Privacy Policy
This policy describes how BrandWitness collects, uses, and protects the personal data of its users, in accordance with the General Data Protection Regulation (GDPR) and applicable data protection law.
1. Data Controller
The data controller is BrandWitness SAS, a simplified joint-stock company headquartered in Paris, France. DPO contact: privacy@brandwitness.fr
2. Data Collected
BrandWitness collects the following data:
- Account data: name, email address, hashed password (bcrypt)
- Usage data: pages visited, actions taken on the platform, connection logs
- Business data: GA4 metrics from your properties (imported via API with your explicit authorisation)
- Payment data: processed by our payment provider Stripe, not stored by BrandWitness
BrandWitness does not use third-party tracking cookies. The only cookies set are functional (authentication session).
3. Purposes and Legal Bases
Your data is processed to:
- Provide the contractually subscribed service (legal basis: performance of contract)
- Ensure security and prevent fraud (legal basis: legitimate interest)
- Comply with our legal obligations, billing, GDPR (legal basis: legal obligation)
- Send you transactional emails related to your account (legal basis: contract)
- Improve the product through aggregated and anonymised data (legal basis: legitimate interest)
4. Hosting and Transfers
Data is hosted in France and within the European Union:
- Database: Neon (serverless PostgreSQL, EU West region)
- Infrastructure: Vercel (with contractual GDPR guarantees)
- Emails: Resend (GDPR compliant, EU data)
No transfer of data to countries outside the EU without adequate safeguards.
5. Retention Period
Account data is retained for the duration of the subscription and up to 3 years after cancellation (legal limitation period). Imported GA4 data is retained according to your plan (6 to 18 months). You may request deletion at any time.
6. Your Rights
Under the GDPR, you have the following rights:
- Access: obtain a copy of your data
- Rectification: correct inaccurate data
- Erasure: have your data deleted ("right to be forgotten")
- Portability: receive your data in a machine-readable format
- Objection: object to certain processing activities
- Restriction: limit processing in certain cases
To exercise these rights: privacy@brandwitness.fr. Response within 30 days. To lodge a complaint: your local data protection authority (in France: cnil.fr).