This English translation is provided for information. The French version prevails.
This policy explains what personal data we process on boitech.dev, enterprise.boitech.dev, web.boitech.dev and in the client area (web.boitech.dev/my), why, for how long, and how to exercise your rights.
In short
- We only collect what we need to answer you, build your website and bill for it.
- No advertising on our websites, no data resale, no third-party trackers. Our fonts are hosted by us.
- We count web.boitech.dev’s visits ourselves: no cookies, nothing stored on your device, and your IP address isn’t kept.
- If you come from one of our Google ads, we ask whether you accept Google’s cookies to measure our ads. Without your consent, nothing is stored or sent to Google.
- If you come from one of our ChatGPT ads, we ask whether you agree to OpenAI measuring our ads from your visit. Without your consent, nothing is sent to OpenAI; with it, nothing is stored on your device.
- Your data is hosted in France. Payments go through Stripe: we never see your card number.
Data controller
Adrien Boitelle (BoiTech), 20 bis rue Maladrerie, 76000 Rouen, France, contact@boitech.dev. See the legal notice.
Data, purposes and retention
Contact forms
Name, email or phone, company or trade, and your message. Purpose: answering you and, if you ask, making you an offer. Legal basis: steps taken at your request before a contract, and our legitimate interest in answering messages. Retention: up to 3 years after our last exchange, unless you become a client (the data then belongs to your client account).
Client account
Email, password (stored only as a hash, never in clear), name, phone and company (optional), language, two-factor authentication secret (encrypted) and, if you use “Continue with Google”, your Google ID, email and name. Purpose: creating and securing your account and letting you follow your requests and websites. Legal basis: performance of the contract. Retention: until you delete your account, which you can do at any time in “My account” when no website is online. An account with no sign-in and no website online for 3 years is deleted after we warn you.
Sign-in security
IP address and browser of each open session, to show you your active sessions, let you close them and detect abuse. Legal basis: our legitimate interest in securing accounts. Retention: 30 days after the session’s last activity.
Projects and messages
Descriptions of your requests, files you send us (logo, photos, texts), messages, screenshots of your website and project steps. Purpose: designing, publishing and updating your website. Legal basis: performance of the contract and pre-contractual steps. Retention: as long as your account exists, unless you delete the website first. A website left without activity is deleted automatically, after a warning by email 30 days before: drafts, projects waiting for you and declined requests after 6 months, websites whose subscription has ended after 12 months.
You can start your request without an account: the draft and its files then stay in your browser (see “Cookies and local storage”) and nothing is sent to us. They go into your account, then are erased from your browser, when you sign up or sign in to send it.
Payment and invoicing
Payments are processed by Stripe. We keep the Stripe customer ID, the status and dates of your subscriptions, and your invoices. Purpose: collecting and renewing subscriptions and keeping our accounts. Legal basis: performance of the contract and our legal obligations. Retention: invoices and accounting records are kept 10 years (article L. 123-22 of the French Commercial Code), even after the account is deleted.
Orders, cancellations and withdrawals
Date and time of each order, version of the terms accepted, and your cancellation or withdrawal requests. Purpose: proving the contract and your requests. Legal basis: our legal obligations and our legitimate interest in being able to evidence our contracts. Retention: 5 years after the end of the contract.
Measuring our Google ads
We advertise on Google. When you click one of our ads, Google adds a click ID to our page’s address, and we ask whether you accept Google’s cookies to measure our ads. Declining, or not answering, changes nothing: the site works the same, no Google cookie is stored and nothing is sent to Google.
If you accept: the Google Ads tag (Google Ireland Limited) loads on our pages and in the client area, and stores its measurement cookies (see “Cookies and local storage”). It tells Google when you create your account and send your request, with a fingerprint of your email address computed in your browser (SHA-256 hash, irreversible): Google can then link these actions to your click without receiving your address (“enhanced conversions”). The client area also attaches the click ID to your account, then we send Google that ID, the date of your request and, if it happens, the date and amount of your first payment. Never your name or what your request says. No personalized advertising: we only ask Google to measure its ads. Purpose: measuring how well our advertising works. Legal basis: your consent (article 82 of the French Data Protection Act). Retention: 90 days after the click.
Your choice is kept 6 months; after that, we ask again if you come back through an ad. You can change it at any time with the “Cookies” link at the bottom of our pages: declining then erases the click ID from your account, and we send Google nothing more (what was already sent stays valid).
Measuring our ChatGPT ads
We also advertise in ChatGPT. When you click one of our ads, ChatGPT adds a click reference to our page’s address, and we ask whether you agree to OpenAI measuring our ads from your visit. Declining, or not answering, changes nothing: the site works the same and nothing is sent to OpenAI.
