Privacy policy (GDPR)

[à compléter], [à compléter]. Privacy contact: support@aureasites.com.

Account: email address, display name, profile picture (from Google or Apple sign-in, or uploaded by you), sign-in method, referral code.

Using the service: the prompts you write, the websites generated and their versions, credit history, your support messages.

Payment: Stripe or Apple customer and subscription identifiers. We never see or store card numbers — Stripe or Apple handle them directly.

Mobile app: the device's push notification token.

Technical data: IP address and browser type, used for security and abuse prevention (anti-spam) and kept in the host's logs.

Audience measurement: only if you accept it in the cookie banner — anonymous page-view statistics, no advertising cookies, no cross-site tracking.

Running your account, generating and hosting your sites, credits and subscriptions, support — performance of a contract (GDPR art. 6.1.b).

Invoicing and accounting — legal obligation (art. 6.1.c).

Security, fraud and spam prevention, rate limiting — legitimate interest (art. 6.1.f).

Audience measurement — consent (art. 6.1.a), which you can withdraw at any time from “Cookie settings” in the footer.

We never sell your data or share it with advertisers. It is processed by these providers, only to run the service:

Vercel Inc. — Hosting, audience measurement (if accepted) (USA / UE).

Neon Inc. — Database (accounts, projects, credits) (selon la région choisie).

Anthropic PBC — Writing site copy from your descriptions (USA).

Stripe — Payments and subscriptions (UE / USA).

Google LLC — Sign in with Google (if used) (USA).

Apple Inc. — Sign in with Apple and in-app purchases (iOS app) (USA).

Expo (650 Industries) — Mobile app push notifications (USA).

We do not use your content to train AI models. Under its commercial terms, Anthropic does not train its models on data received through its API.

Some providers are based in the United States. Those transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses.

Account, projects and history: while the account is open. Deleting your account (Settings) erases them from the database immediately; technical backups are overwritten on their rotation cycle.

Accounting records and invoices: 10 years (French Commercial Code, art. L123-22).

Support messages: 3 years after the last exchange.

Abuse-prevention counters per IP address: 24 hours at most.

Cookie choice: 6 months, after which we ask again.

You may access, correct, erase, restrict, object to and port your data, and leave instructions for after your death. Write to support@aureasites.com: we answer within one month, free of charge.

You may also complain to the French data protection authority, the CNIL (www.cnil.fr), or to the authority in your country.

Published sites count visits without cookies: a visitor is a salted digest valid for one day on one site, derived from an IP address and browser that are never stored. Each site owner is responsible for anything they add themselves.

If we make a material change we email every account holder at least 30 days before it takes effect.