IN PLAIN TERMS
This site only collects the messages you send us through the contact form, and the automatic technical logs of the hosting provider (Vercel Inc., United States). It sets no tracking cookies, sells no data, and serves no advertising. The contact form is relayed by Brevo (Paris, France). You can request deletion of your data at any time by email.
Scope. This policy covers the
elysea.appsite in its entirety: the public pages (presentation, contact form) and the integrator portal (/portail/*— Supabase authentication, API key management, logs, billing). It does not cover third-party applications integrating the ELYSÉA SDK (including ELYSÉA Academy), which process separate data (including user memory) and have their own policies.
1. Data controller
ELYSÉA — company in the process of incorporation (Geneva, Switzerland) — reachable at contact@elysea.app.
GDPR contact: contact@elysea.app. Formal appointment of a Data Protection Officer (DPO) is not required at this stage and will be decided separately.
2. Data collected and purposes
| Data | When | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Name, email, message | Contact form submission | Responding to the request | Legitimate interest (Art. 6.1.f) — responding to an enquiry |
| Email, password (hashed), account creation timestamp | Account creation on /portail | Authentication and integrator account management | Contract performance (Art. 6.1.b) |
| API keys (sk_test_ / sk_live_), SDK call logs, MAU metrics | Integrator portal usage | SDK service delivery, billing, anomaly detection | Contract performance (Art. 6.1.b) |
| Technical data (server logs: IP, timestamp, user-agent) | On every visit, by the hosting provider | Security and proper operation | Legitimate interest (Art. 6.1.f) |
| Audience measurement | — | Not active (no analytics tool deployed on the public site) | — |
The Site collects no health data and does not use the form for unsolicited commercial prospecting.
3. Recipients
Data is transmitted only to strictly necessary service providers:
- — Hosting provider: Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, United States — infrastructure and technical logs. Transfer to the United States is governed by EU Standard Contractual Clauses (SCCs).
- — Email relay (contact form): Brevo SAS (smtp-relay.brevo.com), headquartered in Paris, France — forwarding messages to the publisher's inbox. Data processed within the European Union (France and Germany). ISO 27001 certified.
No data is sold or transferred to third parties for advertising or commercial purposes.
4. Location and transfers outside the European Union
The site is hosted by Vercel Inc. (United States). Requests may be served from European points of presence (Vercel CDN), but the contracting entity is a US company. Technical data (server logs, IP addresses) may transit through servers located in the United States under EU Standard Contractual Clauses (SCCs).
Contact form messages are relayed via Brevo SAS (Paris, France) — data processed within the European Union. The publisher's inbox is hosted with a French provider.
5. Retention periods
- — Contact form messages: 12 months after the last exchange, then deleted.
- — Technical logs from the hosting provider: per Vercel Inc. policy (generally a few months).
- — Audience measurement: aggregate data, not linked to any individual.
6. Your rights
Under the GDPR, you have the rights of access, rectification, erasure, restriction, objection, and portability over your data. You may exercise them at contact@elysea.app. You may also lodge a complaint with your national data protection authority (e.g. CNIL in France: www.cnil.fr).
For cross-session memory in ELYSÉA applications, consent and its revocation can be managed directly from your personal space: Manage cross-session memory →
7. Cookies
This site sets no tracking, advertising, or analytics cookies. A source code audit confirms the absence of any behavioural analytics tool or advertising pixel. No consent banner is required.
For more details: Cookie Policy.
8. AI Transparency — AI Act Art. 50
This showcase site contains no generative AI system interacting directly with visitors. ELYSÉA applications (Academy, CERVEAU) integrate language models (LLMs); in accordance with Article 50 of the European AI Act, users of those applications are informed that they are interacting with an artificial intelligence system. Builders integrating the ELYSÉA CERVEAU SDK are required to fulfil this transparency obligation towards their own users.
9. Security
The publisher implements reasonable technical and organisational measures to protect data against unauthorised access, alteration, or disclosure.