Privacy policy

ABEERY is published by REYTIER Bastien, Julien, Thomas, a sole trader operating under the trade name Abeery. Registered with the Trade and Companies Register (RCS) of Dax under SIREN number 109 930 743.

For any question or request: contact@abeery.com

For people who open an ABEERY account, we are the data controller: we decide why and how their data is processed.

For the contacts our customers import or collect through ABEERY, we are a processor: the customer decides, we carry out. A request about those contacts goes to the customer concerned, and we help you reach them.

• Account and profile: email address and password, handled by our authentication host, plus the display name and avatar. Purpose: opening the session, identifying who performed an action, reaching the account holder.
• Onboarding questionnaire: the answers describing the customer's activity, offers and channels. Purpose: configuring the delivered account.
• Visitors to public pages: a randomly drawn visit identifier, the traffic source, the landing page and the referring site. No IP address, no device identifier and no browser fingerprint are recorded.
• Our customers' contacts: name, email address, phone, company, activity notes, first and last visit origin, and marketing consent status with its date. Purpose: the customer's sales follow-up, on their behalf.
• Access log: when a member of the ABEERY team accesses a customer's data, the record stores their identity, the mandatory reason they entered, the timestamp, their IP address and their browser. This log can neither be modified nor erased.

Seven kinds of cookies, all set by ABEERY itself: the authentication session cookies that keep you signed in; the interface language and the active workspace, kept for one year; two return markers after connecting a social network (fifteen and twenty minutes) and a password-reset marker (fifteen minutes), which carry no data; and, on the tracked links and "My links" page of a customer who has turned on visit linking (off by default), a randomly drawn visit token, kept for thirty days without renewal, that links a visit to a form filled in later. Without this setting, no cookie is set on these pages.

No advertising cookie, no third-party tracker and no external audience measurement tool is set. The visit identifier on public pages lives in the tab's memory, disappears when it closes, and identifies nobody. A YouTube video placed on the “My links” page is shown there by its thumbnail, copied to our storage: the page loads nothing from YouTube, and the visitor only reaches YouTube if they click.

• Supabase (Supabase Inc., United States) — database, authentication and file storage. Data hosted in France, Paris region.
• Vercel (Vercel Inc., United States) — application hosting. Server code runs in Paris, France, like the data storage.
• Brevo (Sendinblue SAS, France) — sending transactional and marketing email on behalf of our customers.
• OpenAI and Anthropic (United States) — text generation and analysis. See the next section for what is sent to them.
• Stripe (Stripe Payments Europe, Ireland) — payment of the ABEERY subscription, and our customers' collections on their own Stripe account.
• AssemblyAI (United States) — transcription of the videos the customer uploads, on request.

For companies established in the United States, data transfers rely on the adequacy decision for the EU–US Data Privacy Framework or, failing that, on the European Commission's standard contractual clauses.

An analysis runs on a click, or every morning for the automatic analysis (every day on Grow and Scale, on Mondays on Start). What is sent consists of totals and counts — number of contacts by status, revenue, at most five offer names. No email address and no user identifier are included, and no third-party service credential is read.

Four exceptions, and they are the only ones. Tone personalisation reads the content the customer has published themselves. The pre-meeting summary sends the display name of the contact concerned, without their email or phone number. The conversation summary, requested with a click in Messages, sends the contact's display name and the text of the messages exchanged, as written. The texts the customer writes themselves to get help — a question to the assistant, a post idea, the description of their activity and offers — are sent as they are.

• Instagram: identifying the connected professional account, publishing the content the customer asks to publish, and reading the statistics of that content. Messaging and comment permissions are requested only once ABEERY has opened them: they are then used to receive, in Messages, the messages and comments sent to the account, and to reply to them.
• TikTok: identifying the connected account, publishing the videos the customer asks to publish, and reading the list and statistics of their videos.
• Meta Ads: read-only access to the customer's advertising campaigns, to report and analyse their results. No writing, no campaign creation and no campaign modification. This read access is requested only once ABEERY has opened it, after Meta's approval.
• Facebook: choosing the customer's Page, publishing the content they ask to publish, and reading the statistics of the Page and its posts. The Page's messaging and comments follow the same rule as Instagram.
• LinkedIn: identifying the connected account, publishing on behalf of the member or the chosen company page, and reading that page's posts.
• X: identifying the connected account, publishing the texts and media the customer asks to publish, and reading those posts.
• Google Calendar: each member of a customer account may connect their own Google calendar, individually. We read the connected Google account's email address to identify it; we create, move and delete, on that member's primary calendar, the appointments booked through ABEERY (with a video-call link); and we read that calendar's busy/free times to offer available slots — never the content of other events, nor of calendars shared by a third party.

The authorisations issued by these platforms are encrypted before being stored, and the key that decrypts them is not held in the database.

ABEERY's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Account data is kept for as long as the account exists; a workspace whose owner requests deletion is deleted thirty days after the request, and a frozen workspace after twelve months. Some data is purged earlier, automatically: measurement events after thirteen months, clicks and social statistics after twenty-six months, read notifications after twelve months, raw video footage after thirty days, and the file of a published video twenty-four hours after its last successful publication, once it is published on every chosen network — only its cover, or failing that an image taken from the video, is kept; a video still used by a draft, a scheduled post or other content is never removed. Two known exceptions: the access log cannot be erased, and accounting records follow statutory retention obligations.

You have the right of access, rectification, erasure, restriction, objection and portability, as well as the right to lodge a complaint with the French data protection authority.

These rights are exercised by writing to contact@abeery.com. We reply within one month. The procedure for erasure is described on the data deletion page.