IN PLAIN TERMS
This site receives the messages you send through the contact form; its hosting provider (Vercel, region not proven — outside the EU possible) keeps automatic technical logs. After you click “Accept”: PostHog (audience measurement through pseudonymous events, localStorage + cookie) and Sentry in your browser (error reports). Without consent: no analytics cookie or tracker. Server-side, the Sentry error log, when enabled, runs independently of your consent and by default records no IP address, cookies, request body or URL parameters (portal, playground and comparator pages excluded). The portal (accounts), the playground, the assistant and the comparator are closed by default; when open, they send your data to the ELYSÉA brain (table in § 2). No advertising, no sale of data. The contact form is relayed by Brevo (region not proven — outside the EU possible). You can request deletion of your data at any time by email.
Scope. This policy covers the
elysea.appsite in its entirety: the public pages (presentation, contact form) and the integrator portal (/portail/*— Supabase authentication, API key management, logs, billing). It does not cover third-party applications integrating the ELYSÉA SDK (including ELYSÉA Academy), which process separate data (including user memory) and have their own policies.
1. Data controller
ELYSÉA — Swiss sole proprietorship (raison individuelle), Geneva, in the process of formation (commercial register registration pending) — reachable at contact@elysea.app.
GDPR contact: contact@elysea.app. Formal appointment of a Data Protection Officer (DPO) is not required at this stage and will be decided separately.
2. Data collected and purposes
| Data | When | Purpose | Legal basis (GDPR) | Retention period |
|---|---|---|---|---|
| Name, email, message | Contact form submission | Responding to the request | Legitimate interest (Art. 6.1.f) — responding to an enquiry | 12 months after the last exchange, then deleted |
| Email, password (hashed), account creation timestamp | Account creation on /portail | Authentication and integrator account management | Contract performance (Art. 6.1.b) | Until the account is deleted |
| API keys (sk_test_ / sk_live_) | Integrator portal usage | SDK service delivery | Contract performance (Art. 6.1.b) | Lifetime of the application |
| SDK call logs, MAU metrics | SDK calls by the integrated application | SDK service delivery, billing, anomaly detection | Contract performance (Art. 6.1.b) | Period not yet set by the brain |
| Exchange log (per SDK or widget exchange: posture, guardian action, constraints applied, crisis flag; no message, no answer, no user identifier) | Written by the brain on each SDK or widget exchange | Compliance log (AI Act, Art. 12 and Art. 26(6)), readable by the builder that owns the application | Legal basis not yet published | 183 days |
| Record of consent grants and withdrawals | On each grant or withdrawal | Audit trail of consents (GDPR) | Legal basis not yet published | Record of grants and withdrawals: retained (GDPR audit trail). The table of your current consents is erased with the account. |
| Crisis data: “vital risk confirmed” state (session state, session handoff), human escalation notification to the builder (hashed user identifier), alert to the recipient chosen by the builder at installation | When the brain confirms a vital danger | Keep the safety response for the rest of the conversation; notify the builder and, if the builder chose one, its recipient | Legal basis not yet published | Period not yet set by the brain |
| Technical data (server logs: IP, timestamp, user-agent) | On every visit, by the hosting provider | Security and proper operation | Legitimate interest (Art. 6.1.f) | Period set at the provider, record to be attached |
| Pseudonymous navigation events (page views) — PostHog | After you click “Accept” | Audience measurement through pseudonymous events — improving journeys | Consent (Art. 6.1.a) | Period set at the provider, record to be attached |
| Browser error reports (error type, trace, URL without parameters) — Sentry | After you click “Accept” | Detecting and fixing bugs | Consent (Art. 6.1.a) | Period set at the provider, record to be attached |
| Server-side technical error reports (error type, trace, URL without parameters) — Sentry | When a server error occurs, if the log is enabled — regardless of browser consent | Detecting and fixing bugs | Legitimate interest (Art. 6.1.f GDPR): security and proper operation of the service | Period set at the provider, record to be attached |
| Messages typed in the playground and the assistance bubble (with the page language, the country if you declare it, the conversation identifier) | On each message, if the PLAYGROUND_OPEN switch is open — closed by default | Have the ELYSÉA brain answer (a language model generates the reply). Recipients: ELYSÉA brain — Google Cloud (Cloud Functions, Cloud Logging), europe-west1 (EU) | Legal basis not yet published | Period not yet set by the brain |
| Messages typed in the portal assistant, with your session token (portal account required) | On each message, if the PLAYGROUND_OPEN switch is open — closed by default | Have the ELYSÉA brain answer in an authenticated conversation (a language model generates the reply). Recipients: ELYSÉA brain — Google Cloud (Cloud Functions, Cloud Logging), europe-west1 (EU) | Legal basis not yet published | Period not yet set by the brain |
| Message typed in the comparator | On each submission, if the COMPARATEUR_OPEN switch is open — closed by default | Compare, on your message, the answers of the models in the ELYSÉA brain’s bench. Recipients: ELYSÉA brain (benchComparateur bench), then the models: Claude (eu.anthropic.claude-haiku-4-5-20251001-v1:0) — AWS Bedrock, EU inference profile (LLM_PROVIDER=BEDROCK_EU), eu-west-3 (Paris) ; GPT (gpt-4o) — api.openai.com, outside the EU — OpenAI (EU data residency not enabled) ; Gemini (gemini-2.5-flash) — Vertex AI (europe-west1-aiplatform.googleapis.com), europe-west1 (Belgium) ; Mistral (mistral-large-latest) — api.mistral.ai, EU as declared by Mistral AI (Paris), not verifiable from the code | Legal basis not yet published | Message of 500 characters at most; no message is kept. |
| Connected portal actions: account, applications and keys, consents, memory, logs | On each action, if the PORTAIL_OPEN switch is open — closed by default | Create, read, change or delete these items in the ELYSÉA brain. Recipients: ELYSÉA brain (europe-west1 (EU)); accounts: Supabase (eu-central-1 (Francfort) (EU)) | Contract performance (Art. 6.1.b) | Depending on the data: “account”, “API keys” and “SDK call logs” rows above |
The Site collects no health data and does not use the form for unsolicited commercial prospecting.
