Privacy policy
Last updated 13 October 2026
This privacy policy describes how Pythie (“we”, “us”) collects, uses, stores, and protects personal data when you visit pythie.eu, join the waitlist, or use the Pythie application. We process data in accordance with Regulation (EU) 2016/679 (GDPR), the French Data Protection Act, and ePrivacy rules where relevant.
GDPR compliance & your rights
Pythie acts as data controller for personal data described in this policy (waitlist, accounts, support, and service logs tied to identifiable users).
You have the following rights, subject to conditions in the GDPR:
- • Access — obtain confirmation and a copy of your data
- • Rectification — correct inaccurate data
- • Erasure — request deletion in certain cases (“right to be forgotten”)
- • Restriction — limit processing in certain cases
- • Portability — receive data you provided in a structured, machine-readable format
- • Objection — object to processing based on legitimate interest
- • Withdraw consent — where processing is based on consent
To exercise your rights, email ghom@pythie.eu. We respond within one month, extendable where permitted. You may also lodge a complaint with the CNIL (France) or your local EU supervisory authority.
Categories of data we process
Depending on how you interact with Pythie, we may process:
Waitlist & contact
- • Email address
- • Timestamp of registration and technical metadata (IP address, user agent) for fraud prevention
Account & service use (when you have access)
- • Account identifiers and authentication data
- • Questions you submit and configuration (alerts, exports)
- • Derived artefacts: numeric results, charts, links to source pages, capture timestamps
- • Usage metrics (feature usage, error reports) in aggregated or identifiable form where needed for support
Technical & security
- • Server and application logs (IP, request paths, timestamps, device/browser type)
- • Abuse-prevention signals
We do not sell personal data. We do not knowingly collect special categories of data (health, biometrics, etc.) through the service.
Purposes and legal bases
We process personal data only for specified purposes:
- Beta access & contract (Art. 6(1)(b) GDPR): managing waitlist, creating accounts, providing the service you request
- Legitimate interest (Art. 6(1)(f)): securing the platform, debugging, preventing abuse, improving reliability — balanced against your rights
- Legal obligation (Art. 6(1)(c)): retaining certain records where law requires
- Consent (Art. 6(1)(a)): optional communications where consent is required; you may withdraw at any time
Marketing emails are not sent without a clear legal basis; waitlist messages relate to product access unless you opt in to broader updates.
Retention periods
- Waitlist: until you unsubscribe, object, or 24 months without engagement, then deletion or anonymisation
- Account & conversations: until you delete content, close your account, or 24 months after last activity unless law requires longer retention
- Billing records (if applicable): duration required by French commercial and tax law (typically up to 10 years for invoices)
- Security logs: up to 12 months, unless needed for an ongoing investigation
- Support tickets: up to 24 months after resolution
When data is no longer needed, we delete or irreversibly anonymise it.
Recipients & subprocessors
Access to personal data is limited to authorised personnel and service providers who need it to operate Pythie, under confidentiality and data-processing agreements.
Categories of recipients may include:
- • Cloud hosting and CDN providers (e.g. Vercel)
- • Database hosting (when DATABASE_URL is configured)
- • Email delivery providers (transactional messages)
- • AI inference providers (question processing — we minimise personal data in prompts and do not use your questions to train third-party models where contractually prohibited)
A list of subprocessors can be provided on request at ghom@pythie.eu.
International transfers
Some providers may process data in the United States or other countries outside the European Economic Area. Where required, we rely on:
- • European Commission adequacy decisions, or
- • Standard Contractual Clauses (SCCs) and supplementary measures
You may request a copy of relevant safeguards by contacting us.
Public web data & automated processing
To answer your questions, Pythie fetches and analyses public web pages. That processing concerns page content, not our users’ special categories of data.
We design pipelines to avoid collecting personal data from the open web (e.g. names, emails on listings). If you believe we inadvertently hold personal data about you in a capture, contact us and we will delete it promptly.
Automated decision-making does not produce legal or similarly significant effects solely by algorithm without human review; outputs are informational tools for your judgment.
Security
We implement technical and organisational measures appropriate to the risk: encryption in transit (HTTPS), access controls, least-privilege access for operators, and monitoring for abuse.
No method of transmission over the Internet is 100% secure. We cannot guarantee absolute security but we work to improve it continuously and notify users and authorities of breaches when required by law.
Children
Pythie is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided personal data, contact us for deletion.
Changes to this policy
We may update this policy to reflect product, legal, or regulatory changes. The “Last updated” date will change; material changes will be highlighted on the site or by email where appropriate.
Continued use after an update constitutes acceptance where permitted by law; for consent-based processing, we will seek consent again if required.
Contact & DPO
For privacy questions, rights requests, or subprocessors information:
ghom@pythie.eu
We have not appointed a separate Data Protection Officer; the publisher handles privacy requests directly at this stage of the beta.
Contact: ghom@pythie.eu