Privacy Policy — GSkills

1. Data controller and contact

• Controller: Numericoach, SASU with capital of €1,000
• Address: 165 avenue de Bretagne, 59000 Lille, France
• Email (DPO/GDPR contact): thierry@numericoach.fr

In some cases, Numericoach may act as a subcontractor for its Clients (dedicated instances).

2. Data processed

Categories of data processed depending on activated features:

• Identification and account data: name, first name, email, image/avatar, user identifier (via authentication, including Google/NextAuth), attached instance.
• Usage and measurement data: internal application events, pages viewed, dates/times, audience aggregates (Vercel Analytics "cookieless", without cookies or persistent identifiers).
• Communications: email addresses, send/receive metadata for transactional emails (Resend).
• Content and files: entered/imported content, files stored (as applicable) on Google Cloud Storage.
• Generative AI: prompts, instructions, content extracts and generated results (currently via Google Gemini) when you use AI features.
• Technical data: server logs, IP addresses, browser/device information, cookies strictly necessary for operation (see §8).

3. Purposes and legal bases

• Service provision, account management, basic personalization: contract execution.
• Security, abuse prevention, technical logging: legitimate interest.
• "Cookieless" audience measurement (Vercel Analytics): legitimate interest.
• Communication (transactional emails): contract execution; non-essential communications: consent or legitimate interest with opt-out possibility.
• Generative AI and translation functions: contract execution/legitimate interest; you remain responsible for reviewing/validating AI outputs.
• Google Analytics (optional): subject to your prior consent if activated.

4. Recipients and subcontractors

Data may be processed by:

• Hosting/distribution: Vercel (PaaS).
• Infrastructure: Google Cloud Platform (GCP); object storage (Google Cloud Storage).
• Database: PostgreSQL managed on the selected service provider's cloud infrastructure (via Prisma).
• Data storage/management: data is stored and operated by Numericoach on Google Cloud Platform (GCP) (PostgreSQL and Google Cloud Storage).
• Messaging: Resend (transactional emails).
• Generative AI: Google Gemini (via SDKs/AI APIs).
• Service location: European Union, mainly Frankfurt (Germany). AI services (Gemini) may involve processing on the provider's global infrastructure.
• Mapping (if activated): Mapbox.

Additional service providers may be used depending on activated modules, in compliance with GDPR.

5. Transfers outside EU/EEA

Some processing may involve transfers outside the EU/EEA. When required, they are framed by appropriate safeguards (standard contractual clauses, complementary measures).

6. Retention periods

Retention for the duration necessary for the described purposes, increased by applicable legal limitations (e.g., accounting obligations, security). "Cookieless" audience aggregates do not involve cookie placement.

Account and associated data deletion: you can request account deletion by writing to contact@numericoach.fr. Subject to legal obligations, we will delete or anonymize active data and initiate backup purging within reasonable timeframes.

7. Your rights

You have rights of access, rectification, erasure, limitation, opposition, portability and post-mortem directives. To exercise your rights or ask a question, contact us at thierry@numericoach.fr. You can lodge a complaint with the CNIL.

8. Cookies and trackers

• Strictly necessary cookies (examples): NEXT_LOCALE (language), GSKILLS_INSTANCE_ID (instance routing), authentication/session cookies (NextAuth), sidebar_state (UI preference). The Platform may not function without these cookies.
• "Cookieless" audience measurement: Vercel Analytics does not use cookies or persistent identifiers.
• Google Analytics (optional): if activated, it will be subject to your prior consent via a consent banner. You can withdraw your consent at any time via this banner or your browser settings.

9. Security

Reasonable security measures: encryption in transit (TLS), access control, logging, instance compartmentalization, monitoring and backups according to cloud service providers' best practices.

10. Generative AI — details

Content provided to AI and generated outputs may be processed by the AI service provider to execute the request. Results may contain errors or biases; human review/validation is required before use. AI features may be disabled at the instance level, at the Client's request or for compliance reasons.

11. Modifications

This policy may evolve. In case of substantial change, appropriate information will be provided. Continued use of the Platform constitutes acceptance of the updated policy.

12. Contact

• Email: thierry@numericoach.fr
• Address: Numericoach, 165 avenue de Bretagne, 59000 Lille, France.