Privacy Policy — GSkills

1. Data controller and contact

• Controller: Numericoach, SASU with capital of €1,000
• Address: 165 avenue de Bretagne, 59000 Lille, France
• Email (DPO/GDPR contact): thierry@numericoach.fr

In some cases, Numericoach may act as a subcontractor for its Clients (dedicated instances).

2. Data processed

Categories of data processed depending on activated features:

• Identification and account data: name, first name, email, image/avatar, user identifier (via authentication, including Google/NextAuth), attached instance.
• Usage and measurement data: internal application events, pages viewed, dates/times, audience aggregates (Vercel Analytics "cookieless", without cookies or persistent identifiers).
• Communications: email addresses, send/receive metadata for transactional emails (Resend).
• Content and files: entered/imported content, files stored (as applicable) on Google Cloud Storage.
• Generative AI: prompts, instructions, content extracts and generated results (currently via Google Gemini) when you use AI features.
• Technical data: server logs, IP addresses, browser/device information, cookies strictly necessary for operation (see §8).

3. Purposes and legal bases

• Service provision, account management, basic personalization: contract execution.
• Security, abuse prevention, technical logging: legitimate interest.
• "Cookieless" audience measurement (Vercel Analytics): legitimate interest.
• Communication (transactional emails): contract execution; non-essential communications: consent or legitimate interest with opt-out possibility.
• Generative AI and translation functions: contract execution/legitimate interest; you remain responsible for reviewing/validating AI outputs.
• Google Analytics (optional): subject to your prior consent if activated.

4. Recipients and subcontractors

Data may be processed by:

• Hosting/distribution: Vercel (PaaS).
• Infrastructure: Google Cloud Platform (GCP); object storage (Google Cloud Storage).
• Database: PostgreSQL managed on the selected service provider's cloud infrastructure (via Prisma).
• Data storage/management: data is stored and operated by Numericoach on Google Cloud Platform (GCP) (PostgreSQL and Google Cloud Storage).
• Messaging: Resend (transactional emails).
• Generative AI: Google Gemini (via SDKs/AI APIs).
• Service location: European Union, mainly Frankfurt (Germany). AI services (Gemini) may involve processing on the provider's global infrastructure.
• Mapping (if activated): Mapbox.

Additional service providers may be used depending on activated modules, in compliance with GDPR.

5. Transfers outside EU/EEA

Some processing may involve transfers outside the EU/EEA. When required, they are framed by appropriate safeguards (standard contractual clauses, complementary measures).

6. Retention periods

Retention for the duration necessary for the described purposes, increased by applicable legal limitations (e.g., accounting obligations, security). "Cookieless" audience aggregates do not involve cookie placement.

Account and associated data deletion: you can request account deletion by writing to contact@numericoach.fr. Subject to legal obligations, we will delete or anonymize active data and initiate backup purging within reasonable timeframes.

7. Your rights

You have rights of access, rectification, erasure, limitation, opposition, portability and post-mortem directives. To exercise your rights or ask a question, contact us at thierry@numericoach.fr. You can lodge a complaint with the CNIL.

8. Cookies and trackers

• Strictly necessary cookies (examples): NEXT_LOCALE (language), GSKILLS_INSTANCE_ID (instance routing), authentication/session cookies (NextAuth), sidebar_state (UI preference). The Platform may not function without these cookies.
• "Cookieless" audience measurement: Vercel Analytics does not use cookies or persistent identifiers.
• Google Analytics (optional): if activated, it will be subject to your prior consent via a consent banner. You can withdraw your consent at any time via this banner or your browser settings.

9. Security

Reasonable security measures: encryption in transit (TLS), access control, logging, instance compartmentalization, monitoring and backups according to cloud service providers' best practices.

10. Generative AI — details

Content provided to AI and generated outputs may be processed by the AI service provider to execute the request. Results may contain errors or biases; human review/validation is required before use. AI features may be disabled at the instance level, at the Client's request or for compliance reasons.

11. Modifications

This policy may evolve. In case of substantial change, appropriate information will be provided. Continued use of the Platform constitutes acceptance of the updated policy.

12. Contact

• Email: thierry@numericoach.fr
• Address: Numericoach, 165 avenue de Bretagne, 59000 Lille, France.

13. GSkills Chrome extension

The GSkills Chrome extension runs only on gemini.google.com and connects to g-skills.fr to provide company use cases inside Gemini. The official dedicated policy is available at /llms.txt/chrome/privacy.

• Local data: the extension stores a rotating GSkills refresh token, profile and instance information, feature flags, favorite use-case identifiers, and prompts explicitly saved as favorites. Access tokens stay in memory-backed Chrome session storage. Local extension storage is restricted to trusted extension contexts.
• Data sent to GSkills: account and instance information, use-case searches and filters, and identified consultation/send events used to provide personalization and measure the extension's functionality.
• Conversation submission: the extension reads the visible Gemini conversation only after you activate the save action. Nothing is submitted until you review the transcript and click the submit button.
• AI and company sharing: a submitted transcript and your account email are sent to GSkills, processed by the configured Google Gemini AI service to create a reusable and partially anonymized use case, and the generated result is added to your company's Google Sheet. People authorized by your company may review and share that result.
• Remote images: the extension may load use-case illustrations only from GSkills domains or the GSkills Google Cloud Storage bucket, without sending the Gemini page as a referrer.
• Retention and deletion: local data remains until you remove it, disconnect, or uninstall the extension, subject to Chrome behavior. Server analytics and submitted use cases follow the retention rules of GSkills and the relevant Client instance. You may exercise your rights or request deletion using the contacts in this policy.

GSkills' use and transfer of information received from Google APIs and website content accessed by the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Data is used only to provide, secure, maintain, and measure the extension's disclosed user-facing features; it is not sold or used for personalized advertising.