Privacy policy

1. Data controller

The data controller is the private individual who publishes Le Récap under the name Foxtaming. That person is not registered as a business of any kind to date; their full identity will be published in the legal notice when the service opens.

Contact for any question or request about your data: contact@lerecap.app. No data protection officer has been appointed: at this scale it is not required, and the same address answers.

2. Data collected

Account: your email address, the interface language, the default language of your documents, the creation date, and your consents with their date (terms, age declaration, waiver of withdrawal).

Delivery: your e-reader's email address, if you enter one, and whether it has been confirmed.

Requests: the topic you write, the free context you add, and the settings you choose (format, length, level, language, depth, destination).

Documents produced: their title, their EPUB and PDF files, their cover, the list of sources, the delivery date, and your rating if you leave one (thumb and reason).

Operations: the state of each generation, the errors encountered, the number of searches and the production cost. This data is what lets us refund you automatically when something fails, and keep an eye on costs.

Technical logs: our hosting providers keep the usual request traces (IP address, date, route called) for security and diagnosis.

Audience measurement: visit statistics, with no advertising cookie (details below).

One important warning: do not write personal data about other people into your topics, nor sensitive data about yourself (health, opinions, religion, sexual orientation). The text of your request is sent to the generation engine.

3. Purposes and legal bases

Running the service (creating your account, generating your documents, delivering them, keeping your credit balance): performance of the contract you enter into by creating an account.

Sending you service emails (sign-in link, document ready, notice of an outage): performance of the contract.

Protecting the service (topic moderation, quotas, abuse detection, cost control, security): our legitimate interest in running a service that stays on its feet.

Complying with the law (marking AI-generated content, keeping proof of consent, and tomorrow accounting once sales open): legal obligation.

Measuring site audience in aggregate: our legitimate interest in knowing what gets read. You can object (see "Cookies and audience measurement").

Telling you about the launch, if you joined the waitlist: your consent, withdrawable in one click from every email.

4. Who your data is passed to

OpenAI (United States): document generation and moderation. It receives your topic, your context and your settings, but neither your email address nor your e-reader's address. Data sent through the programming interface is not used to train its models.

Supabase (European Union): database and storage of your document files.

Vercel (United States): site hosting and delivery.

Amazon Web Services, SES (European region): sending our emails.

GitHub Actions (United States): during the beta, generations run on that infrastructure, and the document's topic and settings pass through it.

PostHog (European region): site audience measurement.

Amazon, Send-to-Kindle gateway: only if you choose Kindle delivery. Your document and your e-reader's address then go through that third-party service, governed by its own terms.

That is the whole list. We sell, rent and trade no data. There is no advertising network on the site.

5. Transfers outside the European Union

Your account data and your documents are stored in the European Union. So is audience measurement.

Some providers are established in the United States: OpenAI, Vercel, GitHub. Those transfers rely on the European Commission's standard contractual clauses and, where the provider is certified under it, on the EU–US Data Privacy Framework.

6. Retention periods

Account, settings and consents: as long as your account exists. Deleted with it.

Subjects, documents and files: as long as your account exists. Deleted with it, immediately and permanently.

Technical logs: twelve months at most, and only a few days at the site's hosting provider.

Waitlist: until the service launches, then twelve months, or until you unsubscribe.

One possible leftover: if you had received a beta invitation, your address may remain in the invitation list after your account is deleted. Write to us and we remove it.

7. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability, and you can withdraw at any time a consent you have given.

The simplest route first: your settings let you correct your data yourself and delete your account in one click. Profile, documents and files are then erased, without going through us.

For anything else, write to contact@lerecap.app. We answer within one month. We may ask you to confirm your identity if the request comes from an address other than the account's.

If our answer does not satisfy you, you can refer the matter to the CNIL (cnil.fr) or to the data protection authority of your country of residence.

8. Minimum age: 15

The service is for people aged 15 or over: in France, that is the age at which you can consent on your own to the processing of your data. An age declaration is requested when you create your account.

We do not knowingly collect data about younger people. If an account was created by a child under 15, write to us: we delete it.

9. What the artificial intelligence sees

The generation engine receives your topic, your context and your settings, then reads public web pages to write the document. It receives neither your email address, nor your e-reader's address, nor the history of your requests.

Your topic first goes through automatic moderation. A rejected topic is not generated and costs you nothing. A rejection has no legal consequence for you. If you think the filter got it wrong, write to us: a person will review your topic.

None of your data is used to train an AI model, neither by us nor by our providers.

10. Cookies and audience measurement

The site uses no advertising cookie and shows no consent banner, because it does not need one.

There are only two things. A session cookie, strictly necessary to keep you signed in. And audience measurement (PostHog, European region), which counts visits with an identifier kept in your browser's local storage, with no cookie and no advertising sharing. That identifier disappears when you clear the site's data, and a tracker blocker prevents it.

11. Security

Exchanges are encrypted in transit. Your files sit in a private space: every download goes through a signed link that expires after one hour. No database or storage key is ever sent to your browser.

No system is infallible. In the event of a data breach likely to create a high risk for you, we will tell you, and tell the CNIL, within the deadlines set by the GDPR.

12. Changes

This policy will change, in particular when sales open and if a provider changes. The last update date is shown at the top of the page, and any significant change will be announced to you by email.