Privacy Policy : CodirAI
Last updated: October 16, 2025 - Version: 1.0
11. Data Controller
Company : EvidencAI
Legal form: SAS (Simplified Joint-Stock Company)
Share capital: €180,000
Head office SIRET: 103 591 806 00015
RCS number: 103 591 806 R.C.S. Romans
VAT number: FR40103591806
Registered office: 9000 les communaux, 26300 Châteauneuf-sur-Isère, France
Publishing director: Stéphane Commenge
GDPR contact: info@evidencai.com
Hosting provider: Scaleway (via a self-hosted Supabase instance)
22. Scope
This privacy policy applies to:
- The CodirAI Chrome and Edge extension (decision support assistant for ChatGPT, Claude, Gemini, Grok, Le Chat)
- The CodirAI web application (complete analysis and verification platform)
- Associated API services
It describes how we collect, use, share and protect your personal data in accordance with the General Data Protection Regulation (GDPR) and Chrome Web Store requirements.
33. Data Collected
3.1 Via the browser extension
Required permissions:
- activeTab: Access to the active tab to capture content you voluntarily share
- storage: Local storage of your preferences and authentication tokens
- clipboardWrite: Copy analysis results to clipboard
- Authorized domains: chatgpt.com, claude.ai, gemini.google.com, grok.x.ai, chat.mistral.ai
Automatically collected data:
- Conversation IDs that you share
- Shared content: Prompts and responses you choose to analyze
- Local preferences (stored on your device)
- Supabase authentication tokens
Important: The extension does not collect any browsing history or personal communications beyond content you explicitly share. No telemetry or analytics are collected by the extension.
3.2 Via the Web Application
Account data (required):
- •Email: For account creation and communications
- •Password: Encrypted by Supabase with bcrypt (never stored in plain text)
- •User ID: Automatically generated unique identifier (UUID)
Subscription and payment data (paying subscribers only):
- •Stripe information: Customer ID, tokenized credit card
- •Subscription type: CodirAI 100, CodirAI 300, Expert
- •Billing address: Required for invoicing
- •Payment history: Retained for 7 years (legal requirement)
- •Last 4 digits of card (full number is never stored)
- •Note: Free users do not provide any payment data.
3.3 Retention Periods
| Plan | Account data and content | Legal basis |
|---|---|---|
| Free | 30 days after last use | Legitimate interest |
| CodirAI 100 | 180 days after subscription ends | Contract performance |
| CodirAI 300 | 180 days after subscription ends | Contract performance |
| Expert | 365 days after subscription ends | Contract performance |
| Payment history | 7 years (all paid plans) | Legal obligation |
44. Purposes and Legal Bases
| Purpose | Legal basis | Details |
|---|---|---|
| Account management | Contract performance | Provision of CodirAI service |
| Payments | Contract performance | Paid subscriptions |
| AI analysis | Contract performance | Generation of evidence-based responses |
| Service improvement | Legitimate interest | Anonymized statistics |
| Marketing (opt-in) | Consent | Newsletters, offers |
55. Recipients and Subprocessors
Your data is only accessible to our GDPR-compliant subprocessors with signed DPAs:
🇫🇷 Scaleway (France)
- Role: Infrastructure hosting for our self-hosted Supabase database
- Location: Paris, France
- Data: User accounts, analyzed content, technical logs
- Safeguards: GDPR DPA, sovereign servers, ISO/IEC 27001:2022
- DPA link: https://www.scaleway.com/en/data-processing-agreement/
🇺🇸🇪🇺 Stripe Inc. (United States / European Union)
- Role: Payment processing and subscription management
- Location: United States (with EU infrastructure)
- Data: Payment information (tokenized card), billing address
- Safeguards: PCI-DSS Level 1, SCCs, regulated transfer to USA
- Applies to: Paying subscribers only
- DPA link: https://stripe.com/fr/privacy-center/legal#data-processing-agreement
🇺🇸 OpenAI OpCo LLC (United States)
- Role: AI text analysis via GPT-4o model
- Location: United States
- Data: Texts submitted for analysis (with anonymized UUID only)
- Safeguards: SCCs 2021/914, TLS 1.3 and AES-256 encryption
- Retention: Maximum 30 days (API with DPA)
- Commitment: Not to use data for model training
- Link: https://openai.com/enterprise-privacy/
🇪🇺 Resend (European Union)
- Role: Transactional email delivery
- Location: European Union
- Data: Email addresses, email content (confirmations, reminders)
- Safeguards: GDPR DPA, EU servers
COMMITMENTS:
- •✅ All our subprocessors have signed a DPA (Data Processing Agreement)
- •✅ We NEVER sell your data
- •✅ We do NOT share with data brokers
- •✅ Non-EU transfers governed by Standard Contractual Clauses
66. Data Transfers Outside the European Union
Some of our subprocessors are located outside the European Economic Area (EEA).
