Privacy Policy
Draft document, to be reviewed by a lawyer before publication.
Effective date: [EFFECTIVE DATE]
Loupsio is a tool that analyses visitor behaviour for online shops. This policy explains which personal data we process, why, for how long, and how to exercise your rights.
It is intended for:
- Loupsio users: people who have an account on behalf of a merchant, or who are invited to one;
- visitors to the Loupsio website;
- visitors to shops that use Loupsio, to explain who is responsible for their data (section 11).
1. Who we are
Loupsio is published by [PUBLISHING COMPANY], [LEGAL FORM AND SHARE CAPITAL], with its registered office at [ADDRESS], registered under number [RCS/SIREN] ("Loupsio", "we").
For any question about your data: [PRIVACY EMAIL].
Data protection officer: [DPO CONTACT DETAILS OR "not appointed"].
2. Two different roles
| Data | Loupsio's role | Where to find the information |
|---|---|---|
| User accounts, billing, Loupsio website | Controller: we decide why and how this data is processed | This policy |
| Data of shop visitors (browsing, replays, survey answers, etc.) | Processor: we process it on behalf of the merchant, who is responsible for it | The shop's privacy policy, and our data processing agreement with the merchant |
3. Users' data
| Category | Data |
|---|---|
| Account | Name, email address, password. The password is stored hashed with the scrypt algorithm: we do not know it. |
| Sign-in | Session cookie (see section 9) |
| Teams | Sites you have access to, your role (owner or member), invitations sent and received (email address of the invited person) |
| Email recipients | Email addresses chosen by an owner to receive the weekly report and alerts |
| Assistant | Questions you ask the assistant |
| Connected tools | Credentials you enter to connect a tool to a site (for example the email address and API token of your Jira account, or a Klaviyo key), and tickets created from a friction (author, date). Tokens and keys are kept encrypted and never shown again; the Jira account's email address is kept with the tool's settings. |
| Technical logs | Information recorded by our servers to run and secure the service [TO BE SPECIFIED: exact content of the logs] |
| Billing | Information needed for billing (company, billing address, VAT number, invoices, payment status). Payments go through Stripe: we do not store card numbers. |
| Correspondence | Messages you send us (support, questions) |
This data comes from you, or from a member of your team who invites you or adds you as a report recipient.
4. Why we process it
| Purpose | Legal basis |
|---|---|
| Creating and managing your account, giving you access to the service, managing teams and invitations | Performance of the contract with the merchant (Article 6(1)(b) GDPR) and, for invited people or report recipients, our legitimate interest in providing the service requested by the merchant (Article 6(1)(f)) |
| Sending you service emails: weekly report, alerts, invitations, password reset | Performance of the contract; legitimate interest for recipients who do not have an account |
| Answering your questions in the assistant | Performance of the contract |
| Connecting the tools you choose (tickets, sending frictions, data warehouse) | Performance of the contract |
| Billing and accounting | Legal obligation (Article 6(1)(c)) and performance of the contract |
| Securing the service, preventing abuse, fixing errors | Legitimate interest (Article 6(1)(f)) |
| Replying to your messages | Legitimate interest, or performance of the contract if they concern the service |
We do not sell your data. We do not use it for advertising. If we start a newsletter, we will ask for your consent, and every email will include an unsubscribe link.
5. How long we keep it
| Data | Retention period |
|---|---|
| Account and teams | As long as the account exists. Deleted when the account is deleted, which you can do from the application. |
| Session cookie | 30 days at most, or until you sign out |
| Invitations | An invitation expires after 14 days. [TO BE COMPLETED: when accepted or expired invitations are deleted.] |
| Questions to the assistant | The time needed to produce the answer. They are not stored in our database. |
| Credentials of connected tools | Until an owner disconnects the tool, or until the site is deleted |
| Technical logs | [PERIOD TO BE DEFINED] |
| Invoices and accounting records | 10 years (Article L123-22 of the French Commercial Code) |
| Correspondence with us | [PERIOD TO BE DEFINED, for example 3 years after the last exchange] |
Database backups are kept for 30 days at most, then deleted. Deleted data may therefore remain in a backup for up to 30 days.
Note for legal review. Set the retention period for technical logs (the CNIL generally recommends 6 months to 1 year for security logs) and for correspondence with users.
6. Who has access to it
- The people at Loupsio who need it for their work, bound by confidentiality.
