Legal
Privacy policy
What we collect, why, for how long, and how to exercise your rights. Written in plain language.
Last updated: 20 October 2026
1. Who is responsible for your data?
The data controller is: ThΓ©o Coutard, individual (experimental project, no commercial activity to date), not registered, 4 rue des pinsons, 44115 Haute-Goulaine, France β theo@correlationindex.xyz.
No Data Protection Officer (DPO) has been appointed at this stage. For any question or request, write to the address above.
2. What data, why, and on what legal basis
The live correlation test collects no personal data: it puts fictional scenarios to AI models.
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Email address, password (stored hashed, never readable), declared sector, date and version of the terms accepted | Create and manage your account | Performance of a contract (Art. 6.1.b) | While the account exists, then 24 months after the last sign-in |
| The set of institutions you follow | Provide the "my perimeter" feature | Performance of a contract (Art. 6.1.b) | While the account exists |
| Usage events (opening the dashboard, adding to the perimeter, export, test run). No content you type is recorded. | Understand how the product is used and improve it | Legitimate interest (Art. 6.1.f). You can object in the dashboard's privacy settings. | 13 months |
| Anonymous visit statistics: page views, country, device type, referrer (Vercel Web Analytics, cookie-free) | Measure site audience | Legitimate interest (Art. 6.1.f) | Aggregated, per Vercel |
| Messages you write to the site assistant | Answer your question | Legitimate interest (Art. 6.1.f) | Not stored by us; sent to Anthropic to produce the answer (see Β§4) |
| IP address and technical logs | Security and abuse prevention | Legitimate interest (Art. 6.1.f) | Short period set by the host |
| Your emails, or a booked appointment (Cal.com) | Reply to you | Pre-contractual steps / legitimate interest | For the duration of the exchange, then at most 3 years |
3. What we do not do
- We do not sell your data or run targeted advertising.
- We take no automated decision that has legal effects on you.
- We do not read the content of your conversations with your AI assistants.
- We use no advertising cookies or cross-site trackers (see the cookie policy).
4. Who receives your data (processors)
Service administrators can access account data and usage statistics, solely to operate and improve the service.
| Provider | Role | Location |
|---|---|---|
| Supabase | Database and account authentication | Ireland (AWS eu-west-1, European Union) |
| Vercel Inc. | Site hosting, cookie-free audience measurement | Functions run in Paris; company based in the United States |
| Anthropic PBC | Generates the site assistant's answers from the message you send | United States |
| Cal.com | Appointment booking, only if you use it | [to verify] |
| GitHub | Source-code hosting (no user data) | United States |
5. Transfers outside the European Union
Some providers are based in the United States. These transfers rely on the safeguards provided for by the GDPR (adequacy decision / EUβUS Data Privacy Framework, or standard contractual clauses) [to verify provider by provider in their data processing agreements].
6. Your rights
To exercise these rights, or to ask for your account to be deleted, write to theo@correlationindex.xyz. We reply within one month at most. We may ask you to prove your identity.
If you believe your rights are not respected, you may lodge a complaint with your data protection authority (in France, the CNIL: www.cnil.fr).
- Access, rectification, erasure, restriction and portability of your data.
- Objection to processing based on legitimate interest β in particular to usage events, which you can switch off at any time in the dashboard (privacy settings).
- Withdrawal of consent where processing relies on it.
- Setting directives about your data after your death (France).
7. Security
Encrypted connections (HTTPS), passwords stored hashed by the authentication service, row-level access rules in the database (each account sees only its own data), and restricted administrator access. No measure offers an absolute guarantee; in case of a data breach likely to harm you, we will inform you and notify the authority within the legal deadlines.
8. Minors
The service is aimed at professionals. It is not intended for people under 16.
9. AI-assistant connectors (upcoming)
We plan to offer a connector that lets you query The Correlation Index from your AI assistant. If you use it, we will receive only what your assistant sends to our tools (for example the filters requested: country, lab, institution type), never the rest of the conversation.
Any further collection (for example data contributions from you) will be optional, subject to your explicit consent, and described in this policy before it goes live.
10. Changes
This policy may change. The current version is dated 20 October 2026 (version 2026-10-20). We will tell you about material changes.