# Privacy Policy

*Last updated: February 2026*

BALTHAZAR CONSULTING ("we", "us", "AdoptionLayer") is committed to protecting your privacy. This policy explains what data we collect, why, and how we handle it in compliance with the General Data Protection Regulation (GDPR — EU Regulation 2016/679).

## 1. Data Controller

**BALTHAZAR CONSULTING**, SARL 200 Rue de la Croix Nivert, 75015 Paris, France Contact:[contact@balthazar.consulting](mailto:contact@balthazar.consulting)

## 2. Data We Collect

| Data | Purpose | Legal Basis |
| --- | --- | --- |
| Email, name (account) | Account creation and management | Contract performance |
| Page snapshots (structural only — no form values or personal data) | Providing real-time AI guidance | Legitimate interest |
| Guidance sessions (guidances) | Service delivery and analytics for customers | Contract performance |
| Page view counts | Usage metering and billing | Contract performance |

## 3. Cookies and Local Storage

AdoptionLayer does**not use cookies**. The embedded widget uses browser`localStorage`only to maintain the current guidance session state. No tracking cookies, no advertising cookies, no analytics cookies.

## 4. Sub-Processors

| Sub-Processor | Purpose | Location |
| --- | --- | --- |
| Hetzner Online GmbH | Infrastructure hosting | Germany (EU) |
| Google Cloud (Vertex AI) | LLM inference (AI responses) | France (Paris) |
| Stripe, Inc. | Payment processing | United States |

For transfers outside the EU, we rely on Standard Contractual Clauses (SCCs) or equivalent safeguards.

## 5. Data Retention

- **Account data:**retained for the duration of the account, deleted within 30 days of account deletion.
- **Guidance sessions and page snapshots:**retained for 12 months, then automatically purged.
- **Page view analytics:**retained in aggregated form for 24 months.
- **Payment records:**retained for the legally required duration (10 years in France for accounting purposes).

## 6. Your Rights (GDPR Articles 15–22)

You have the right to:

- **Access**your personal data
- **Rectify**inaccurate data
- **Erase**your data ("right to be forgotten")
- **Port**your data to another service
- **Restrict**processing in certain circumstances
- **Object**to processing based on legitimate interest

To exercise any of these rights, contact us at[contact@balthazar.consulting](mailto:contact@balthazar.consulting). We will respond within 30 days.

## 7. Security

All data is transmitted over HTTPS. Application data is stored on Hetzner infrastructure in Germany. We implement access controls, encryption at rest, and regular security audits.

## 8. Filing a Complaint

If you believe your data rights have been violated, you may file a complaint with the French data protection authority:

**CNIL**— Commission Nationale de l'Informatique et des Libertés 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 [www.cnil.fr/fr](https://www.cnil.fr/fr)