Privacy policy

Controller

The Artisana AI website is operated by SD TECH, a French single-shareholder simplified joint-stock company (SASU) with variable capital, registered with the Versailles Trade and Companies Register under number 981 288 285, whose registered office is at 2 rue Eugène Pottier, 78190 Trappes, France. For any question about your personal data or to exercise your rights: privacy@artisanaai.com.

Data processed

When you submit a request: the name of your organisation, the name and business e-mail address of the contact, the type of need, the catalogue item, the description, the indicative budget and timeline, and the form language; then the history of the request (statuses, internal comments, qualification). For security and abuse prevention: a cryptographic digest (HMAC) of your IP address, reduced to its /64 prefix for IPv6, used in counters; a digest of the request to detect duplicates; web server logs in which the IP address is truncated. The form does not ask for health data, identity documents or attachments; please do not include any in free-text fields.

Purposes and legal bases

Receiving and analysing your request, contacting you, preparing a possible proposal and following up the relationship: steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR) when you act on your own behalf, or SD TECH's legitimate interest in answering a business request (Article 6(1)(f)) when you act for an organisation. Service security and abuse prevention: legitimate interest (Article 6(1)(f)). Submitting the form triggers no marketing and no automatic message.

Recipients and providers

Only authorised SD TECH staff can access the data. Technical providers: Scaleway SAS (France), which hosts the application and the database on a server located in Amsterdam (Netherlands) and keeps the encrypted backups in Paris (France); OVHcloud, which provides the mailboxes contact@ and privacy@artisanaai.com. Healthchecks.io (SIA Monkey See Monkey Do, Latvia) monitors service availability and backup success: it only receives technical signals, without contact details or request content. Your request is not sent to any artificial intelligence service. SD TECH does not sell or transfer your data.

Retention periods

Open request: 36 months from submission, restarting at each status change. Request closed without follow-up: 12 months after closure. When the period ends, the organisation, contact details, description, comments and qualification are erased automatically; only statuses, dates and a non-identifying reference remain. Abuse counters: 48 hours. Web server technical logs: 30 days; access logs only keep a truncated IP address, error logs may contain the full address. Audit logs, which contain no contact details and no free text: target period of 12 months, records proving that an erasure or an opposition was handled may be kept longer while they remain necessary.

Backups

Daily backups are encrypted before leaving the server. They are kept for 7 days on the server and for about 71 days off the server: each copy is protected against deletion for at least 35 days, then deleted automatically. Data erased at your request may therefore remain in these encrypted copies until they expire; if a backup is restored, the erasures already carried out are applied again.

Security

Restricted, named access to the applications and the database, operator authentication and logging of operations, isolation of services and networks, least-privilege database accounts, HTTPS encryption of public exchanges, encrypted backups kept in another region, restore drills. These measures are reassessed according to the risks.

Your rights

Under the conditions set by the GDPR, you may request access to your data, its rectification or erasure, the restriction of processing and portability, and you may object to processing based on legitimate interest. Write to privacy@artisanaai.com; we answer within one month, which may be extended in the cases provided by law, and a proportionate identity check may be requested. If you object to any marketing by SD TECH, a cryptographic digest of your address may be recorded in an opposition register, checked before any contact; it is kept for as long as your opposition must be respected, then deleted. You may lodge a complaint with the CNIL (www.cnil.fr).

Cookies and trackers

The public portal sets no cookies or trackers: no audience measurement, no advertising, no social networks. Any change will be announced on this page and, where the law requires it, subject to your prior consent.

Location and transfers

The application, the database and the backups are hosted in the European Union (Netherlands and France). No data from your requests is sent to the monitoring service. As the hosting location of that service is not published, we entrust it with no personal data.

Changes

This policy may change with the service, the processing or the law. Version of 16 October 2026.