This policy sets out the personal data processed in connection with Artichaut, why it is processed, and the rights you hold. It follows the General Data Protection Regulation (GDPR) and French data protection law. The French version is the authoritative one.
1. Who is the controller
Artichaut is a brand operated by MBS SASU, share capital 1 000 €, registered office at 60 rue François Ier, 75008 Paris, France, registered under 990 868 283 R.C.S. Paris. That company is the data controller.
Contact: [email protected].
2. Scope, and a role that changes
This policy covers two things that must be kept apart:
- the marketing website artichaut.co, open to all;
- the Artichaut application and platform, reserved for our clients and their teams.
Our role differs between the two, and the distinction is substantive. For the website and for user accounts we are the controller: we decide the purposes and the means. For the purchasing data our clients entrust to us — invoices, price lists, orders, credit notes, sales — we act as a processor: the client establishment remains the controller, and we process that data only on its instructions, under the contract between us. Individuals concerned by such data should therefore address their requests to the establishment, which passes them on to us.
3. The marketing website
Audience measurement
We measure site traffic using our host’s built-in tool. The measurement is aggregated: it produces totals, never individual profiles. The dimensions recorded are pages viewed, browser type, device type, country and traffic source. It cannot identify you or track you across sites.
No cookies, no trackers
The site sets no cookies, uses neither localStorage nor sessionStorage, and loads no third-party script: no ad network, no social media pixel, no external analytics tool. That is why you see no consent banner: with no non-essential tracker in use, none is required.
Server logs and getting in touch
Like any web server, our host records incoming requests — IP address, timestamp, page requested — for security and diagnosis only. The site has no forms: the only way to reach us is a link that opens your own mail application, so we receive only what you choose to send.
4. The Artichaut application and platform
Who is concerned
Our clients — hospitality groups and establishments — and the members of their teams who hold an account.
Account data
For each user, we process as controller:
- work email address;
- telephone number;
- role within the establishment;
- sign-in history — dates, times and device used.
This data is used to create and secure access, to establish who did what in the tool, and to reach you about the service.
Purchasing data entrusted by our clients
The platform processes the establishment’s purchasing documents and data: invoices, supplier price lists, orders, credit notes, sales figures and related records. This is primarily company data, but it incidentally contains personal data — a supplier representative’s name, a contact’s details, a signature on a purchase order.
We process it solely to deliver the subscribed service: purchasing analysis, price comparison, variance detection, dashboards. We use it for nothing else, and it is never resold.
Processing by artificial intelligence
The service relies on artificial intelligence models to read purchasing documents and extract the information they contain. The data needed for that is sent to our model provider, acting as a processor:
- Anthropic — document analysis and data extraction.
This data is not used to train models: Anthropic’s commercial terms expressly forbid it. Processing takes place in the United States, governed by the standard contractual clauses. Should we engage other providers, the list above is updated before any such processing begins.
To be fixed before go-live. This list must match exactly the providers actually called in production. The no-training commitment is established for Anthropic under its commercial terms; it must be verified for any provider added, and it assumes a commercial plan rather than consumer access.
5. Purposes and legal bases
| Processing | Purpose | Legal basis |
|---|---|---|
| Aggregated audience measurement | Understand how the site is used | Legitimate interests (Art. 6(1)(f)) |
| Server logs | Security, availability, diagnosis | Legitimate interests (Art. 6(1)(f)) |
| User accounts | Provide and secure access to the service | Performance of a contract (Art. 6(1)(b)) |
| Sign-in history | Traceability and access security | Legitimate interests (Art. 6(1)(f)) |
| Purchasing data | Deliver the service subscribed by the establishment | Processing on behalf of the client (Art. 28) |
| Email correspondence | Answer your enquiry | Pre-contractual steps or legitimate interests |
6. Retention
- Website statistics: kept as aggregated totals.
- Server logs: a short period set by the host.
- User accounts: for the duration of the contract, then deleted within a reasonable period after it ends.
- Purchasing data: for the duration of the contract. On termination it is returned or deleted at the client establishment’s choice, in line with our contractual commitments.
- Email correspondence: as long as it takes to handle the enquiry, then per applicable legal obligations.
7. Recipients and processors
We neither sell nor rent any data. Our processors act on our instructions:
| Processor | Role | Data location |
|---|---|---|
| Strapi, Inc. (Fimo) | Website hosting and audience measurement | United States and European Economic Area |
| Supabase | Platform database | European Union (Ireland) |
| Vercel | Application hosting and delivery | European Union for execution; worldwide delivery of static files |
| Anthropic | Document analysis by artificial intelligence | United States |
| Apple | Mobile application distribution | United States and Apple’s global infrastructure |
8. Transfers outside the European Union
Platform data — accounts and purchasing data — is stored in the European Union. Some of our providers are nonetheless companies established in the United States, whose technical teams may access data from there for maintenance and support.
The marketing website is hosted by Strapi, Inc., the US company behind Fimo, whose data processing addendum provides for processing outside the European Economic Area, including in the United States. The data concerned is limited to server logs and aggregated traffic statistics; no client data passes through the website.
These transfers are governed by the European Commission’s standard contractual clauses, together with appropriate technical measures.
The application runs in a European Vercel region. That provider’s delivery network remains worldwide, but it serves only static files — interface code, styles, images — containing no personal data.
A decision to take should clients require it. Calling Anthropic’s model through a European region of AWS Bedrock or Google Vertex AI, rather than the direct API, would keep that processing inside the Union. The choice belongs before the integration is written: changing it later means redoing authentication, SDK and billing.
9. Your rights
You have the right to access, rectify, erase, restrict, object to, and port the data concerning you. Write to [email protected]; we answer within one month.
If your request concerns purchasing data entrusted to us by a client establishment, we will direct you to that establishment: it is the controller for that data, and we can act only on its instructions.
You may also lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, 75007 Paris — www.cnil.fr.
10. Security
Traffic is encrypted in transit (HTTPS). Platform access is personal to each user and actions are logged. Data is hosted with providers holding recognised information security certifications.
11. Minors
Our services address hospitality professionals. They are not directed at minors and do not knowingly collect data about them.
12. Changes
This policy may change if our processing changes. The date of the latest update appears at the top of this page. Clients are informed of any substantive modification.