3. Recipients
Data is only sent to the providers below. The list is the exact copy of the single compliance source; no entry is written by the site.
| Provider | Role | Data | Region | Shown as | Transfer basis |
|---|---|---|---|---|---|
| Google Cloud (Cloud Functions, Cloud Logging) | Exécution du cerveau (toutes les routes) et journaux techniques | Messages, identifiants pseudonymisés, métadonnées de requête | europe-west1 | UE | aucun (région UE prouvée) |
| Google Firebase (Firestore) | Base du cerveau : applications SDK, usage, registre des consentements, conversations | Identifiants, consentements, conversations, métadonnées | europe-west9 | UE | aucun (région UE prouvée) |
| Amazon Web Services (Bedrock) | Modèle de génération et classifieurs de sûreté (LLM_PROVIDER / SAFETY_LLM_PROVIDER = BEDROCK_EU) | Messages des utilisateurs, invites système | eu-west-3 | UE | aucun (région UE prouvée) |
| Google Cloud (Vertex AI) | Classifieurs de crise ; génération (VERTEX_EU) et palier de secours de génération, même modèle (décision du 01/10) | Messages des utilisateurs, invites système | eu | UE | aucun (région UE prouvée) |
| Anthropic (API directe) | Génération et filet de sûreté si LLM_PROVIDER ou SAFETY_LLM_PROVIDER = US_DIRECT | Messages des utilisateurs, invites système | États-Unis (api.anthropic.com) | hors UE possible | non établie |
| OpenAI | Sur main : mémoire vectorielle (embeddings), repli de génération, raisonneur, voix (synthèse), apport de clé. Après #1066 : raisonneur, voix (synthèse), apport de clé. | Messages (500 premiers caractères pour les embeddings sur main), textes à vocaliser | non fixée par le code | hors UE possible | non établie |
| Deepgram | Voix : transcription (STT) Removal decided, not yet effective in the code | Voix des utilisateurs | non fixée par un paramètre de région (hôte api.eu.deepgram.com fixé par le code ; lieu de traitement non prouvé) | hors UE possible | non établie |
| audEERING | Voix : analyse émotionnelle en ombre (si AUDEERING_API_KEY) Removal decided, not yet effective in the code | Voix des utilisateurs | non fixée par le code | hors UE possible | non établie |
| Scaleway (Generative APIs) | Classifieur de sûreté (SAFETY_LLM_PROVIDER = SCALEWAY_EU) | Messages des utilisateurs | non fixée par un paramètre (hôte api.scaleway.ai) | hors UE possible | non établie |
| Mistral AI | Détection sémantique du gardien (SEMANTIC_DETECTION_ENABLED=true, désactivée par défaut) ; pipeline de génération Mistral (apport de clé) | Messages des utilisateurs | non fixée par le code | hors UE possible | non établie |
| Google AI (API Gemini) | Pipeline de génération Gemini (fournisseur d'application ou apport de clé) | Messages des utilisateurs, invites système | non fixée par le code | hors UE possible | non établie |
| DuckDuckGo | Outil de recherche web du pipeline | Requêtes issues des messages des utilisateurs | non fixée par le code | hors UE possible | non établie |
| Telegram | Bot de conversation (webhook) | Messages et identifiants Telegram des utilisateurs du bot | non fixée par le code | hors UE possible | non établie |
| Notion | Journal interne de l'activité des dépôts (webhook GitHub) | Activité des dépôts (auteurs, messages de commit) ; aucune donnée d'utilisateur final | non fixée par le code | hors UE possible | non établie |
| Resend | E-mails transactionnels (constructeurs, avertissements de rétention, invitations) | Adresses e-mail, contenu des e-mails | non fixée par le code | hors UE possible | non établie |
| Stripe | Facturation des constructeurs et paiement (fermé tant que les ventes sont fermées) | Identité et coordonnées de facturation des constructeurs | non fixée par le code | hors UE possible | non établie |
| Supabase | Comptes et authentification ; mémoire, consentements, journal d'audit | E-mails, sessions, mémoire, consentements | eu-central-1 (Francfort) | UE | aucun (région UE relevée) |
| Vercel | Hébergement du site et de ses routes serveur (portail, formulaire de contact) | Messages du formulaire de contact, jetons de session transmis au cerveau, journaux | non fixée (vercel.json sans région) | hors UE possible | non établie |
| Brevo | Relais SMTP du formulaire de contact du site | Nom, adresse e-mail et message des personnes qui écrivent | non fixée par le code (hôte smtp-relay.brevo.com) | hors UE possible | non établie |
| Sentry | Remontée d'erreurs du site (et du cerveau après #1066, si SENTRY_DSN) | Traces d'erreur, adresses de requête, métadonnées techniques | non fixée par un paramètre (CSP du site vers *.ingest.de.sentry.io ; DSN serveur non lu) | hors UE possible | non établie |
| PostHog | Mesure d'audience du site, après consentement | Événements de navigation pseudonymes | non fixée par un paramètre de région (hôte eu.i.posthog.com fixé par le code ; lieu de traitement non prouvé) | hors UE possible | non établie |
| Messagerie de l'éditeur | Boîte qui reçoit les messages du formulaire de contact (variable CONTACT_INBOX) | Nom, adresse e-mail et message des personnes qui écrivent | non établie (fournisseur de la boîte non inscrit dans une pièce) | hors UE possible | non établie |
No data is sold or transferred to third parties for advertising or commercial purposes.
