Privacy policy

Data controller

Ulysse Trin, Colombani.ai (sole proprietor, EI)
SIREN: 101 463 545
Email: ulysse@colombani.ai

Data collected

The data you voluntarily provide through the contact form is collected:

• First and last name
• Email address
• Company name
• Message content

Audience and conversion measurement

The website measures only aggregated events, needed to improve it. On the visitor side: page views, contact clicks, booking clicks, email clicks, opening or using the assistant, form started, abandoned or submitted. On the content side: clicks on an offer, a training, a sector or an article, FAQ questions expanded, pages not found, scroll depth. On the layout side: click positions, as a percentage of the page and with the screen size, to draw an aggregated map of clicked areas. For each event we record its type, the page path, the language, a general source category and its target. No name, email, message content, advertising identifier, cookie or fingerprint is collected for this purpose. To understand how pages follow one another during a visit, each event also carries a randomly generated visit identifier and the position of the page within that visit. This identifier belongs to the browser tab open on colombani.ai, is kept in the browser’s session storage and is erased when the tab is closed; it is linked neither to your IP address nor to any form or email, and cannot be used to follow you on other websites. It serves only to produce anonymous, aggregated statistics (entry pages, page sequences, exit pages), solely on Colombani.ai’s behalf, which does not combine them with any other processing and does not pass them on to any third party. If your browser sends the “Do Not Track” signal, no visit identifier is created.

A general source category may be passed between pages in website links, without an individual identifier or browser storage. Booking links pass this category and the referring page path to Cal.com, without the other parameters in your URL. Cal.com stores this information in the booking details. Clicking a booking link does not mean an appointment has been confirmed.

Each event also carries the country and the network type (hosting provider or consumer connection), derived from the connection by Cloudflare in order to exclude bots from measurement; the IP address is not stored. These events, including the visit identifier, are retained for three months in Cloudflare Workers Analytics Engine, with Cloudflare acting as processor. The website also uses Cloudflare Web Analytics to count page views, traffic sources, countries, device types and loading speed. This measurement works without cookies, fingerprinting or individual identifiers. It does not track visitors across websites. It is exempt from consent under the CNIL guidelines on audience measurement. Finally, to prevent automated form and message submissions, your IP address is counted for at most ten minutes, then erased. It is linked to no other data and serves only that purpose, and to exclude from measurement, by simple comparison and without storage, visits coming from Colombani.ai’s own networks. You can opt out of event measurement by opening any page of the site followed by ?mesure=non, for example colombani.ai/?mesure=non. This choice is stored in your browser, it also disables the visit identifier, and ?mesure=oui cancels it.

Website chat assistant

The website offers a chat assistant. Messages you enter are sent to NVIDIA Corporation (United States), which hosts the language model used to generate responses. Do not enter personal data or confidential information. Colombani.ai keeps the questions asked and the answers given for 90 days. This log holds no IP address, cookie or identifier. Any email address, phone number, company registration number or IBAN they may contain is masked automatically before storage. It is used only to improve the assistant’s answers and the website content, and is never linked to an identity.

AI maturity assessment

The assessment can be completed without any personal data: unless you request the report, only its start, its completion and the level obtained are counted, in aggregate. If you request the report, your email address, your first name and your organisation (if given) and your answers are used to produce the PDF report and send it to you, then, once, to write to you about your result. They are stored in Brevo, and Colombani.ai receives a copy of your answers by email. The report is laid out by Cloudflare’s rendering service, which does not keep it. Other communications (analyses, invitations) are only sent if you tick the box provided, and each includes an unsubscribe link. This data is kept for three years at most after the last exchange.

Downloadable documents

Some guides offer a complementary working document, sent by email. If you request it, your email address is used to send it to you and then, once, to write to you about it. It is stored in Brevo with the document name, language, requesting page and date, and Colombani.ai is notified by email. No other communication is sent to you without your consent, and you can ask for this data to be erased at any time. It is kept for at most three years after the last exchange.

Advertising campaign measurement

When Colombani.ai runs Google Ads, a visitor arriving from an ad is asked for consent. If they accept, Google’s tag loads and sends Google the ad click identifier when a request is completed (call, message, document, assessment report), in order to measure the ad’s effectiveness. No ad personalisation is enabled. Legal basis: your consent, which you can withdraw at any time through the “Cookie settings” link in the footer. Without consent, nothing is loaded or stored; only an anonymous count of arrivals from ads is kept in the site’s audience measurement. Your choice is kept for thirteen months if you accept and six months if you decline.

Recipients and sub-processors

Your data is neither sold nor transferred. It is processed by the following providers, solely for the purposes described above:

• Cloudflare, Inc. (United States) : website hosting, delivery, cookieless audience measurement and aggregated conversion measurement
• Twilio SendGrid (United States) : contact form message delivery
• Brevo (Sendinblue SAS, France) : delivery of the assessment report and of downloadable documents, and management of the contacts who requested them
• Microsoft 365 (European Union and United States) : business email
• NVIDIA Corporation (United States) : language model powering the website assistant
• Google Ireland Limited (Ireland) : Google Ads campaign measurement, only with your consent
• Cal.com, Inc. (United States) : appointment booking. On the Contact page, the next available slots are requested from Cal.com by our server, without any data about you, and no third-party service is loaded: Cal.com opens only when you click, on its own website. Elsewhere, the embedded calendar loads only when you ask for it; it then sets a security cookie (Cloudflare) and a booking identifier, and sends its error reports to Sentry (United States)

These transfers outside the European Union are governed by the European Commission’s standard contractual clauses. Data from engagements entrusted to Colombani.ai does not pass through any of these services.

Purpose

This data is used exclusively to respond to your contact request and, where applicable, for the performance of a service contract.

Legal basis

Contact requests and assessment report requests are processed on the basis of your consent (Article 6(1)(a) GDPR) and pre-contractual measures (Article 6(1)(b)). The single follow-up message about your result relies on Colombani.ai’s legitimate interest (Article 6(1)(f)), to which you may object at any time. Other communications are sent on the basis of your consent, given through a separate box and withdrawable at any time. Aggregated conversion measurement relies on the legitimate interest in evaluating and improving the website (Article 6(1)(f)), without profiling or cross-site tracking.

Retention period

Your contact data is retained for 3 years from the last exchange. Contractual data is retained in accordance with French legal obligations (10 years for accounting documents).

Your rights

Under the GDPR, you have the following rights:

• Right of access to your data
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to object
• Right to withdraw your consent at any time, without affecting processing already carried out

To exercise these rights, write to ulysse@colombani.ai. You may also file a complaint with the CNIL.

Cookies

The website places no cookies without your consent, apart from those strictly necessary for it to work: its audience measurement is cookieless. Two third-party services may place cookies, and only at your request: the Google Ads tag, loaded only if a visitor arriving from an ad accepts it, and the Cal.com calendar, loaded only when you open it. The “Cookie settings” link in the footer lets you change your choice at any time.

Data hosting

This website is hosted by Cloudflare, Inc. (United States). Cloudflare contractually commits to GDPR compliance and applies standard contractual clauses for international data transfers.