Privacy Policy
1. Data Controller
The data controller for personal data collected on unobsoless.ai is:
- Company name: Unobsoless SAS
- Registered office: [address to be completed]
- SIRET: [to be completed]
- Email: contact@unobsoless.ai
- DPO (Data Protection Officer): [to be designated]
This privacy policy aims to inform users of the unobsoless.ai website (hereinafter “the Site”) about how their personal data is collected, processed, stored, and protected, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (hereinafter “GDPR”) and French Act No. 78-17 of 6 January 1978 on Information Technology, Data Files and Civil Liberties.
2. Data Collected
In providing its services, Unobsoless collects the following categories of personal data:
a) Identification data
When creating your account, we collect: your email address, your first and last name (if provided), and your profile picture (if you sign in via Google or LinkedIn). This data is collected directly from you or via identity providers (Google, LinkedIn) that you choose to use for authentication.
b) Diagnostic data
When completing the diagnostic questionnaire, we collect: your answers to the 10 quiz questions, your sector, your job, your main tasks, your experience level, your education level, your AI usage, your digital learning ability, the importance of human interaction in your work, and your age range. From these answers, we calculate your obsolescence score and the scores across 6 analysis dimensions.
c) Payment data
Payment data (card number, expiration date, security code) is processed exclusively by our payment provider Stripe Inc. Unobsoless does not collect, store, or have access to credit card numbers. We only receive from Stripe: payment confirmation, the type of card used (Visa, Mastercard, etc.), the last 4 digits of the card, and the transaction identifier.
d) Navigation data
When browsing the Site, subject to your prior consent for analytics cookies, we may collect: pages visited, interactions with site elements, session duration, and navigation paths. This data is collected in an anonymized manner via our analytics tool PostHog and cannot be used to personally identify you.
e) Technical data
When connecting to the Site, we automatically collect: your IP address, browser type and version, operating system, screen resolution, and browser language. This data is collected for security, fraud prevention, and technical compatibility improvement purposes.
3. Purposes and Legal Bases for Processing
Your personal data is processed for the following purposes, each based on a legal basis compliant with the GDPR:
| Purpose | Legal basis | GDPR Article |
|---|---|---|
| Diagnostic service provision and report generation | Contract performance | Art. 6.1.b |
| User account and authentication management | Contract performance | Art. 6.1.b |
| Payment processing and subscription management | Contract performance | Art. 6.1.b |
| Service improvement and usage analytics | Legitimate interest | Art. 6.1.f |
| Marketing communications and newsletters | Consent | Art. 6.1.a |
| Invoicing, accounting, and tax obligations | Legal obligation | Art. 6.1.c |
| Site security and fraud prevention | Legitimate interest | Art. 6.1.f |
| Responding to support requests and complaints | Legitimate interest | Art. 6.1.f |
4. Data Retention Periods
Your personal data is retained for the following periods:
| Data type | Retention period |
|---|---|
| Account data (name, email, photo) | Duration of registration + 3 years after account deletion |
| Payment and billing data | 10 years (legal accounting obligation) |
| Diagnostic data (responses, score, reports) | Duration of service registration |
| Analytics cookies | 13 months maximum (CNIL recommendation) |
| Connection logs (technical logs) | 1 year (legal obligation) |
| Complaint and support data | 5 years from resolution |
Upon expiration of these periods, data is securely deleted or irreversibly anonymized so that the data subject can no longer be identified.
5. Data Recipients
Your personal data may be shared with the following recipients, in strict compliance with the purposes described above:
| Recipient | Purpose | Location | Safeguards |
|---|---|---|---|
| Stripe Inc. | Payment processing | USA | Standard Contractual Clauses (SCCs) |
| Resend Inc. | Transactional emails | USA | Standard Contractual Clauses (SCCs) |
| Anthropic PBC | AI processing (anonymized data) | USA | Standard Contractual Clauses (SCCs) |
| Vercel Inc. | Website hosting | USA | Standard Contractual Clauses (SCCs) |
| PostHog Inc. | Analytics (anonymized data) | USA / EU | Standard Contractual Clauses (SCCs) |
Unobsoless never sells your personal data to third parties. Data is only shared with subprocessors strictly necessary for service delivery, within the framework of contractual agreements guaranteeing the protection of your data.
