How CyberLouis processes personal data related to its website and service.
Last updated: Version 1.2 — October 15, 2026
The data controller is GROUPE ALRIC, a French simplified single-shareholder company (SASU) with share capital of EUR 311,000, registered with the Paris Trade and Companies Register under number 751 736 166, whose registered office is at 17 place Richard Baret, 75017 Paris, France.
For privacy questions or to exercise your rights, contact contact@groupealric.com. This address is GROUPE ALRIC’s privacy contact point.
We process professional contact details, organisation data, account and authentication data, connection and security data, preferences, support content, billing data, and service-use data such as training progress, answers and authorised simulation results. Depending on the features used, we may also process email addresses submitted to an HIBP exposure check, content and instructions sent to support or AI-generation features, and information relating to mailboxes authorised by the customer organisation.
Responding to requests, creating and administering accounts and organisations, providing the service, support and billing rely on pre-contractual measures or contract performance. Security, abuse prevention, checks required for authorised simulations and service improvement rely on our legitimate interests. Keeping accounting records and meeting legal obligations rely on applicable legal obligations. Optional marketing relies on consent, which may be withdrawn at any time.
Fields required to create an account or complete a subscription are mandatory; if they are not provided, we cannot process the relevant request.
Authorised GROUPE ALRIC staff and service providers may process data as needed: Supabase (authentication and database), Stripe (payments), Resend (email), Vercel (hosting and usage measurement where enabled), OpenReplay through the instance configured by GROUPE ALRIC (private interaction replay after consent), Cloudflare Turnstile (anti-abuse protection), Upstash (abuse rate limiting), Sentry when enabled for error monitoring, OpenRouter for AI features, and Have I Been Pwned for email exposure checks. The customer organisation’s email providers, including Google Workspace or Microsoft where the customer enables an authorised connection, may also be involved in that connection.
Some providers may process data outside the European Economic Area. Such transfers are safeguarded by the mechanisms required by applicable law, including standard contractual clauses where necessary.
Account and service data are retained during the contractual relationship and then archived for applicable limitation periods; invoices and billing records for ten years; commercial requests for up to three years after the last contact. Security and connection logs are retained for a period proportionate to their purpose and legal obligations.
Data is then deleted or anonymised unless retention is legally required or necessary to defend legal claims.
You may request access, rectification, erasure, restriction, objection, portability where applicable, or withdrawal of consent by writing to contact@groupealric.com. We answer within the statutory time limit. You may also lodge a complaint with the French data-protection authority (CNIL).
Where a customer invites employees or carries out an authorised simulation, that customer remains responsible for its own processing and GROUPE ALRIC acts on its documented instructions to provide the service.
