Privacy policy

1. Who is responsible

Qastel AI SAS (being incorporated), Paris, France, is the data controller for the processing described in this policy. Our identity and postal details are on the legal notice.

For anything to do with your personal data (a question, a request, a complaint) write to privacy@qastel.ai. A named person answers; there is no ticket queue.

2. What this policy covers, and what it does not

This policy covers this website, qastel.ai, and the business relationships that start here: messages you send us, trials you ask for, and applications to join the team. Where a link takes you to a service run by someone else, that service's own privacy notice governs what happens once you are there.

It does not cover the Qastel product at app.qastel.ai. There, the data comes from a customer's own systems, and the roles are reversed: the customer organisation is the controller and Qastel is its processor, acting only on that customer's documented instructions under a Data Processing Agreement. What we process there, where it lives and who else touches it is documented on the trust page, including the subprocessor list and our EU data residency commitments.

One consequence is worth stating plainly. If your employer uses Qastel and you want to know what it records about your AI usage, ask your employer, not us. They decide what is collected and for how long; we cannot lawfully act on your request without their instruction, and we will forward it to them.

3. What we process, why, and for how long

Visiting the site

Our web server writes an access log entry for every request: your IP address, the page requested, the date and time, the HTTP status, and your browser's user-agent string. We use it to keep the site available and to investigate abuse: our legitimate interest under article 6(1)(f) GDPR in operating a secure service. Entries are held for 30 days and then deleted.

Writing to us

If you use the contact form, or write to hello@qastel.ai or press@qastel.ai, we process your name, e-mail address, the organisation you mention, and whatever you put in the message. The basis is either steps taken at your request before entering a contract (article 6(1)(b)) or our legitimate interest in answering correspondence (article 6(1)(f)). We keep the exchange for up to three years after our last contact, the standard the CNIL sets for prospect records, then delete it.

Asking for an enterprise trial

The trial form collects your name, work e-mail, phone number, company, company size, which part of Qastel you are interested in, and your message. Same basis and same retention as a message sent through the contact form.

Applying for a job

Applications sent to careers@qastel.ai (your CV, covering letter and contact details) are processed to assess your application, on the basis of steps taken before entering an employment contract. If we do not hire you, we keep the file for up to two years so we can come back to you if a suitable role opens, in line with CNIL guidance, and delete it after that. Tell us if you would rather we deleted it straight away, and we will.

Reporting a vulnerability

Reports sent to security@qastel.ai are processed so we can fix the issue and keep a record of how we handled it: our legitimate interest in the security of the service. We keep the report, and your contact details if you gave them, for as long as we need to remediate and document it.

4. Analytics without cookies, no advertising, no profiling

We use one analytics tool, Microsoft Clarity, and run it in cookieless mode. Before the Clarity tag loads, the page denies both storage categories exposed by Clarity's consent API. Microsoft says that, when storage consent is denied, Clarity sets no cookies and creates a new user identifier for each page view. It therefore cannot link one page view to the next or recognise a returning visitor.

Clarity records how a page is used: the page visited, clicks, scrolling, mouse movement, the browser viewport, device type and user-agent string. The root of this site is explicitly marked for masking, so page text is masked in the browser before upload. Microsoft says masked content is never sent to its servers. Your IP address reaches Microsoft because your browser connects to it directly, as it does for any third-party request.

We use this information to learn which parts of the site are read and which are ignored, so we can improve confusing pages: our legitimate interest under article 6(1)(f) GDPR. We do not use it for advertising, profile visitors or make automated decisions about them. Clarity recognises Global Privacy Control, and this site's content security policy blocks its advertising-cookie sync endpoint.

If you would rather not be counted, you can:

• enable Global Privacy Control in your browser or an extension;
• use Microsoft's industry opt-out at optout.aboutads.info;
• block www.clarity.ms, which breaks nothing else on this site; or
• object to the processing, on grounds relating to your situation, by writing to privacy@qastel.ai.

Microsoft retains ordinary session recordings for 30 days. Recordings we mark as favourites or label, as well as heatmaps and click data, are retained for up to nine months. We can access only the reports and recordings for this site.

Our typeface is served from our own servers rather than a font CDN, so loading a page does not hand your IP address to a third party for that.

One other third-party request is worth naming. To show a vendor's logo next to the AI tools and integrations we describe, the home page and the integration pages load small icons from Google's public favicon service (google.com/s2/favicons, which redirects to gstatic.com). Your browser makes that request directly, so Google sees your IP address and the icon requested. We send no referrer and no identifier of you.

5. Who else sees your data

We do not sell personal data, we do not share it for advertising, and we do not use it to train AI models.

Recipient	What for	Where
Scaleway SAS	Hosting this site and our application	France (fr-par)
OVH SAS	Our business e-mail	France
Microsoft Ireland Operations Limited	Website analytics (Microsoft Clarity)	Ireland and the United States
Google LLC	Vendor icons (public favicon service)	United States

Beyond these, we disclose personal data only where the law requires it, or to our advisers under a duty of confidentiality.

6. Transfers outside the EU

Two services described in section 4 send data to the United States: Microsoft Clarity and Google's public favicon service. For visitors in the European Economic Area, Microsoft identifies Microsoft Ireland Operations Limited as the Clarity data controller. The Microsoft Privacy Statement and Google Privacy Policy state that the providers participate in the EU-U.S. Data Privacy Framework and use standard contractual clauses where required. Those are the safeguards they publish for transfers to the United States.

The data is limited by the way this site is configured. Clarity receives no cookie identifier and page text is masked before upload. Google's favicon request carries no referrer or identifier from us, although both providers receive the visitor's IP address when the browser connects.

Our first-party hosting and business e-mail remain in the EU. Scaleway and OVH are established in France, and the data they hold for us is stored and processed there.

The same holds for the product: no customer data leaves the EU either. See data residency.

7. Your rights

Under the GDPR and the French loi Informatique et Libertés you may ask us to:

• access the personal data we hold about you, and get a copy;
• correct it if it is wrong or incomplete;
• delete it, where one of the grounds in article 17 applies;
• restrict how we use it while a dispute about it is resolved;
• receive it in a portable form, for the data you gave us that we process by consent or under a contract;
• object to processing based on our legitimate interest, on grounds relating to your situation.

You may also leave instructions about what happens to your data after your death, under article 85 of the loi Informatique et Libertés.

To exercise any of these, write to privacy@qastel.ai. We answer within one month, and tell you if we need to extend that. We may ask for something that establishes your identity if we genuinely cannot place your request, never as a way of stalling it.

If you think we have handled your data badly, you are entitled to complain to the French data protection authority, the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr) or to the authority where you live or work.

8. Security

We describe how we protect data (encryption, access control, audit logging, our certification roadmap) on the trust page. If you find a weakness, tell us at security@qastel.ai; we will not pursue you for reporting it in good faith.

9. Changes to this policy

The date at the top of this page is the last time it changed. When a change materially affects you, we say so on the site rather than relying on you to re-read the page.