Privacy Policy.

We only collect the data you send us and the data generated by your browsing:

The quizzes can be used without an account and without an email. Your answers and your score stay on the quiz screen and are not stored in our comments database.

We do not collect any sensitive data within the meaning of article 9 of the GDPR, nor any banking data through this website, and our services are not intended for minors.

• Responding to your request and sending you a proposal: pre-contractual steps taken at your request (article 6.1.b of the GDPR).
• Carrying out an assignment and invoicing it: performance of the contract (article 6.1.b).
• Sending you the pre-diagnostic report: your express request, made in the assistant (article 6.1.b).
• Sending you a document you asked for: your express request (article 6.1.b).
• Contacting a business prospect again about a subject related to their activity: legitimate interest in developing our business (article 6.1.f). You can object to this at any time.
• Measuring the website audience and the performance of our campaigns: your consent, collected through the cookie banner (article 6.1.a).
• Ensuring the security of the website and preventing abuse: legitimate interest in protecting our services (article 6.1.f).
• Meeting our accounting and tax obligations: legal obligation (article 6.1.c).

The mandatory fields of the forms are marked. Without them, we cannot process your request.

In the comments, your email is used to verify your access and to restore your session. Verification does not sign you up to any newsletter. The username and the verified email are required to comment, reply or vote; reading remains public.

The assistant available on the diagnostic page (in French) and on the French version of the custom software page relies on the language models of Anthropic PBC (United States). Your answers are sent to it to run the conversation and write the report or the brief; the costed estimates, however, are calculated by our own functions, using the method published on the diagnostic page.

Anthropic acts as a processor: the data sent through our application programming interface is not used to train its models. We send it neither your name, nor your email address, nor your IP address.

The conversation thread is kept for 7 days in your browser, so that you can pick up where you left off. It does not leave your device, and clearing your browser data is enough to delete it. This storage is necessary for the service you asked for, so it is not subject to the consent banner.

If you ask to receive the report or the brief, your email address and the content of the diagnostic are sent to us and follow the same path as the other requests. Do not give the assistant any confidential information or information covered by a duty of secrecy.

If you book a call from the assistant, the summary of your needs is pre-filled in the booking form of Calendly: you can read it again and change it before confirming.

The website sets two categories of trackers, in addition to those strictly necessary for it to work:

• Audience measurement: Google Analytics, through Google Tag Manager, to understand which pages are viewed and where visitors come from.
• Advertising: Google Ads and the Meta pixel, to measure the conversions from our campaigns and to deliver advertisements.

These trackers are only set after your consent, collected on your first visit. Refusing is as easy as accepting, and does not prevent you from using the website. Your choice is kept for 6 months, after which you are asked again.

You can change or withdraw your choice at any time through the “Manage cookies” link in the footer. The lifetime of the trackers set does not exceed 13 months, and the data derived from them is not kept beyond 25 months.

Your choice is stored in your browser's local storage, not in a cookie. Strictly necessary trackers, such as those Cloudflare uses for the security of the website, are set without consent, as the regulations allow.

The YouTube videos embedded in our articles only load after you click on them. As long as you do not click, YouTube stores nothing on your device.

After your email has been verified for the comments, the community_session cookie keeps you logged in for 30 days at most. It is limited to the discussion features, inaccessible to the page's scripts and sent over an encrypted connection in production. The “Me déconnecter” (log out) button invalidates the session and removes this cookie.

Your data is processed by Pierre Bour and, where applicable, by the Scale Me team members assigned to your file. We use the following service providers, who act on our instructions:

We may also disclose data to our advisers, to our chartered accountant, or to an authority requesting it within the framework provided for by law.

Some of our service providers are established in the United States, as is the data controller. These transfers are governed by the standard contractual clauses of the European Commission, supplemented where applicable by the provider's participation in the EU-US Data Privacy Framework and by technical measures such as the encryption of data flows.

You can ask us for a copy of the applicable safeguards at hello@scale-me.fr.

• Request with no commercial follow-up: 3 years from your last contact.
• Client: for the duration of the contractual relationship, then 3 years for prospecting. Accounting and contractual documents are archived for 10 years, in accordance with the law.
• Pre-diagnostic report sent by email: treated as a request, so 3 years from the last contact.
• Conversation with the assistant: 7 days in your browser, and nothing on our side unless you ask for the report.
• Trackers and measurement data: 13 months for the trackers, 25 months for the data derived from them.
• Technical security logs: 12 months at most.

At the end of these periods, the data is deleted or anonymised. Data archived for a legal reason is kept with restricted access, solely for the use provided for by law.

For the comments, a code can no longer be used after 10 minutes and a session after 30 days at most. The expiry of access does not automatically erase the records in the database. Accounts, comments, votes and moderation records have no automatic purge in this version. Hiding a comment removes it from the public thread, without erasing its content from the database. To ask for your participation data to be deleted, write to hello@scale-me.fr.

We implement appropriate technical and organisational measures: encryption of exchanges, access limited to the people who need it, strong authentication on our accounts, rate limiting on the public entry points of the website, and minimisation of the data collected.

In the event of a data breach likely to result in a high risk to your rights and freedoms, we will inform you as soon as possible and notify the competent supervisory authority under the conditions laid down by the GDPR.

You have the right of access, rectification, erasure, restriction and portability, and the right to object to processing based on our legitimate interest. Where processing is based on your consent, you can withdraw it at any time, without affecting what was done before. You can also set instructions regarding what happens to your data after your death.

To exercise these rights, write to hello@scale-me.fr. We reply within one month, extended to three months if the request is complex, and we may ask you for proof of identity in case of reasonable doubt.

Every prospecting message explains how to stop receiving them: a simple reply is enough. If you believe your rights are not being respected, you can lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL, the French data protection authority), www.cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or with the supervisory authority of the EU country where you live (in Malta, the Information and Data Protection Commissioner, idpc.org.mt).

We may update this policy to reflect a change in our services, our tools or the regulations. The date of the last update is shown at the top of this page. In the event of a substantial change, we will inform you by appropriate means before it comes into force.

This policy is governed by French law and by Regulation (EU) 2016/679. It is written in French; in the event of translation, only the French text is authoritative. The invalidity of one clause does not affect the validity of the whole.