Privacy Policy

This policy sets out the personal data processed in connection with Artichaut, why it is processed, and the rights you hold. It follows the General Data Protection Regulation (GDPR) and French data protection law. The French version is the authoritative one.

1. Who is the controller

Artichaut is a brand operated by MBS SASU, share capital 1 000 €, registered office at 60 rue François Ier, 75008 Paris, France, registered under 990 868 283 R.C.S. Paris. That company is the data controller.

Contact: contact@artichaut.co.

2. Scope, and a role that changes

This policy covers two things that must be kept apart:

• the marketing website artichaut.co, open to all;
• the Artichaut application and platform, reserved for our clients and their teams.

Our role differs between the two, and the distinction is substantive. For the website and for user accounts we are the controller: we decide the purposes and the means. For the purchasing data our clients entrust to us — invoices, price lists, orders, credit notes, sales — we act as a processor: the client establishment remains the controller, and we process that data only on its instructions, under the contract between us. Individuals concerned by such data should therefore address their requests to the establishment, which passes them on to us.

3. The marketing website

Cookies and trackers, only with your consent

On your first visit, a banner asks for your consent. Until you accept, no measurement or advertising tool is loaded, and no such cookie is set. Refusing is as easy as accepting, and the site works just the same. You can change your mind at any time with the “Cookie settings” link at the bottom of every page.

The tools below are loaded by Google Tag Manager, itself loaded only after your consent. Each belongs to one of the two categories you accept or refuse separately:

• Audience measurement — Knowing which pages are read and how the site is browsed, to improve it.
• Advertising — Measuring how our ads perform and showing them to you on other sites and networks.

Legal basis: your consent (Art. 6(1)(a) GDPR and Article 82 of the French Data Protection Act). Retention: your choice is kept for 6 months in your browser, then asked again; measurement and advertising cookies last 13 months at most. Measurement data is kept for 14 months at most by the tool concerned.

For advertising, Meta and LinkedIn act as joint controllers with us for the collection made on this site, then as controllers for their own use: their policies, linked in the table above, describe those uses and your rights with them. These providers may transfer data to the United States; such transfers rely on the EU-U.S. Data Privacy Framework and the European Commission’s standard contractual clauses.

Server logs and getting in touch

Like any web server, our host records incoming requests — IP address, timestamp, page requested — for security and diagnosis only. The site has no forms: to reach us, it shows our email address, which opens your own mail application, and our phone number — so we receive only what you choose to send or say.

4. The Artichaut application and platform

Who is concerned

Our clients — hospitality groups and establishments — and the members of their teams who hold an account.

Account data

For each user, we process as controller:

• work email address;
• telephone number;
• role within the establishment;
• sign-in history — dates, times and device used.

This data is used to create and secure access, to establish who did what in the tool, and to reach you about the service.

Purchasing data entrusted by our clients

The platform processes the establishment’s purchasing documents and data: invoices, supplier price lists, orders, credit notes, sales figures and related records. This is primarily company data, but it incidentally contains personal data — a supplier representative’s name, a contact’s details, a signature on a purchase order.

We process it solely to deliver the subscribed service: purchasing analysis, price comparison, variance detection, dashboards. We use it for nothing else, and it is never resold.

Processing by artificial intelligence

The service relies on artificial intelligence models to read purchasing documents and extract the information they contain. The data needed for that is sent to our model provider, acting as a processor:

• Anthropic — document analysis and data extraction.

This data is not used to train models: Anthropic’s commercial terms expressly forbid it. Processing takes place in the United States, governed by the standard contractual clauses. Should we engage other providers, the list above is updated before any such processing begins.

5. Purposes and legal bases

6. Retention

• Server logs: a short period set by the host.
• User accounts: for the duration of the contract, then deleted within a reasonable period after it ends.
• Purchasing data: for the duration of the contract. On termination it is returned or deleted at the client establishment’s choice, in line with our contractual commitments.
• Email correspondence: as long as it takes to handle the enquiry, then per applicable legal obligations.

7. Recipients and processors

We neither sell nor rent any data. Our processors act on our instructions:

8. Transfers outside the European Union

Platform data — accounts and purchasing data — is stored in the European Union. Some of our providers are nonetheless companies established in the United States, whose technical teams may access data from there for maintenance and support.

The marketing website is hosted by Vercel Inc., a US company whose privacy notice provides for processing outside the data subject’s country of residence, including in the United States. The data concerned is limited to server logs; no client data passes through the website.

These transfers are governed by the European Commission’s standard contractual clauses, together with appropriate technical measures. Vercel Inc. also adheres to the EU-U.S. Data Privacy Framework.

The application runs in a European Vercel region. That provider’s delivery network remains worldwide, but it serves only static files — interface code, styles, images — containing no personal data.

9. Your rights

You have the right to access, rectify, erase, restrict, object to, and port the data concerning you. Write to contact@artichaut.co; we answer within one month.

If your request concerns purchasing data entrusted to us by a client establishment, we will direct you to that establishment: it is the controller for that data, and we can act only on its instructions.

You may also lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, 75007 Paris — www.cnil.fr.

10. Security

Traffic is encrypted in transit (HTTPS). Platform access is personal to each user and actions are logged. Data is hosted with providers holding recognised information security certifications.

11. Minors

Our services address hospitality professionals. They are not directed at minors and do not knowingly collect data about them.

12. Changes

This policy may change if our processing changes. The date of the latest update appears at the top of this page. Clients are informed of any substantive modification.