Legal
Privacy Policy
Last updated: March 16, 2026
This Privacy Policy explains how Personæ collects, uses, and protects your personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable French law.
1. Data Controller & Contact
The data controller for the Personæ platform is Hugo Cusanno, entrepreneur registered under CAPE C1497 (SIRET 423 194 307 00090, APE 9499Z), domiciled at PCE, 6 Rue d'Amboise, 75002 Paris, France. Contact: contact@personae.life. As data controller, we are responsible for deciding how and why your personal data is processed. This Privacy Policy applies to all personal data collected through the Personæ platform and website.
2. Data We Collect
We collect the following categories of data: (i) Account data — name, email address, company name, job title, and hashed password, provided at registration; (ii) Usage data — interactions with the platform, features used, session duration, and pages visited, collected automatically; (iii) User Content — data you upload to create personas, including interview transcripts, survey responses, CRM exports, and custom inputs; (iv) Communication data — messages exchanged with our support team; and (v) Technical data — IP address, browser type, device information, and cookies. We do not collect special categories of personal data (GDPR Article 9) and do not use your User Content to train AI models.
3. How We Use Your Data
We use your data to: (i) create and manage your account and provide the Service; (ii) process payments and manage your subscription; (iii) improve and develop the Service through anonymized analytics; (iv) send transactional communications (account confirmation, password reset, invoices); (v) send product updates and marketing communications, where you have opted in; (vi) respond to support requests and ensure security; and (vii) comply with our legal obligations. We do not sell your personal data to third parties.
4. Legal Bases for Processing
We process your personal data under the following legal bases (GDPR Article 6): (i) Performance of contract — to provide you with the Service you have subscribed to; (ii) Legitimate interests — to improve the Service, prevent fraud, and ensure platform security, where such interests are not overridden by your rights; (iii) Legal obligation — to comply with applicable tax, accounting, and regulatory requirements; and (iv) Consent — for optional communications such as marketing emails and non-essential cookies. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
5. Data Sharing & Sub-Processors
We do not sell or rent your personal data. We share data only with the following trusted sub-processors under appropriate data processing agreements: (i) AI model providers — we use OpenAI APIs to power AI features (interviews, memory creation, avatar generation). Queries may include User Content; OpenAI does not use API inputs to train its models by default; (ii) Infrastructure providers — hosting, database, and storage providers operating within the European Union; (iii) Payment processors — to process subscription payments securely; and (iv) Analytics providers — using anonymized or aggregated data only. All sub-processors are required to maintain appropriate technical and organizational security measures.
6. International Data Transfers
All Personæ infrastructure — servers and databases — is hosted within the European Union. We do not transfer your personal data outside the EEA except where strictly necessary for certain sub-processors (e.g., OpenAI, which processes data in the United States). Where such transfers occur, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission (GDPR Article 46) or equivalent transfer mechanisms.
7. Data Retention
We retain your personal data for as long as your account is active or as needed to provide the Service. Upon account deletion, we will delete or anonymize your personal data within 30 days, unless longer retention is required by applicable law (e.g., accounting records may be retained for up to 10 years under French law — Code de commerce, article L. 123-22). Anonymized, aggregated data may be retained indefinitely for statistical purposes.
8. Your Rights Under GDPR
As a data subject under the GDPR, you have the right to: (i) access — request a copy of the personal data we hold about you; (ii) rectification — correct inaccurate or incomplete data; (iii) erasure ("right to be forgotten") — request deletion of your data; (iv) restriction — limit how we process your data in certain circumstances; (v) portability — receive your data in a structured, machine-readable format (JSON or CSV); (vi) objection — object to processing based on legitimate interests; and (vii) withdraw consent at any time for consent-based processing. To exercise any of these rights, contact us at contact@personae.life. We will respond within 30 days. You also have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL) — www.cnil.fr.
9. Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include TLS encryption in transit, encryption at rest, access controls and authentication, regular security reviews, and staff awareness. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security. In the event of a personal data breach that is likely to result in a risk to your rights, we will notify you and the CNIL within 72 hours, as required by GDPR Article 33.
10. Cookies & Tracking
We use cookies and similar technologies to operate the Service, remember your preferences, and understand usage patterns. We use: (i) Essential cookies — required for the Service to function (session management, authentication, language preference). These cannot be disabled without affecting the Service; and (ii) Analytics cookies — used to understand aggregate usage and improve the platform. These are activated only with your explicit consent, in accordance with French law (CNIL guidelines). You can manage your preferences at any time via the cookie banner displayed on the platform.
11. Children's Privacy
The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected personal data from a person under 18 without verified parental consent, we will take prompt steps to delete that information. If you believe a minor has provided us with personal data, please notify us immediately at contact@personae.life.
12. Changes to This Policy & Contact
We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. When we make material changes, we will notify you by email or by prominent notice within the Service. The date of the most recent revision is shown at the top of this page. For any questions or concerns regarding this Privacy Policy, or to exercise your data rights, please contact: Hugo Cusanno — contact@personae.life — PCE, 6 Rue d'Amboise, 75002 Paris, France.