1. Data controller
The controller of personal data is Entreprendre.Blog, which can be reached at contact@entreprendre.blog.
2. Data collected
When the Platform is used, the following data may be collected:
- Email address (mandatory to start a journey and receive the file).
- Member account, requested before access to the dashboard: first name, last name and telephone number (mandatory; the number is not verified by any code and is not used to send any SMS), password if you choose to sign in by email (kept only in hashed form, never in plain text), or Google identifier if you choose to sign in with Google.
- Voluntary information about the entrepreneurial project (idea, market, business model, team, traction). This data is entered in the questionnaires.
- Payment information: transmitted directly to Stripe; we store neither the card number nor the CVV. We keep only the Stripe customer identifier and the payment identifier.
- Technical data: IP address, user-agent, server logs (kept for 30 days).
3. Purposes and legal bases
The data is processed for the following purposes:
- Performance of the contract: generation of the deliverables, follow-up of the journey, creation and security of the member account, access to the dashboard (Article 6.1.b GDPR).
- Legal obligation: invoicing, accounting, fraud prevention (Article 6.1.c GDPR).
- Legitimate interest: improvement of the service, anonymised usage analysis, prevention of abuse (Article 6.1.f GDPR).
- Consent: sending of non-transactional emails (newsletter, follow-up on day 3) — can be withdrawn at any time (Article 6.1.a GDPR).
4. Processors
We use the following processors:
- Hostinger (VPS hosting, France/EU).
- Stripe Payments Europe Limited (payment, Ireland).
- Anthropic via LiteLLM (AI generation, transmission of prompts containing project data; no training on this data).
- Perplexity (market data search for the free offer: only the sector, area and problem described in your project are sent, never your name, email address or telephone number).
- Groq (voice transcription, United States, only if you choose to speak instead of typing: the recording is transcribed then deleted, it is not kept by us, and you read the text before sending it).
- Resend (sending of transactional emails).
- Google (optional sign-in with a Google account: we receive your email address and your Google identifier, never your Google password).
5. Retention period
As no paid tier is offered for sale today, session data and free-tier deliverables are kept for 1 year for support purposes, unless early deletion is requested.
If a paid tier is offered for sale again, its associated retention period will be set out in this section before any offer for sale.
Billing data is kept for 10 years (legal accounting obligation).
6. Rights of data subjects (GDPR)
In accordance with Articles 15 to 22 of the GDPR, the User has the following rights: access, rectification, erasure, restriction, objection, portability.
To exercise these rights: contact@entreprendre.blog. Response within 30 days at most. In the event of a dispute: CNIL (cnil.fr).
7. Cookies
The Site uses strictly necessary cookies: theme preference and language, member account session cookie (30 days), registration verification cookie (30 days) and Google sign-in security cookie (10 minutes), as well as a technical session identifier reserved for the administration area.
No third-party audience measurement or advertising cookie is set without consent.
8. Security
Exchanges between your browser and the Platform are encrypted (HTTPS).
Passwords are hashed (scrypt) and are never logged; after 5 failed sign-in attempts within 15 minutes, access to the account is suspended for 15 minutes.
Payments go through Stripe (PCI DSS Level 1); we never have access to the card number or the CVV.
9. Contact
For any question about this Policy: contact@entreprendre.blog.