Privacy Policy

The controller for your personal data is SHARESUB (a French SAS), whose full contact details appear in our Legal Notice.

We collect: your email and account preferences (language, plan); the content of your conversations with the Service; technical metadata (connected devices, timestamps, moderation flags); billing data (via our payment provider); if you contact us, the content of your exchanges with our support team.

Your data is used to: provide the Service (authentication, conversations, history); ensure the platform's security and moderation; manage your subscription billing; measure and control the technical cost of the Service per account; send you transactional communications (welcome, confirmation, data export); comply with our legal obligations.

These processing activities rely, depending on the case, on: performance of our contract with you (providing the Service, billing); our legitimate interest (security, moderation, economic steering); your consent (waitlist sign-up, non-essential cookies); our legal obligations (accounting, combating unlawful content).

Your data may be processed by the following sub-processors, strictly within the purposes described above: OVHcloud (infrastructure hosting and AI model inference, European Union — data never used to train a model); Scaleway (France) and Mistral AI (France), fallback inference providers — they only receive the content of an exchange if our primary provider is unavailable at the time of your request, under the same conditions: European Union, data never used to train a model; Supabase (authentication, self-hosted by us in Europe — the software vendor is a US company; standard contractual clauses cover this point); Stripe (payment processing); Brevo (transactional emails, French company); Staan (our web search feature's provider, European Union — only a minimal query is sent to it: the message the search is about, stripped beforehand of any email addresses, phone numbers, or identifiers it may contain, never the conversation history); Brave Search (United States — used only as a fallback when our European search provider is unavailable; the same minimized, PII-stripped query is sent to it, never the conversation content); Google (United States — only if you choose to sign in with "Continue with Google", an optional sign-in method: the email sign-in link always remains available; in that case, Google sends us the email, name, and profile picture associated with your Google account, solely to authenticate you). Each sub-processor is bound by a GDPR-compliant Data Processing Agreement (DPA).

Your data is kept for as long as your account is active. When you delete your account, a 30-day grace period allows for possible restoration, after which your data is deleted or anonymized: conversations, sessions, and usage counters are deleted; cost and billing events are kept in anonymized form (legal accounting-retention obligation); moderation logs are kept for 18 months and then automatically deleted. Technical application logs are kept for a maximum of 72 hours.

Under GDPR, you have the right to access, rectify, erase, restrict, object to, and port your data. You can download a full copy of your data from your account at any time (JSON export, available once every 24 hours), or permanently delete your account. For any other request, contact our Data Protection Officer (DPO), Jean-Brice de Cazenove, at support@surikat.ai. You also have the right to lodge a complaint with your national data protection authority (in France: CNIL, www.cnil.fr).

Our hosting and AI inference infrastructure is operated entirely in Europe. Some of our sub-processors (Stripe; the vendor of the authentication software we self-host; Brave Search, used as a fallback for our web search feature; Google, for the optional "Continue with Google" sign-in method) are US-based companies; any resulting data transfers are covered by standard contractual clauses approved by the European Commission.

We implement technical and organizational measures to protect your data (encrypted communications, restricted access to production systems, access logging). No system being infallible, we encourage you to choose a strong password and never share it.

The Service only uses cookies strictly necessary for it to function (session persistence, language and theme preferences). No advertising or third-party analytics cookie is set without your prior consent.