Privacy policy

In short

• The assessment is anonymous: you give no contact details to answer the questions.
• Your contact details are only requested to send you the guide by e-mail.
• Your answers are never shared with third parties or sold, and the website sets no cookies or trackers.
• All data stays in France, with French providers.

Data controller

Nabil Kassi, Entrepreneur individuel, 6 B rue du Val d'Osne, 94410 Saint-Maurice, France.

For any question about your data or to exercise your rights: rgpd@govern-ai.fr.

Data processed and purposes

• Running the assessment: your answers to the profile (size, sector, uses of AI…) and to the questions, stored under a random identifier, with no name or address. Legal basis: pre-contractual measures taken at your request.
• Sending you the guide: business e-mail address, first name, last name, organisation, role and your consent choices. Legal basis: pre-contractual measures taken at your request.
• Contacting you to discuss your results, only if you ticked the corresponding box. Legal basis: your consent.
• Informing you of regulatory changes, only if you ticked the corresponding box. Legal basis: your consent.
• Improving the service with aggregated, anonymous statistics (number of assessments, average scores). Legal basis: the publisher's legitimate interest.

Confidentiality of your answers

Your answers may reveal weaknesses in your organisation: they are treated as confidential. They never appear in technical logs or internal notifications, which only mention the score and the alerts. Access to the administration tool requires a password and two-factor authentication.

The resume link of your assessment gives access to your answers: only share it with people you trust.

Retention periods

• Unfinished assessment: 30 days after the last answer.
• Completed assessment without a guide request: 12 months, with no identifying data.
• Contact details and the related assessment: 24 months after the last contact, then the contact details are deleted and the assessment is anonymised.
• Guides and generated documents: 30 days in storage, then deleted.
• Encrypted database backups: 7 days. Deleted data therefore disappears from backups at most 7 days after its deletion.

These periods are applied automatically every night.

IP addresses and logs

No IP address is recorded. To prevent abuse, a non-reversible fingerprint of the address is kept in memory for at most one hour, then erased. The web server keeps no visit log.

Recipients and processors

• Hosting of the website, the database and the generated documents: Scaleway SAS, 8 rue de la Ville-l'Évêque, 75008 Paris, France (RCS Paris 433 115 904).
• Sending e-mails: Scaleway SAS, France.

Only the publisher accesses your data. It relies on two processors, established in France, which may not use it for their own purposes:

Transfers outside the European Union

None. The service uses no language model, no audience analytics tool, and no font or script loaded from a third-party service.

Cookies

The public website sets no cookies and uses no trackers, so no consent banner is needed. Only the administration tool, reserved for the team, uses a strictly necessary session cookie.

Your rights

You have the right to access, rectify, erase, restrict, object to and port your data. You can withdraw your consent at any time, without affecting processing already carried out. Write to rgpd@govern-ai.fr; we reply within one month.

If you believe your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).