- The members of the teams you belong to: they see your name, email address and role.
- Our service providers, within the limits of their tasks:
| Provider | Role | Location |
|---|---|---|
| Scaleway SAS | Hosting of servers and storage, sending of transactional emails | Netherlands (Amsterdam region) for the server; France (Paris region) for storage and emails |
| Stripe Payments Europe Ltd | Payment and billing | Ireland [TO BE CHECKED: any transfers outside the EU and safeguards] |
| Anthropic PBC | Claude options, each disabled by default and enabled separately for a site by an owner: "answers written by Claude" in the assistant (receives your question and totals calculated from sessions); "Visit summaries by Claude" and "Comment themes by Claude" (receives data of shop visitors, processed on behalf of the merchant: see section 11 and the data processing agreement). | United States |
- Authorities, if the law requires us to share it.
Avoid writing personal data in the questions you ask the assistant: if the option is enabled, they are sent to Anthropic.
The tools that a merchant connects to Loupsio itself, with its own credentials (Google Analytics 4, Segment, Klaviyo, Jira, Linear, Trello, data warehouse), are not our service providers. They receive visitor data on the merchant's instruction (section 11).
Note for legal review. Check Stripe's exact role (processor for Loupsio, or separate controller for some purposes such as fraud prevention) and adapt the table.
7. Transfers outside the European Union
Our server and its database are in the Netherlands (Amsterdam region); our storage, backups and email sending are in France (Paris region). Both are in the European Union, at Scaleway SAS: hosting involves no transfer outside the Union.
The only transfers outside the European Union planned by Loupsio are to Anthropic PBC (United States), for the Claude options that an owner enables for a site: "answers written by Claude" in the assistant, "Visit summaries by Claude" and "Comment themes by Claude". These transfers are covered by the European Commission's adequacy decision on the EU–US Data Privacy Framework if Anthropic is certified under it, or failing that by the European Commission's standard contractual clauses. You can obtain a copy of these safeguards by writing to us.
The tools that a merchant connects to its site itself (section 11) may be located outside the European Union. Data is sent to them on the merchant's instruction, and the merchant is responsible for it.
Note for legal review. Check Anthropic's certification under the Data Privacy Framework and the contractual safeguards in force at the date of publication. The "Visit summaries by Claude" and "Comment themes by Claude" options send visitor data that is not aggregated (the timeline of a visit, free-text comments): also check how long Anthropic keeps this data and its commitments not to reuse it. Complete this section if Stripe transfers data outside the EU.
8. Security
We protect data with measures including:
- HTTPS encryption of exchanges;
- passwords hashed with scrypt;
- tokens (sessions, invitations, share links, API keys) stored as hashes;
- an
HttpOnlysession cookie and protection against cross-site requests; - rate limits;
- data separated by site and role-based access control;
- encryption (AES-256-GCM) of the tokens and keys of the tools connected by merchants, and of the access token of Shopify shops;
- verification of the signature of messages received from Shopify;
- daily backups;
- a check of each component of the service every minute, with the results published on a public status page (
/status) that contains no personal data.
9. Cookies and storage
On the Loupsio application
| Name | Type | Purpose | Duration |
|---|---|---|---|
loupsio_session | HttpOnly cookie | Keeping you signed in | 30 days at most, cleared when you sign out |
loupsio:site | localStorage | Remembering the last site you opened | Until you clear it |
These are necessary for the service you request. They do not require your consent.
On the Loupsio website
[TO BE COMPLETED: list of cookies and trackers on the Loupsio website. If it uses a non-exempt audience measurement tool (or Loupsio itself), a consent banner is required.]
On merchants' shops
The Loupsio script does not set any cookie on shops. It uses the browser's storage (sessionStorage, localStorage) and, if the merchant has connected Google Analytics 4, Segment or Klaviyo, it reads the identifier that these tools have already stored in the browser. See section 11.
10. Visitors to the Loupsio website
[TO BE COMPLETED: data processed when you visit the Loupsio website (for example contact form, audience measurement), purposes, legal bases and retention periods.]
Note for legal review. The content and tools of the public Loupsio website are not yet settled. Do not state anything before the actual setup is known.
11. You are visiting a shop that uses Loupsio
Some online shops use Loupsio to understand how visitors use their site and to improve it.
Who is responsible? The shop. It decides to use Loupsio, what is recorded and for how long. Loupsio only acts on its behalf, as a processor.
