account deletion coded and its database migration applied; no consent-based learning active, and no learning-consent or withdrawal flow implemented yet. Publishing this policy alone does not implement those operations.
Your rights
You can request access, correction, erasure, restriction and portability where applicable, object to processing based on legitimate interests, and withdraw consent. Contact [email protected] or write to 7 rue Marie-Thérèse Hermann, 74000. We respond within one month; a justified extension of up to two further months will be explained within the first month. We request identity evidence only when necessary.
You may complain to the CNIL or your local supervisory authority. In Switzerland, see the FDPIC. Mandatory local rights remain available.
Automated estimates and children
Statistical models generate estimates from the figures you give; the website uses no language model to compute them. Estimates may be wrong. You decide what to do; the service must not be used to decide another person's access to work, credit, insurance, education or essential services. You may request a human review at [email protected].
The service is for adults aged 18 and over. Contact us if a minor has submitted data so it can be investigated and removed as required.
Security and changes
See the security policy. Where a breach meets the applicable legal thresholds, we notify the supervisory authority and affected people. Changes to purposes or consent-based uses must be communicated before they take effect, with renewed consent where required.
Legal references: GDPR and CNIL guidance on consent.