Privacy policy

Last updated: 10 November 2026

1. Preamble

This privacy policy describes the processing of personal data carried out by Ailoop SAS (hereinafter “Ailoop”), acting as data controller, in connection with the use of the website https://ailoop.io.

Any question about this policy or the exercise of your rights can be sent to our Data Protection Officer, Guillaume Szablewski, at contact@ailoop.io.

2. Data collected, purposes and legal bases

Ailoop only collects the data strictly necessary for the purposes listed below. No sensitive data within the meaning of the GDPR is collected intentionally.

Contact form
Data
First name, last name, email, company (optional), reason, content of the message.
Purposes
Handling of contact requests (support, sales questions, press, recruitment) and follow-up of the relationship.
Legal basis
Express consent of the data subject (Art. 6(1)(a) GDPR).
“Talk to an expert” form
Data
First name, last name, business email, company, subject, origin (source).
Purposes
Qualification of the request, organisation of a discussion with an Ailoop expert and related sales follow-up.
Legal basis
Express consent (Art. 6(1)(a) GDPR).
Appointment booking (Microsoft Bookings)
Data
First name, last name, email, phone number if provided, time slot chosen, additional information entered when booking.
Purposes
Organisation of an appointment between the visitor and an Ailoop expert.
Legal basis
Consent to loading the third-party Microsoft Bookings service (Art. 6(1)(a) GDPR), then performance of pre-contractual measures at the person’s request (Art. 6(1)(b) GDPR).
White paper download
Data
First name, last name, business email, company, job title.
Purposes
Measuring the performance of downloadable resources, editorial follow-up information and sales qualification of interested people.
Legal basis
Ailoop’s legitimate interest in measuring the reach of its resources and qualifying its prospects (Art. 6(1)(f) GDPR), combined with consent for any further communication (Art. 6(1)(a) GDPR).
Newsletter subscription
Data
Email address.
Purposes
Sending editorial content and information about Ailoop publications and events.
Legal basis
Express consent with double opt-in (confirmation email required): Art. 6(1)(a) GDPR.
Audience measurement (Matomo)
Data
Anonymised IP address, pages viewed, referrer, device type, visit duration, browsing events. The data is anonymised or processed with consent depending on the active configuration.
Purposes
Understanding how the website is used in order to improve it, measuring the audience of the content.
Legal basis
Legitimate interest for anonymised audience measurement exempt from consent (Art. 6(1)(f) GDPR); consent (Art. 6(1)(a) GDPR) for any identifying measurement. Precise terms to be confirmed once Matomo is connected.
Browsing analysis (Microsoft Clarity)
Data
Clicks, scrolling, mouse movements, session recording (input fields masked), device type, pages viewed, pseudonymous identifier stored in a cookie.
Purposes
Understanding browsing journeys and spotting usability difficulties in order to improve the website.
Legal basis
Consent (Art. 6(1)(a) GDPR and Art. 82 of the French Data Protection Act, LIL), collected through the cookie banner and revocable at any time from the “Cookie settings” link in the footer.
Technical and preference cookies
Data
Session identifiers, storage of the consent choice (CMP), display preferences.
Purposes
Operation of the website and respect of the choices expressed by the person.
Legal basis
Legitimate interest: strictly necessary cookies exempt from consent (Art. 82 LIL / ePrivacy Directive).

3. Retention periods

Your data is kept for the following periods, suited to the purpose pursued:

Prospect data (PostgreSQL database): 3 years from the last actual contact, then automatic deletion.
Newsletter subscribers: Until unsubscription.
Audience measurement (Matomo): According to the settings of the Matomo instance (to be specified upon activation).
Technical logs (web server, application): 12 months maximum.
Cookies: Lifetime specific to each cookie, stated in the CMP. As a rule, 13 months maximum for cookies set with consent.

4. Recipients and processors

Your data is intended for duly authorised internal Ailoop teams, strictly to the extent necessary for their tasks. It may be disclosed to technical processors acting on our instructions and under contracts guaranteeing a level of protection compliant with the GDPR:

Mailjet (Sinch)
Sending of transactional emails (acknowledgements of receipt, notifications).
Location: France (European Union).
Microsoft Bookings
Online appointment booking with Ailoop experts.
Location: European Union / United States: Microsoft Corporation. Transfer governed by the European Commission’s standard contractual clauses (SCCs).
Microsoft Clarity
Browsing analysis, only after consent.
Location: European Union / United States: Microsoft Corporation. Transfer governed by the European Commission’s standard contractual clauses (SCCs).
OVH SAS
Hosting of the website and the database.
Location: France (European Union).
Cloudflare
Anti-abuse protection (Turnstile), protection against attacks and content delivery network.
Location: United States / United Kingdom: governed by the European Commission’s standard contractual clauses (SCCs) and the UK adequacy decision.

5. Transfers outside the European Union

Most of our processors are established in the European Union. When a transfer outside the EU is necessary (in particular with Microsoft for the Bookings calendar and the Clarity tool, and Cloudflare for anti-abuse protection), it is governed by the standard contractual clauses (SCCs) adopted by the European Commission or, where applicable, by an adequacy decision in force (for example for the United Kingdom).

6. Your rights

In accordance with the GDPR and the French Data Protection Act (loi Informatique et Libertés), you have the following rights over your data:

Right of access to your data.
Right to rectification of inaccurate data.
Right to erasure (“right to be forgotten”).
Right to data portability.
Right to object to processing.
Right to restriction of processing.
Right to withdraw your consent at any time.
Right to set instructions regarding your data after your death.

How to exercise your rights: send an email to contact@ailoop.io with the subject “GDPR request”. We will reply within a maximum of 30 days from receipt of your request, which may be extended by two months in the complex cases provided for by the GDPR.

To verify your identity, you may be asked to attach proof of identity to your request.

7. Complaint to the CNIL

If, after contacting us, you consider that your rights are not being respected, you can lodge a complaint with the CNIL (Commission nationale de l’informatique et des libertés, the French data protection authority): www.cnil.fr .

8. Cookies and trackers

The website uses cookies for its proper operation (session, storage of consent, preferences), for audience measurement and, with your consent, for the integration of third-party services (Microsoft Bookings calendar). The detailed list of cookies used, their purposes and their lifetime is available through the cookie management banner on the website.

You can change your choices at any time from the cookie management link in the website footer.

9. Data security

Ailoop implements appropriate technical and organisational measures to preserve the confidentiality, integrity and availability of your data: encryption of exchanges in transit (HTTPS/TLS), encryption of database backups, named access control based on the principle of least privilege, logging of sensitive access, anti-abuse protection of forms, continuous updating of software components.

10. Changes to the policy

This privacy policy may be updated to reflect technical, legal or organisational changes. Any substantial change will be brought to your attention by a visible notice on the website. The date of the last update appears at the top of this page.