Privacy policy
Last updated : 12 July 2026.
1. Data controller
The controller of the personal data collected on inclaria.com is Johann Flipo, sole trader (entrepreneur individuel, EI), 6 rue d'Armaillé, 75017 Paris, France. Contact for any question regarding data: privacy@inclaria.com.
2. Minimization principle
We only collect the data strictly necessary for the operation of the service. We do not sell or rent your data to third parties.
3. Data collected, purposes and legal bases
- Account data (email, credentials). Purpose: account creation and management, access to the service. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
- Billing data, processed by Paddle (Merchant of Record), a separate controller for payment. Legal basis: legal obligation and performance of the contract.
- URLs and technical data of the analyzed sites at your request. Purpose: provision of the accessibility audit service. Legal basis: performance of the contract.
- Communication data (support, contact form). Purpose: response to your requests. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
- Free scan leads and waiting list (email, URL of the submitted site). Purpose: sending the requested report and informing you at the launch of the service. Legal basis: pre-contractual measures taken at your request (Art. 6(1)(b) GDPR).
- Anonymous audience measurement. Purpose: traffic statistics. Legal basis: consent exemption (audience measurement compliant with the conditions of the CNIL).
4. Recipients and processors
Your data may be processed by our processors, bound by a data processing agreement (DPA) compliant with Article 28 of the GDPR: Paddle.com Market Ltd (payment and invoicing); Neon (database hosting, European Union, Frankfurt); Resend (transactional email delivery, United States, standard contractual clauses), with Brevo (European Union) as a possible fallback; Cloudflare (site hosting and delivery); PostHog Cloud EU (product usage analytics, data hosted in the European Union); Sentry (Functional Software, Inc., technical error tracking, data ingestion in the European Union, standard contractual clauses). Where a processor processes data outside the European Union, these transfers are governed by appropriate safeguards (standard contractual clauses of the European Commission or adequacy decision).
5. Retention period
- Account data: for the duration of the subscription, then 3 years.
- Billing data: 10 years (accounting obligation).
- Support data: 3 years after the last contact.
- Free scan leads and waiting list: 3 years after collection.
- Audience measurement: aggregated, anonymous statistics, no cookie or tracker, via PostHog Cloud EU (server-side page views), Cloudflare Web Analytics and an in-house counter (a data-free request sent by your browser that only increments a daily total).
6. Business (B2B) prospecting
We may collect professional contact data (name, role, business email address, website) from publicly available sources, in order to present Inclaria to organisations concerned by digital accessibility obligations. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). In accordance with Article 14 of the GDPR, the persons concerned are informed at the latest at the time of the first communication. This data is kept for a maximum of 3 years. You may object to this prospecting at any time, via the unsubscribe link in each message or by writing to privacy@inclaria.com.
7. Hosting
The data is hosted within the European Union.
8. Your rights
In accordance with the GDPR, you have the rights of access, rectification, erasure, restriction, portability and objection, as well as the right to define post-mortem directives. You can exercise them by writing to us at privacy@inclaria.com. Where processing is based on your consent, you can withdraw it at any time.
9. Complaint
You can lodge a complaint with the French data protection authority (CNIL): www.cnil.fr · 3 Place de Fontenoy, TSA 80715, 75334 Paris CEDEX 07.
10. Cookies
The site uses only strictly necessary cookies and an audience measurement tool exempt from consent (anonymous data, no cross-site tracking). No advertising tracker is placed.
Cookies set: « is » (sign-in session token, httpOnly, 30 days), « il » (a simple « signed in » hint for the interface, 30 days) and « il_noview » (set on the admin area to exclude the publisher's own visits from statistics, 12 months).