Data protection notice
Plainly: this is everything that reaches me when you use this site, what I do with it after, and the control you keep over it. It is one person at this desk. No mailing list, no sales team, no shared office inbox passing your details from hand to hand.
Who answers for it
This site is run by Noé Valbrume, who works on quartier-level AI visibility for independent Paris businesses. Under the General Data Protection Regulation (GDPR) and laws of the same shape, the person accountable for the data described below is the operator of aiseoparis.com. With a privacy question, or to act on a right of yours, write to hello@aiseoparis.com.
What actually reaches me
Submit the form and only this arrives:
- Your name and email, so I can write back and address you the right way.
- A second way to reach you, if you choose to add one (Telegram, Signal, WhatsApp, phone), for when email is not how you prefer to talk.
- Whatever you tell me about the request: the business, the arrondissement, the quartier wording, the page to look at. Name and email are the only required fields; the rest is entirely yours to give or to keep.
These details serve a single job: answering the request you sent. Nothing is added to a list, nothing is passed to anyone else, and nothing is mined beyond the exchange between us. Filed next to your message is the time it arrived and a salted SHA-256 hash of your IP address, which is the quiet mechanism that keeps automated abuse off the form. The raw IP is never recorded, and neither are browser fingerprints or device traits.
What I leave alone
- No tracking cookies. The audience measurement I rely on is cookie-free and holds no per-visitor identifier.
- No retargeting pixels, no marketing-automation tags, and no ad-network trackers anywhere on the pages.
- No automated profiling, and no automated decision that would carry a legal effect for you.
- No selling and no sharing of personal data with commercial partners. That is simply not how this practice keeps its lights on.
The legal ground for each thing
Form messages rest on GDPR art. 6(1)(b) — steps taken at your request before any possible engagement. The IP hash that guards the form against abuse rests on GDPR art. 6(1)(f), the legitimate interest of keeping the form usable. Where any payment-outcome data exists, it is handled on the contractual basis.
How long it stays
- Form messages: held through the engagement and for 24 months after it ends, so the record of the work stays intact, then deleted. Requests that never turn into work are held for 12 months, then deleted.
- Payment records: held for as long as tax and accounting rules require (commonly 5–6 years), then deleted.
- IP hashes: held for 90 days — long enough to protect the form — then deleted.
- Email threads: held while we work together, or for 24 months after our last contact, whichever runs longer.
What you can ask for
Under GDPR and comparable laws you may ask to see your data, correct it, erase it, move it elsewhere, restrict its use, or object to its use. For any of these, write to hello@aiseoparis.com and I will respond inside 30 days. If you think the law has been broken, you can complain to your data-protection authority (in France, the CNIL).
Where the data sits
The servers behind this site sit in European Union (Germany). If any further processors (email provider) happen to operate outside the European Union, those transfers run on standard contractual clauses together with the safeguards each one publishes.
If this notice changes
I revise this notice whenever the way I handle data shifts in a way that matters. The "Updated" date at the top marks the current version. When a change is significant, I post a note on the home page for 30 days so returning readers catch it.