Privacy Policy
Last updated: June 19, 2026
1. Data controller
The controller responsible for processing your personal data is:
- Oussama BELKADI, sole proprietor (micro-entreprise), established in France
- SIREN: 947 808 812 — RCS Metz 947 808 812
- Registered office: 6 rue de Vercly, Appartement B-104, 57070 Metz, France
As a data controller established in France (European Union), Oussama BELKADI is directly subject to the General Data Protection Regulation (GDPR — Regulation (EU) 2016/679).
2. Data collected
Account data
When creating an account: email address, hashed password, and optionally first/last name.
Usage data
The analysis projects you create (product name, target market, search URL), the reports generated, and your account settings.
Analyzed verbatims
Sondeo analyzes publicly accessible data from the web (customer reviews, public discussions, ads). These verbatims are anonymized before being included in your reports: no name, pseudonym, or personal identifier is stored or displayed.
Payment data
Payments are processed by Stripe. Sondeo never stores your bank details: only a Stripe customer ID and your subscription status are retained.
Technical logs
IP address, browser, pages visited and request timestamps — collected automatically for security, debugging and audience-measurement purposes (see the cookies section).
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and managing your account | Performance of a contract (Art. 6.1.b) |
| Providing the analysis service and generating reports | Performance of a contract (Art. 6.1.b) |
| Analysis of anonymized public data from the web | Legitimate interest (Art. 6.1.f) — public, anonymized data |
| Processing payments and managing subscriptions | Performance of a contract (Art. 6.1.b) |
| Sending transactional emails (confirmation, report ready) | Performance of a contract (Art. 6.1.b) |
| Product analytics (in-app behavior, usage metrics) | Consent (Art. 6.1.a) — cookie banner |
| Security, fraud prevention, technical logs | Legitimate interest (Art. 6.1.f) |
| Compliance with legal obligations | Legal obligation (Art. 6.1.c) |
4. Retention periods
- Account data: for the lifetime of the account, then 3 years after the last activity or account deletion.
- Analysis reports: kept while the account is active and for up to 90 days after account deletion.
- Technical logs: rolling 12 months.
- Payment data (Stripe identifier): statutory retention period for accounting records (10 years in France).
5. Processors & transfers outside the EU
We use the following processors, each contractually bound to protect your data. Processors established outside the European Union may process data outside the EU as part of their service; such transfers are governed by Standard Contractual Clauses (SCCs) adopted by the European Commission and by Data Processing Agreements (DPAs), in accordance with Articles 46 and 28 of the GDPR:
| Processor | Role | Location |
|---|---|---|
| Supabase | Database, authentication, storage | EU — Frankfurt, Germany |
| Vercel Inc. | Application hosting | USA (global CDN) |
| Stripe | Payment and subscription processing | USA / EU |
| Anthropic | Claude AI API — request analysis (DPA in place) | USA |
| Resend | Transactional email delivery | USA |
| PostHog | Product analytics (EU-hosted) | EU |
| Upstash | Rate-limiting (queueing) | USA / EU |
Your personal data is stored primarily in the European Union, on Supabase servers in Frankfurt, Germany.
6. Your rights
In accordance with the GDPR, you have the following rights over your personal data:
- Right of access (Art. 15): obtain a copy of your data.
- Right to rectification (Art. 16): correct inaccurate data.
- Right to erasure (Art. 17): request deletion of your data (the "right to be forgotten").
- Right to data portability (Art. 20): receive your data in a structured, machine-readable format.
- Right to object (Art. 21): object to processing based on legitimate interest.
- Right to restriction (Art. 18): temporarily suspend processing.
- Right to lodge a complaint (Art. 77): file a complaint with the CNIL (www.cnil.fr), the French data protection authority, or the supervisory authority in your country of residence.
To exercise your rights, contact us via the contact form or by post to the registered office address given in section 1. We respond within one month (extendable to three months for complex requests).
7. Cookies
For more information on the cookies used by Sondeo, see our Cookie Policy.
8. Changes
We may update this policy at any time. Any material change will be notified to you by email or via a banner on the Site. The "Last updated" date at the top of this page governs.