What may be recorded. If you agree, the shop records your visit: page content as it is displayed, mouse movements, clicks, scrolling, pages visited, the site you came from, device type, browser, language, page errors and speed. Depending on the shop's settings, the following are added:
- how you use forms: which fields you use, in what order and for how long, fields that are refused, whether the form is sent or abandoned, without what you type in them;
- the page's requests that fail or take more than 3 seconds (method, address without parameters, response code, duration) and the error or warning messages of the browser console;
- the A/B test variants shown to you;
- your customer number, if you are signed in to your account on the shop, or the customer identifier that the shop sends;
- the amount, currency and number of your order if you order on a Shopify shop, or the order amount that the shop sends.
If you answer a survey or leave feedback, your answer is linked to your visit. The answers you give to the different questions of one survey are linked to each other.
What is not recorded. Everything you type into the shop's form fields (email, password, bank card, address, etc.) is masked in your browser before anything is sent. Parameters in page addresses are removed. The content and headers of the page's requests are never collected. Your IP address is not kept. The pages that the shop chooses not to record and, if it records only a share of visits, the visits that are not picked are not recorded.
Storage in your browser. Loupsio does not set cookies. It keeps a random visit identifier in the tab's memory (sessionStorage), cleared when you close the tab, and, if the shop identifies you as a customer, your customer identifier in the same memory. If it shows you a survey, it keeps a date in your browser (localStorage) so as not to show it to you again. If the shop has turned on the recognition of returning visitors, it also keeps a random identifier in localStorage for 13 months at most, which links your visits to that shop; it erases it if the shop turns this setting off. If the shop has connected Google Analytics 4, Segment or Klaviyo to Loupsio, the script reads, without changing it, the identifier that this tool has already given you (the _ga cookie, Segment's anonymous identifier, Klaviyo's __kla_id cookie).
The shop's tools. The shop can have information sent to its own tools, which it connects with its own credentials: the frictions of your visit (type, page, element concerned) to Google Analytics 4, Segment or Klaviyo, linked to the identifier that this tool knows you by; a friction turned into a ticket in Jira, Linear or Trello; a daily copy of visits, survey answers and feedback in its data warehouse. These tools may be located outside the European Union. They are not Loupsio's service providers: the shop is responsible for them. The shop can also have Claude (Anthropic PBC, United States) analyse the timeline of a visit, to summarise it, or the text of the comments left in its surveys and feedback button, to group them by theme. Neither the recording of your visit nor what you type into the shop's form fields is sent to Anthropic.
Your consent. We ask shops to obtain your consent before any recording. You can refuse or withdraw your consent at any time from the shop's cookie banner or cookie settings. Withdrawing it stops the recording.
Your rights. To access your data, have it erased or object to its processing, contact the shop: its contact details are in its privacy policy. To help it find your visit, give the date, approximate time, pages visited, device used, your customer number if you were signed in to your account and, if you answered a survey or left feedback, what you wrote. Unless the shop recognises returning visitors or identifies you as a customer, no identifier follows you from one visit to the next. Erasure in Loupsio does not reach information already sent to the shop's tools: the shop erases it in those tools.
On a Shopify shop connected through the Loupsio app, when Shopify forwards a request to erase your customer data, Loupsio erases the visits linked to your customer account. When Shopify forwards a request for access to your data, Loupsio tells the shop's owners how many visits are linked to your customer account, so that they can answer you.
If you write to us at [PRIVACY EMAIL], we forward your request to the shop concerned within 3 working days and confirm this to you. We cannot answer on the shop's behalf.
You can also lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr), or with the supervisory authority of your country.
12. Your rights
You can request:
- access to your data and a copy of it;
- its rectification;
- its erasure;
- restriction of processing;
- portability of the data you have provided to us;
- to object to processing based on our legitimate interest.
You can also give instructions on what should happen to your data after your death.
You can change your name, email address and password, and delete your account, directly in the application. For anything else, write to [PRIVACY EMAIL]. We reply within one month. This period may be extended by two months if the request is complex; we will tell you if so. If we have reasonable doubts about your identity, we may ask you for proof.
If you believe your rights are not being respected, you can lodge a complaint with the CNIL (www.cnil.fr) or with the supervisory authority of your country.
13. Changes
We may change this policy. The effective date is shown at the top of the page. If we make a significant change, we notify users by email before it takes effect.