4. Location and transfers outside the European Union
European Union region set by the code : Google Cloud (Cloud Functions, Cloud Logging) (europe-west1) ; Google Firebase (Firestore) (europe-west9) ; Amazon Web Services (Bedrock) (eu-west-3) ; Google Cloud (Vertex AI) (eu) ; Supabase (eu-central-1 (Francfort)).
Outside the European Union possible (region not proven by the code) : Anthropic (API directe) ; OpenAI ; Deepgram ; audEERING ; Scaleway (Generative APIs) ; Mistral AI ; Google AI (API Gemini) ; DuckDuckGo ; Telegram ; Notion ; Resend ; Stripe ; Vercel ; Brevo ; Sentry ; PostHog ; Messagerie de l'éditeur.
Hors UE possible ⇒ traité comme un transfert hors UE. Aucune base de transfert n'est présumée : tant qu'une pièce (contrat signé, clauses contractuelles types acceptées) n'est pas inscrite ici, la base est « non établie ».
Reservation: in the deployed brain, the fallback to an OpenAI model and vector memory are removed (an OpenAI model is only called with the builder’s own key, if the builder chooses it); voice is removed from the brain; the Supabase database region, eu-central-1 (Frankfurt), was read on the provider’s dashboard on 01/10 at 18:03, formal evidence to be attached; other providers are outside the EU possible (full list in the privacy policy).
5. Retention periods
- — Contact form messages: 12 months after the last exchange, then deleted.
- — Portal account: until the account is deleted.
- — API keys: lifetime of the application.
- — Exchange log written by the brain: 183 days.
- — Record of grants and withdrawals: retained (GDPR audit trail). The table of your current consents is erased with the account.
- — SDK call logs, MAU metrics and crisis data: period not yet set by the brain.
- — Hosting provider technical logs, PostHog audience measurement, Sentry error reports (browser and server): period set at the provider, record to be attached.
- — Functions closed by default (playground and bubble, assistant, comparator, portal): see the table in § 2.
6. Your rights
Under the GDPR, you have the rights of access, rectification, erasure, restriction, objection, and portability over your data. You may exercise them at contact@elysea.app. You may also lodge a complaint with the CNIL (www.cnil.fr).
For cross-session memory in ELYSÉA applications, consent and its revocation can be managed directly from your personal space: Manage cross-session memory →
7. Cookies
This site uses PostHog (audience measurement through pseudonymous events) and Sentry in your browser (error reports) only after you click “Accept”. After acceptance, PostHog persistence is localStorage + cookie; without consent, no audience measurement runs and no analytics cookie is set. Server-side, the Sentry error log, when enabled, runs independently of your consent (legal basis: table in § 2). No advertising pixels. Exchange pages (/playground, /comparateur, /portail) remain excluded from measurement. To withdraw your consent: “Manage cookies” link in the footer.
For more details: Cookie Policy.
8. AI Transparency — AI Act Art. 50
The site’s conversation functions — playground and assistance bubble, portal assistant, comparator — are closed by default (server switches). When open, they send your messages to the ELYSÉA brain and, for the comparator, to the models listed with their region in the table in § 2: a language model then generates the answer shown. Applications integrating the ELYSÉA SDK also rely on language models (LLMs). Under Article 50 of Regulation (EU) 2024/1689 (applicable from 2 August 2026 — Article 113), people interacting with an artificial intelligence system must be informed of it. Builders integrating the SDK remain responsible for that transparency towards their own users.
9. Security
The publisher implements reasonable technical and organisational measures to protect data against unauthorised access, alteration, or disclosure.