Privacy policy

REYTIER Bastien, Julien, Thomas, sole trader operating under the trade name Abeery, publishes ABEERY. Registered with the Dax Trade and Companies Register under SIREN number 109 930 743. 80 Impasse du Lanna, 40180 Heugas, France.

For any question or request: contact@abeery.com.

For the people who open an ABEERY account and the members of their team, and for the people who request access to the demo, we are the controller: we decide why and how their data is processed.

For the contacts, buyers and students of our customers, we are a processor: the customer decides, we carry out, under the terms of the data processing agreement. A request about these people goes to the customer concerned, and we help them with it.

Account and profile: email address and password, managed by our authentication host, the display name and the avatar, the date the terms were accepted, and the country the account was created from, derived from the connection by our host (the IP address itself is not kept). Purpose: opening the session, identifying who performed an action, reaching the account holder; the country only tells us where our clients come from.

Subscription: the billing address, the legal name and the billing email, sent to Stripe, and a copy of the invoices. The bank card is entered at Stripe; ABEERY never sees it. Purpose: billing the subscription.

Onboarding questionnaire: the answers describing the customer's business, offers and channels. Purpose: setting up the delivered Workspace.

Visitors to our customers' public pages: a randomly drawn visit identifier, the traffic source, the landing page, the referring site and the pages viewed. No IP address, no device identifier and no browser fingerprint is recorded with these measurements.

Abuse prevention: to prevent bursts of submissions (forms, sign-up, link clicks, training purchases, student portal), the IP address of the request, sometimes combined with the email address entered, is used as the key of a counter. These counters, and the IP address they carry, are deleted after 30 days.

Our customers' contacts: last name, first name, email address, phone number, company, status, notes, member in charge, source of the first and of the last visit, form answers, appointments (title, notes, video call link), sales and payments (amount, offer, buyer's email), emails received and sent, and marketing consent status with its date. Purpose: the customer's sales follow-up, on the customer's behalf.

Messages and comments, when this feature is available: for the messages and comments received on the Instagram and Facebook accounts the customer connects, the sender's name, username and identifier on the network, and the text of the messages and comments, kept as they were written. Attachments are not kept, only their type is. Purpose: letting the customer read and reply from Messages.

Students and buyers of our customers' training courses:

• the student account: email address, first name, last name, password (managed by our authentication host), date the account was created and date of last activity;
• access: training course, origin of the access (purchase or invitation), start and end dates, status (active, removed, ended);
• progress: lessons started and completed, and the playback position of each video;
• the access links sent by email, of which only a fingerprint is kept, valid for 7 days;
• for an "Immediate access, no refund" offer: the waiver of the right of withdrawal, with the date and time, the exact text of the box that was ticked, the buyer's email address, the offer, the training course and the payment reference. No IP address and no browser information is recorded with it.

Viewing time is not measured per student: only the Workspace total is, each month. Purpose: giving access to the training courses purchased or offered, and allowing the customer to prove their buyer's agreement.

Access log: when a member of the ABEERY team accesses a customer's data, the record stores their identity, the mandatory reason they entered and the timestamp. No IP address and no browser information is recorded in it. This log can neither be changed nor erased.

Demo workspace: a shared account, open to the people invited to discover ABEERY. Its data is fictitious (invented names, @example.com addresses). What a visitor enters there is visible to the following visitors and erased every night at 4 a.m., Paris time. Nothing leaves it, except the questions asked to the artificial intelligence models. No real personal data must be entered there.

Request for access to the demo, through the demo request form on ABEERY's website:

• data collected: the first name and email address entered, and the origin of the visit (landing page, referring site, campaign parameters of the address);
• purposes: sending you access to the demo workspace, then contacting you again about ABEERY;
• legal basis: pre-contractual measures taken at your request;
• recipients: ABEERY, which records your request as a contact in its own workspace, and its email provider, Brevo, which sends you the access;
• retention period: 3 years after the last contact with you;
• your rights: those of the section "Your rights"; to no longer be contacted or to have your request erased, write to contact@abeery.com.

The first name and email entered also remain in the tab's memory (sessionStorage) until it is closed, to display the confirmation page.

The details are on the cookie management page. In short: session, language, active workspace and return cookies, all set by ABEERY itself; a visit-linking token on tracked links and "My links", only if the customer has turned it on; a visit identifier in the tab's memory on public pages.

No advertising cookie and no external audience measurement tool is set. A YouTube video placed on the "My links" page is shown there through its thumbnail, copied to our servers: the page loads nothing from YouTube, and the visitor only reaches YouTube if they click.

One exception: training videos. They play in the player of our video host, Bunny, displayed in the page from its own domain; its thumbnails also come from its servers. The browser of the student (or of the visitor, for a free preview lesson) therefore contacts Bunny directly, which may set its own cookies or trackers there, under its own rules. No student identifier is sent to it: the playback link is signed and expires. Likewise, payment takes place on Stripe's page, which applies its own cookies.

Transfers outside the European Union rely on the following grounds:

• the EU–US Data Privacy Framework, to which these companies are certified: Vercel Inc., Stripe, LLC (with Stripe's standard contractual clauses as a fallback), AssemblyAI and Google LLC (YouTube);
• the European Commission's standard contractual clauses, provided for in their data processing agreement: OpenAI, from OpenAI Ireland Ltd; Anthropic; Supabase, for access from the United States and Singapore.