Transfers to the United States
Mechanism: European Commission Standard Contractual Clauses (Decision 2021/914)
Impact assessment: Transfer Impact Assessment (TIA) conducted in accordance with EDPB recommendations
Additional safeguards:
- Encryption in transit (TLS 1.3) and at rest (AES-256)
- Only prompts and anonymized user ID (UUID) are sent
- Contractual commitment not to use data for training
- Maximum retention of 30 days
Access: You can obtain a copy of the contractual clauses by contacting us at info@evidencai.com
77. Data Security
🔐 Encryption
In transit: HTTPS (TLS 1.3)
At rest: AES-256 (database, documents)
Passwords: bcrypt hashing (never in plain text)
👥 Access Controls
• RBAC (role-based access)
• Strong authentication
• Access logging (2 years)
• 2FA available
🚨 In Case of Data Breach
In accordance with Article 33 of the GDPR, we commit to:
- Notify the CNIL within 72 hours of discovery
- Inform you without delay if your data is affected and if a high risk exists
- Document all incidents in an internal register
88. Cookies and Similar Technologies
8.1 Essential Cookies (no consent required)
| Cookie | Purpose | Duration |
|---|---|---|
| sb-access-token | Supabase authentication session | 1 hour |
| sb-refresh-token | Session renewal | 30 days |
| language | Language preference (FR/EN) | 1 year |
🔒 Anonymous internal analytics
We use purely technical and anonymous analytics stored in our Supabase database.
Important: We do NOT use ANY third-party analytics tools (no Google Analytics, Posthog, Amplitude, etc.)
99. Your Rights (GDPR)
In accordance with Articles 15 to 22 of the GDPR, you have the following rights:
📖 Right of Access (Art. 15)
Obtain a copy of all your personal data
How: My account > Settings > Download my data
✏️ Right to Rectification (Art. 16)
Correct your inaccurate or incomplete data
How: My account > Profile > Edit
🗑️ Right to Erasure (Art. 17)
Request deletion of your data
How: My account > Settings > Delete my account
📤 Right to Portability (Art. 20)
Retrieve your data in JSON/CSV format
How: My account > Settings > Export
⛔ Right to Object (Art. 21)
Object to processing based on legitimate interest
How: Contact info@evidencai.com
🔓 Withdrawal of Consent (Art. 7)
Withdraw your consent for marketing
How: "Unsubscribe" link in emails
⏱️ Response time: 1 month (extendable by 2 months if complex, with notification)
1010. Chrome Web Store Specific Provisions
10.1 Data Minimization Principle
We only collect data strictly necessary for the extension to function.
10.2 Prominent Disclosure
On first use of the extension, a pop-up clearly informs you of:
- The types of data collected
- The purposes of collection
- The subprocessors involved (notably OpenAI)
You must explicitly accept before using the service.
10.3 Limited Use Policy
We commit to:
- • ✅ Never sell your data to third parties
- • ✅ Never transfer your data to data brokers
- • ✅ Never use your data for personalized advertising unrelated to the service
1111. Paid Plan Activation
11.1 Subscription Activation
Paid access to CodirAI starts after payment confirmation. No free trial period is currently available.
11.2 Billing Notifications
We may send operational emails related to your subscription:
- D-3: "Your next billing date is approaching"
- D-1: "Your payment requires your attention"
Each email contains the options available to manage your subscription.
11.3 Subscription End or Cancellation
When a paid subscription ends:
- • If you have not subscribed: Your account automatically switches to Free plan (4 credits/day, 7 modules)
- • If you subscribe: Your subscription starts on the subscription date. No automatic charge is made without explicit action on your part.
11.4 Subscribing to a Paid Plan
To subscribe to a paid plan (CodirAI 100, CodirAI 300 or Expert), you will need to provide a payment method via our provider Stripe. Payment data is collected in accordance with section 3.2 of this policy.
11.5 Online Cancellation "3 Clicks" (France)
In accordance with French Law No. 2022-1158 of August 16, 2022:
- Step 1: My account > Subscription > Cancel
- Step 2: Cancellation confirmation
- Step 3: Confirmation email sent
Important: The cancellation button is visible, direct and permanent (accessible 24/7).
1212. Data Concerning Minors
CodirAI is not intended for persons under 16 years of age.
If you are under 16, you cannot create an account without the explicit consent of a holder of parental authority.
Parents: If you believe your child has provided us with data without your consent, contact us at info@evidencai.com
1313. Changes to the Privacy Policy
We may update this policy to reflect legal developments, new features or changes in subprocessors.
Notification of Changes
In case of substantial changes, we will inform you by:
- Email to your contact address (30 days before entry into force)
- In-app notification on your next login
- Banner on the website for 30 days
1414. Contact and Exercising Your Rights
Email: info@evidencai.com
Subject: "GDPR - [Your request]"
Postal: EvidencAI - GDPR Service - 9000 les communaux, 26300 Châteauneuf-sur-Isère, France
GDPR contact: Stéphane Commenge
14.1 Complaint to the CNIL
In case of persistent dispute, you may contact the Commission Nationale de l'Informatique et des Libertés (CNIL):
Online: https://www.cnil.fr/fr/plaintes
By mail: CNIL - 3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07
By phone: +33 1 53 73 22 22
For any questions: stephane@commenge.net