Aller au contenu principal
    Grattin

    Privacy policy

    Last updated: February 25, 2026

    1. Data controller

    Agence Pistache – SAS with share capital of 70,000 €

    7 rue Gaston de Flotte, 13012 Marseille

    SIRET: 948 941 810 00012 – RCS Marseille: 948 941 810

    DPO / Contact: Nassim MARESNI

    Email: contact@grattin.app – Phone: 04 12 29 00 55

    2. Data we collect

    When you use the Grattin Service, we collect and process the following categories of data:

    • Identification data: last name, first name, company name, SIRET, business address, phone number, email address.
    • Login data: usernames, passwords (hashed), login logs, IP addresses.
    • Payment data: handled exclusively by our payment provider Stripe. The Publisher never stores complete bank details. Billing history.
    • Usage data: performance statistics, generated content, interactions with the Service.
    • Social media data: access to the Client's Instagram, Facebook, and Google Business Profile accounts (through secure API tokens).

    3. Purposes of processing

    Your data is processed for the following purposes:

    • Subscription management and billing
    • Providing and improving the Grattin Service
    • Customer support and account management
    • Generating personalized content through Grattin
    • Sending communications about the Service
    • Meeting legal and tax obligations
    • Fraud prevention

    4. Legal bases for processing

    Data processing relies on the following legal bases:

    • Performance of the contract: providing the Service the Client subscribed to.
    • Legitimate interest: improving the Service and keeping the platform secure.
    • Legal obligation: invoicing and retention of accounting records.
    • Consent: marketing communications and commercial outreach.

    5. Data recipients

    Your data may be shared with the following recipients:

    • Authorized staff at Agence Pistache (support, development, administration)
    • Stripe – secure payment provider
    • O2switch / DigitalOcean – hosting
    • OpenAI (ChatGPT) – text generation and semantic analysis
    • Wavespeed – image generation and enhancement
    • Legally authorized authorities, upon request
    Transfers outside the European Union: Some providers may be located outside the EU (notably OpenAI – United States and DigitalOcean – United States). These transfers are governed by standard contractual clauses approved by the European Commission, in accordance with the GDPR.

    6. Retention periods

    Type of dataRetention period
    Active customer dataTerm of the contract + 3 years after cancellation
    Billing data10 years (accounting and tax obligation)
    Login data / logs12 months (security)
    Generated contentDeleted within 30 days after cancellation*

    * Anonymized content may be retained to improve AI algorithms.

    7. Your rights

    In accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act, you have the following rights:

    • Right of access: confirm whether data about you is being processed and receive a copy of it.
    • Right to rectification: correct inaccurate or incomplete data.
    • Right to erasure: request deletion of your data (unless retention is legally required).
    • Right to restriction: request that processing be suspended in certain circumstances.
    • Right to object: object to processing on legitimate grounds.
    • Right to portability: receive your data in a structured, machine-readable format.
    • Right to withdraw consent: at any time, for processing based on consent.

    How do you exercise these rights?

    By email to contact@grattin.app along with proof of identity.

    Response time: 1 month maximum.

    8. Cookies

    The grattin.app website and the Grattin application may use cookies and similar technologies to:

    • Essential cookies: required for the Service to work (authentication, security)
    • Analytics cookies: audience measurement and improving the user experience
    • Marketing cookies: personalized content and targeted advertising (with consent)

    You can configure your browser to refuse cookies. Refusing essential cookies may limit access to certain features of the Service.

    9. Data security

    We put appropriate technical and organizational measures in place to keep your data secure:

    • Encryption of sensitive data (SSL/TLS)
    • Secure hosting
    • Restricted and monitored access
    • Regular backups
    • Strong password policy

    That said, since no method of electronic transmission or storage is completely secure, we cannot guarantee absolute security.

    10. Complaints

    If you disagree with how your data is processed, you can:

    • Contact us directly at contact@grattin.app
    • File a complaint with the CNIL (the French data protection authority) – www.cnil.fr
    • Use the consumer mediation service: SAS Médiation Solution – Ms. Eliane SIMON – 222 chemin de la bergerie, 01800 Saint-Jean-de-Niost, France – 04 82 53 93 06 – www.sasmediationsolution-conso.fr

    11. Changes

    We reserve the right to change this Privacy Policy at any time. In the event of a substantial change, you will be notified by email at least 30 days before the new terms take effect. The version in force is the one available on the grattin.app website.