Privacy Policy

1. Data controller

2. Data collected

MB AI collects the following data:

• Via contact / email capture forms: professional email address, name (optional), company (optional)
• Via memo requests: name, professional email, company, role, name of the target asset
• Browsing data: IP address, pages viewed, visit duration (aggregated and anonymised)

3. Purposes and legal bases

• Contract performance (Art. 6.1.b GDPR): processing orders and delivering D7™ memos
• Legitimate interest (Art. 6.1.f GDPR): sending the Free Memo Extract newsletter to voluntary subscribers
• Consent (Art. 6.1.a GDPR): non-essential cookies (where applicable)

4. Retention periods

• Contact data: 3 years from last contact
• Contractual data: 10 years (legal accounting obligation)
• Browsing data: maximum 13 months
• Client documents (dataroom): deleted within 30 days of memo delivery

5. Data recipients

Data is not transferred to third parties for commercial purposes. It may be shared with:

• OVHcloud (hosting — European Union)
• Anthropic (AI processing — subprocessor, anonymised data)
• Web3Forms (contact forms)

6. Your rights

Under the GDPR, you have the following rights:

• Right of access, rectification and erasure
• Right to restriction of processing
• Right to object
• Right to data portability

To exercise these rights: david.roux@mb-ai.fr

You also have the right to lodge a complaint with the CNIL (French data protection authority) or your local supervisory authority.

7. International transfers

Data processed by Anthropic (Claude API) may be transferred to the United States under the EU-US Data Privacy Framework. MB AI undertakes to use only subprocessors offering adequate safeguards.