Privacy policy
Last updated: 10 October 2026
This English translation is provided for information purposes only. In the event of any discrepancy or inconsistency between this translation and the French version, the French version shall prevail.
Contents
1. Data controller
PHASEN, a French simplified joint-stock company (société par actions simplifiée) with a share capital of 100 euros, registered with the Paris Trade and Companies Register (Registre du commerce et des sociétés) under number 106 966 005, whose registered office is located at 47 rue Vivienne, 75002 Paris, acts as data controller for the processing operations described in this policy.
Data protection contact: contact@phasen.co.
2. PHASEN’s roles depending on the processing
PHASEN acts as data controller for the management of the website, prospects, accounts, subscriptions, payments, support, security, abuse prevention, usage measurement necessary for the operation of the Service and its own legal obligations.
Where PHASEN processes, on behalf of an Organisation, personal data entered by that Organisation into its projects, proposals, contacts, media or client areas, the Organisation in principle acts as data controller and PHASEN as processor within the meaning of Article 28 of the GDPR. The applicable terms are set out in the Data Processing Agreement (DPA).
3. Data that may be processed
Identification and account data: surname, first name, company, job title, e-mail address, login credentials and account preferences.
Billing and subscription data: billing details, plan subscribed to, invoices, payment status and technical transaction references. Full payment card data is processed by the payment service provider and is not stored by PHASEN.
Usage and security data: connection logs, IP address, browser, device, technical events, AI Credit consumption, administrative actions and information necessary for the prevention of abuse.
Support data: requests, exchanges, attachments and information provided during a diagnosis.
Data contained in projects: client names, comments, contacts, media, documents, proposals, products, annotations or other information added by the User.
Client area data: identity provided by the professional where applicable, comments, products proposed, choices, acceptances, rejections and approvals recorded in connection with a proposal.
Data transmitted to AI or 3D generation services when a corresponding feature is triggered: source images, prompts, parameters, metadata and results necessary for the processing.
Data relating to partner links: attribution parameters, technical click identifiers and information necessary for tracking an affiliation or partnership when this feature is used.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating and administering accounts, providing the Service, managing subscriptions and AI Credits | Performance of the contract |
| Invoicing, collecting payments, keeping accounting records and managing unpaid amounts | Performance of the contract / legal obligation |
| Providing support, maintenance, security and continuity | Performance of the contract / legitimate interest |
| Preventing fraud, abuse, unauthorised automated extraction and incidents | Legitimate interest |
| Measuring usage necessary for the operation, sizing and improvement of the Service | Legitimate interest; consent where required for trackers |
| Sending marketing communications to business prospects or clients | Legitimate interest or consent depending on the context and the applicable regulations |
| Processing data entered into projects on behalf of an Organisation | Documented instructions of the data controller, under the DPA |
| Performing an AI or 3D generation or an enrichment requested by the User | Performance of the contract; processing on behalf of the client where the data forms part of a client project |
| Managing affiliate links and the attribution of a purchase when this feature is used | Legitimate interest / performance of the relevant agreements; consent where required for a tracker |
5. Recipients
Data is accessible, on a strict need-to-know basis, to authorised PHASEN personnel and to the service providers necessary for the operation of the Service. Depending on the features used, these categories may include:
hosting and infrastructure;
authentication, sending of transactional e-mails, monitoring and support;
payment and invoicing;
audience measurement and technical analysis tools, subject to the applicable consent choices;
AI generation, 3D generation or data enrichment service providers;
catalogue, feed or API suppliers or partners where necessary for the service requested;
partner networks or merchants for the attribution of an affiliate link;
publishers of third-party assistants or connectors where the User expressly activates an integration.
PHASEN does not sell its Users’ personal data to third parties.
6. AI services and third-party connectors
When a User triggers an AI, 3D generation, enrichment feature or an authorised connector, the strictly necessary data may be transmitted to the relevant service provider in order to carry out the action. Where technically and contractually possible, PHASEN configures the services so as to limit the retention and secondary use of content.
Connectors used from ChatGPT, Claude or Gemini are activated at the User’s initiative. These third-party services remain governed by their own terms and policies. The User must check the permissions granted and may revoke them using the mechanisms made available.
7. Transfers outside the European Economic Area
Certain service providers may process data from a country located outside the European Economic Area. In such cases, PHASEN ensures that a mechanism provided for in Chapter V of the GDPR applies, in particular an adequacy decision, the European Commission’s standard contractual clauses or any other appropriate safeguard, supplemented where necessary by additional measures.
8. Retention periods
| Category | Period or criterion |
|---|---|
| Account and contract | For the duration of the contractual relationship, then for the period necessary for evidential purposes and legal obligations |
| Invoices and accounting records | 10 years from the end of the relevant financial year, unless a different requirement applies |
| Business prospects | Up to 3 years after the last contact, or earlier in the event of objection, unless a contractual relationship is subsequently entered into |
| Security logs | Period proportionate to security and evidential needs, limited in principle |
| Project data | For the lifetime of the Account, then in accordance with the deletion, reversibility and backup mechanisms provided for by the Service and the DPA |
| Support tickets | Period necessary for handling, then archiving proportionate to evidential needs and to the improvement of support |
| Cookie choices | Period indicated in the cookie policy |
| Review reward data | Period necessary to prevent multiple awards and to prove the consideration provided |
9. Security
PHASEN implements technical and organisational measures appropriate to the risks, including access control, protection of communications, logging, backups, monitoring and logical segregation of environments. As no system can guarantee absolute security, the User must also protect their credentials, devices and access.
10. Your rights
Depending on the applicable regulations and the capacity in which PHASEN processes the data, you may have a right of access, rectification, erasure, restriction and objection and, where the conditions are met, a right to data portability. You may also withdraw your consent at any time without affecting the lawfulness of prior processing.
To exercise a right: contact@phasen.co. PHASEN may request the information necessary to verify the requester’s identity. Where the request concerns data processed on behalf of a client Organisation, PHASEN may forward it to that Organisation or assist it in accordance with the DPA.
You may also lodge a complaint with the CNIL (the French data protection authority).
11. End-client data
The client area enables a professional to share a proposal with their own client. The professional determines the data they publish there and the purpose of its processing. Viewing, commenting, comparing, proposing products, accepting, rejecting or approving actions may be recorded in order to provide the Service and keep a history that is useful to the professional.
12. Minors and sensitive data
The Service is intended for professionals. It is not designed to knowingly collect data relating to minors or special categories of data within the meaning of the GDPR. The User must avoid entering into Phasen sensitive or excessive data that is not necessary for their project.
13. Cookies and trackers
Information relating to cookies, local storage, audience measurement tools and attribution parameters is set out in PHASEN’s Cookie Policy.
14. Changes to this policy
PHASEN may update this policy in order to reflect changes to the Service, its service providers, the regulations or its processing operations. The date of the last update shown at the top of the document makes it possible to identify the applicable text.
15. Contact
For any question relating to data protection: contact@phasen.co.