6. Data Transfers Outside the European Union
Some of our subprocessors are located in the United States. Personal data transfers to the United States are governed by Standard Contractual Clauses (SCCs) adopted by the European Commission, in accordance with Article 46 of the GDPR.
These Standard Contractual Clauses ensure an adequate level of protection for your personal data. We ensure that each subprocessor implements appropriate technical and organizational measures to protect your data, including data encryption in transit and at rest, strict access policies, and regular security audits.
You may obtain a copy of the Standard Contractual Clauses by sending your request to contact@unobsoless.ai.
7. Your Rights (Articles 15-22 GDPR)
Under the GDPR, you have the following rights regarding your personal data:
- Right of access (Art. 15): You have the right to obtain confirmation as to whether your personal data is being processed and, if so, to obtain a copy of that data and information about the processing activities.
- Right to rectification (Art. 16): You may request correction of your personal data if it is inaccurate or incomplete.
- Right to erasure (Art. 17): You may request deletion of your personal data, subject to legal retention obligations (including the 10-year accounting obligation).
- Right to data portability (Art. 20): You may receive your personal data in a structured, commonly used, and machine-readable format, and transmit it to another data controller. This feature is available from your dashboard (Settings > Personal data > Export my data).
- Right to object (Art. 21): You may object to the processing of your personal data based on legitimate interest, particularly for commercial prospecting communications.
- Right to restrict processing (Art. 18): You may request restriction of processing of your data in certain cases provided by the GDPR (accuracy contested, unlawful processing, etc.).
- Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal.
- Right to lodge a complaint: You have the right to lodge a complaint with the CNIL (French Data Protection Authority): www.cnil.fr — 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.
How to exercise your rights:
- By email: contact@unobsoless.ai
- From your dashboard: Settings > Personal data section
- By mail: Unobsoless SAS, [address to be completed]
We commit to responding to any rights exercise request within a maximum period of one (1) month from receipt. This period may be extended by two (2) additional months in case of complex requests, in which case you will be informed.
8. Cookies
The Site uses essential cookies and, subject to your consent, analytics cookies. For detailed information about the cookies used, their purposes, and how to manage them, please refer to our Cookie Policy.
9. Data Security
Unobsoless implements appropriate technical and organizational measures to ensure the security and confidentiality of your personal data, and in particular to protect it against unauthorized access, loss, alteration, or disclosure.
These measures include:
- Data encryption in transit (TLS/HTTPS) and at rest
- Secure authentication via NextAuth.js with OAuth 2.0 protocol support
- Hosting on secure infrastructure (Vercel) with DDoS protection
- Parameterized queries to prevent SQL injection (via Prisma ORM)
- Separation of development, testing, and production environments
- Access to personal data limited to authorized personnel only
- Logging of access and operations on data
- Payment processing by a PCI-DSS certified provider (Stripe)
Despite all precautions taken, no method of electronic transmission or storage is completely secure. In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will inform you as soon as possible in accordance with Article 34 of the GDPR.
10. Data Protection Officer (DPO)
A Data Protection Officer (DPO) is being designated. Pending formal designation, any questions regarding the protection of your personal data may be addressed to:
- Email: contact@unobsoless.ai
- Subject: “Data Protection”
11. Changes to the Privacy Policy
Unobsoless reserves the right to modify this privacy policy at any time to bring it into compliance with legal, regulatory, or technological developments.
In the event of a substantial change, registered users will be notified by email at least 30 days before the new version takes effect. The version in effect is the one accessible on the Site. We encourage you to check this page regularly for any updates.
Last updated: March 1, 2026