Retention at these providers: OpenAI receives our requests without a retention request (store: false); Anthropic applies its own retention periods. At AssemblyAI, the transcript and the uploaded video file are deleted as soon as the transcription has finished: right after its text has been saved at ABEERY if it succeeded, and right away as well if it failed. If this deletion fails, a daily catch-up retries it until it succeeds. The same applies if the media was deleted during the transcription: nothing of it is kept at ABEERY, and the transcript is deleted at AssemblyAI as soon as it finishes, or at the latest at the next daily catch-up.

Two providers, OpenAI and Anthropic, receive the requests. Each feature has a default provider; if one is unavailable, the request goes to the other. A request is only sent on an action by the customer, or every morning for the automatic analysis (every day on Grow and Scale, on Mondays on Start).

Texts the customer writes themselves are sent as they are: the customer must not put in them data that does not belong there. No login credential for a third-party service is ever sent.

• Instagram: identifying the connected professional account, publishing the content the customer asks to publish, and reading the statistics of that content. When this feature is available, the messaging and comments permissions are also requested: they are used to receive, in Messages, the messages and comments sent to the account, and to reply.
• TikTok, when this feature is available: identifying the connected account, publishing the videos the customer asks to publish, and reading the list and statistics of their videos.
• Meta Ads: read-only access to the customer's ad campaigns, to report and analyse their results. No writing, no creation and no change to any campaign.
• Facebook: choosing the customer's Page, publishing the content they ask to publish, and reading the statistics of the Page and its posts. When this feature is available, the Page's messaging and comments too, as for Instagram.
• LinkedIn: identifying the connected account, publishing on behalf of the member or, when this feature is available, of the chosen company page, and reading the posts and the follower statistics of that page.
• X: identifying the connected account, publishing the texts and media the customer asks to publish, and reading those posts.
• Google Calendar, when this feature is available: each member can connect their own Google calendar. We read the email address of the connected Google account; we create, move and delete on their primary calendar the appointments booked through ABEERY, with their title (appointment type and contact name), their notes and a video call link; we read the busy times of that calendar, so as not to offer those time slots; and, of its events, only their identifier, status and times, to reflect in ABEERY an appointment the member moves or deletes there. We never read an event's title, description or guests.

Published content and sent messages go to the platform concerned, which processes them under its own rules.

The authorisations issued by these platforms are encrypted before being stored, and the key that decrypts them is not in the database.

ABEERY's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data received from Google is used only for the feature described above: it is never sold, never used for advertising, never used to train an artificial intelligence model, and no person reads it, except at the member's request, for security or to comply with the law.

Who it is shared with. Data received from Google is passed only to our hosting processors named above: Supabase, which hosts the database, and Vercel, which runs the application. Within the Workspace, the members who can see an appointment see its times and its video call link; that link, created by Google, is also given to the contact who booked the appointment, on the confirmation page and in the appointment emails, sent through Brevo. Busy times (their start and end, nothing else) are used to work out the free slots: the public booking page shows only those slots, and only the Workspace's booking window receives the busy times to do that calculation. The email address of the connected Google account is shown to no one. This data is never sold, and never passed to anyone else.

How it is protected. It travels encrypted (HTTPS) between Google, ABEERY and the browser. The authorisations issued by Google are encrypted by ABEERY (AES-256) before being stored, with a key that is not in the database. The Google connection and the busy times can only be read by ABEERY's server, never directly from a browser; an appointment can only be read by the members of its Workspace, under access rules enforced by the database itself. Our host also encrypts the database at rest.

How long it is kept, and how it is deleted.

• Busy times: the next 60 days only, replaced at each synchronisation (every 5 minutes); erased as soon as the member disconnects.
• Email address of the connected Google account: kept with the member's connection, including after a disconnection, until a new connection replaces it or the Workspace is deleted.
• Authorisation issued by Google: on disconnection, it is revoked at Google; its encrypted copy, now unusable, stays in the database until the Workspace is deleted.
• Identifier and video call link of an event created for an appointment: kept with the appointment, so that ABEERY can move or delete that event if the appointment changes; deleted with the appointment, or with the Workspace. A disconnection does not remove the events already created from the Google calendar.
• Deletion of the Workspace: all this data is erased from the database with it, thirty days after the request. To also withdraw the authorisation at Google, the member disconnects beforehand, or withdraws it from their Google account.

A member can withdraw this access at any time: from ABEERY ("Disconnect", in "My availability"), which also revokes it at Google and erases the busy times kept; or from their Google account, at myaccount.google.com/permissions.

A Workspace's data is kept for as long as the Workspace exists. A Workspace whose owner requests its deletion is deleted thirty days after the request; a paused Workspace (subscription stopped or unpaid) is deleted after twelve months.

Some data is purged earlier, automatically:

A video still used by a draft, a scheduled post or other content is never removed.

Students. A student can delete their student account themselves from the portal: their access to all their training courses is closed. Their record (email, first name, last name), their progress and, where applicable, their waiver remain in the coach's Workspace, the coach being the controller, until the coach decides otherwise or the Workspace is deleted. The waiver is never changed or erased, except with the Workspace: it is the coach's proof of their buyer's agreement. Student accounts that only serve one Workspace are deleted with it.

Exceptions: the access log cannot be erased; the record of billing events and accounting documents follow the legal retention obligations.

You have a right of access, rectification, erasure, restriction, objection and portability, as well as the right to lodge a complaint with the CNIL (the French data protection authority).

These rights are exercised by writing to contact@abeery.com. We reply within one month. If you are a contact, buyer or student of an ABEERY customer, contact them first; write to us if you cannot identify them. The steps for an erasure are described on the data deletion page.