Privacy Policy

The data controller is Bassirou THIAM (sole proprietorship registered in France), SIREN 993 344 282. Contact: [email protected].

• Account: email address, name, password (stored encrypted).
• Organization and team: names, roles, invitations.
• Content: the projects, equipment, libraries and points lists you create.
• Billing: subscription and payment data handled by Stripe (the publisher does not store your card details).
• Technical data: connection and security logs (IP address, timestamps).
• Audience and usage measurement: page views, journeys and technical errors, measured by PostHog (hosted in the EU), and recordings of browsing sessions with input fields masked.

• Providing and securing the service (performance of the contract).
• Managing subscriptions and billing (performance of the contract, legal accounting obligations).
• Providing support and communicating about the service (legitimate interest).
• Measuring audience and improving the service, without cookies or profiles for anonymous visitors (legitimate interest).
• Complying with legal obligations and preventing abuse (legal obligation, legitimate interest).

Your data is accessible to the publisher and its technical processors, strictly for the purposes above:

• Supabase / AWS: Database and file storage hosting (EU).
• Hostinger International Ltd.: Application server hosting (VPS).
• Cloudflare, Inc.: Content delivery, security and DDoS protection.
• Stripe Payments Europe, Ltd.: Subscription payments and invoicing.
• Anthropic, PBC: AI document analysis and assisted writing (United States).
• Resend, Inc.: Service emails: account, billing, announcements (United States).
• Brevo (Sendinblue SAS): Information and outreach emails (EU).
• PostHog, Inc.: Audience measurement and usage analytics, hosted in the EU.
• Cal.com, Inc.: Online meeting scheduling, hosted in the EU.

Application data is hosted in the European Union (Frankfurt, Germany). Some processors may process data outside the EU: the payment provider (Stripe), the AI provider (Anthropic) and the email service (Resend), in the United States. These transfers are covered by the European Commission's standard contractual clauses.

Account and content data is kept while your account is active, then deleted after it is closed (subject to temporary technical backups). Billing records are kept as required by law (up to 10 years).

You have the rights of access, rectification, erasure, restriction, objection and portability. You can exercise them at any time by writing to [email protected], or delete your account from your settings. You may also lodge a complaint with the French data protection authority (CNIL, www.cnil.fr) or the authority of your country.

Structio only uses cookies that are strictly necessary for the service: keeping you signed in and securing payments (Stripe). They do not require prior consent. No advertising cookies or third-party trackers are set. Audience measurement (PostHog) works without cookies or browser storage, so it does not require consent either.

Data access is isolated per organization (database-level security policies), passwords are encrypted and all traffic is encrypted in transit (HTTPS).