If you accept: the client area attaches the click reference to your account when you sign up or sign in, then our servers send OpenAI that reference as is, the fact that you sent your request and its date and, if it happens, the date and amount of your first payment, with the address of the client-area page concerned, when they happen within 30 days of the click. Never your name, your email, your IP address, your browser or what your request says. OpenAI stores nothing on your device: no OpenAI script, pixel or cookie loads on our pages. Purpose: measuring how well our ads in ChatGPT work. Legal basis: your consent (article 6(1)(a) GDPR). Retention: 90 days after the click.
Your choice is kept 6 months, apart from your answer about Google’s cookies; after that, we ask again if you come back through an ad. You can change it at any time with the “Cookies” link at the bottom of our pages: declining then erases the click reference from your account, and we send OpenAI nothing more (what was already sent stays valid).
Emails
We send you emails about your account and websites (address verification, security alerts, project progress, payments, renewals) from our own mail server. We don’t send marketing emails without your consent.
Server logs
Our web servers record the IP address, date, requested page and browser of each visit. Purpose: security and troubleshooting. Legal basis: our legitimate interest. Retention: 14 days.
Visit statistics
We count web.boitech.dev’s visits ourselves, to know which pages and buttons are useful and where our visitors come from (search engine, AI assistant, social network, another website, our ads). On each page view, each click on one of our buttons, when you start and finish drafting a request and when the client area’s sign-up or sign-in screen shows, your browser sends our server the page, its language, the button clicked, the name of the website you came from and the address’s campaign parameters; sending a contact or quote form is counted too. Our server adds an ID for the day, computed from your IP address, your browser and its languages with a secret key that is changed and erased every day: it counts a person once a day, then can’t be computed again or linked to another day. Your IP address isn’t kept, nothing is stored on or read from your device (no cookies, no local storage) and no third party is involved. Robots and our team aren’t counted.
If you create an account, it keeps the origin of the visit you created it in (the kind of source, the landing page and the last button clicked), to count the requests and orders each source brings; never the pages you viewed. Purpose: visit statistics to improve our pages. Legal basis: our legitimate interest. Retention: 25 months. You can object by writing to contact@boitech.dev.
Visitors of our clients’ websites
When we host a client’s website, its visitors’ data is processed on behalf of that client, who is the controller; we act as processor (see the terms of sale).
Recipients
Only BoiTech has access to your data. We use the following providers:
- Stripe Payments Europe, Ltd. (Ireland): payments and invoicing (Stripe’s policy).
- OVH SAS (France): network and email.
- Google Ireland Limited: only if you choose “Continue with Google”, or if you accept Google’s cookies to measure our ads (Google’s policy).
- OpenAI Ireland Limited (Ireland): only if you agree to OpenAI measuring our ads from your visit (OpenAI’s policy).
We never sell or rent your data. It may be disclosed to authorities when the law requires it.
Transfers outside the European Union
We host your data in France. Stripe and Google may transfer some data to the United States; these transfers are covered by the European Commission’s adequacy decision on the EU–US Data Privacy Framework and by standard contractual clauses. OpenAI Ireland Limited commits to cover any transfer of our ads’ measurement data to a country without an adequate level of protection by a valid GDPR transfer mechanism.
Cookies and local storage
- __Host-my_session: sign-in cookie of the client area, required for it to work; 30 days after your last visit.
- i18nextLng (your browser’s local storage): remembers the language you chose.
- boitech_ads_consent (local storage): remembers your answer about Google’s cookies; 6 months.
- boitech_openai_consent (local storage): remembers your answer about OpenAI measuring our ads; 6 months.
- boitech_draft (local storage, and the IndexedDB database of the same name for the files you add): the draft of the request you started without an account, until it goes into your account or you delete it.
These are strictly necessary for the service you ask for, so they don’t require consent (article 82 of the French Data Protection Act). Stripe’s payment page (checkout.stripe.com) uses its own cookies, needed for payment security and fraud prevention.
Only if you come from one of our Google ads and accept its cookies, the Google Ads tag stores the _gcl_au and _gcl_aw cookies on our domain (click ID and conversion measurement; 90 days), and Google may use its own cookies on its domains (see Google’s list). Measuring our ChatGPT ads stores nothing on your device: it happens from our servers. We use no other advertising cookies and no social media cookies; our visit statistics use no cookies at all. You can withdraw your consent at any time with the “Cookies” link at the bottom of our pages.
Security
Encrypted connections (HTTPS), hashed passwords, optional two-factor authentication, encrypted secrets, restricted access and backups. If a data breach puts you at risk, we tell you and notify the CNIL as required by the GDPR.
Your rights
You have the right to access, rectify, erase, restrict, object to and port your data, and to set instructions for what happens to it after your death. You can edit your account, download your data or delete your account yourself in “My account”, or write to contact@boitech.dev. We answer within one month and may ask you to prove your identity if in doubt.
If you believe your rights are not respected, you can complain to the CNIL, the French data protection authority (www.cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07).
Minors
Our services are for adults and businesses. The client area is not intended for people under 18.
Changes
We may update this policy. The date of the latest version is shown at the top of the page; for significant changes, we notify account holders by email.