This text explains what bilgi.fr does with personal data. It covers the website, demo requests and the accounts of customer associations. The data of the families, pupils and teachers of a school stays under the responsibility of their association (see “Two roles”).
Two roles
For the website, demo requests, the subscription, invoicing and the security of the service, the publisher is the data controller.
For a school’s data (pupils, families, imams, volunteers), the association is the data controller and the publisher acts as its processor, under a processing agreement. A family that wants to exercise its rights first contacts the association of its school; the publisher helps the association to answer.
Who the publisher is
Node Digital, sole trader, 3 rue d'Aigle, 61300 L'Aigle, France. SIRET 893 465 245 00015. For any question about your data: contact@bilgi.fr.
Data collected, purposes and legal bases
| Data | Why | Legal basis |
|---|---|---|
| Demo request: name of the association, name, e-mail; optional phone and message; site language | Answer the request and present a demo | Pre-contractual steps taken at the person’s request |
| IP address, kept for 24 hours at most to count submissions (5 demo requests per hour) | Protect the forms against abuse | Legitimate interest of the publisher |
| Association sign-up: name, city, address chosen for the space, first name, last name and e-mail of the president, country, plan | Create the space and manage the subscription | Performance of the contract |
| Payment, entered at Stripe: the publisher neither sees nor keeps the card number | Collect the subscription and issue invoices | Performance of the contract; legal obligation for invoices |
| Account: e-mail, password (stored in unreadable form), two-step verification settings | Sign-in and account security | Performance of the contract |
| Technical logs: technical identifiers, page template, status and duration of the request; no name, no e-mail, no IP address | Security and fault diagnosis | Legitimate interest of the publisher |
| Site audience: one counter per day, page, language and referring site; no cookie, no IP address in the database | Know which pages are read | Legitimate interest of the publisher |
| Software usage: events counted by the server, without name, e-mail, or account or device identifier (for example “set-up finished”) | Improve onboarding and the software | Legitimate interest of the publisher |
| Detailed audience measurement, ONLY with your consent: random visit identifier (cookie, 13 months), pages viewed, time spent, clicks on buttons and offers, sign-up step reached, abandoned payment. Never the content of a form, keystrokes, or screen or mouse recording; IP address never kept | Understand where visitors hesitate in order to improve the site | Consent (you can withdraw it at any time) |
| Commercial personalisation, ONLY with your consent: call to action adapted to your visit (for example “Resume your sign-up”) | Help you finish what you started; never a different price depending on the person | Consent (you can withdraw it at any time) |
| Proof of your cookie choice: date, banner version, choice, random identifiers | Prove that your choice was respected | Legal obligation to be able to demonstrate consent; legitimate interest of the publisher |
| Site assistant: your question, sent without name, e-mail, number or web address; not kept. Anonymous counters (number of questions) and, for questions left unanswered, the cleaned text without identifier | Answer your questions before purchase and complete the site’s help | Pre-contractual measures taken at the person’s request; legitimate interest of the publisher |
| Timely nudges: computed in your browser (session storage erased when the tab closes), for all visitors; only anonymous “shown / clicked” counters per variant and per day are sent | Help you at the right moment and compare two wordings | Legitimate interest of the publisher |
Detailed measurement and personalisation: with your consent
On your first visit, a banner asks for your choice. “Accept all” and “Refuse all” are on the same level; the close cross counts as a refusal; “Customise” lets you choose purpose by purpose. Nothing is stored or sent before your choice.
Controller: the publisher. Recipient: the publisher alone. No third-party service (no Google Analytics, Meta or Hotjar): everything stays on our servers in France. The publisher’s artificial intelligence model only receives aggregated figures (for example the number of visitors per step), never the identifier or journey of a visit.
Your choice is kept for 6 months (acceptance as well as refusal), then asked again. The visit identifier and tracking data are kept for 13 months at most, then erased automatically.
You can refuse or withdraw your consent at any time, as simply as you gave it, with the “Manage my cookies” link at the bottom of every page: tracking stops at once and the events of your visit are erased. Refusing does not limit access to the site.
What we do not do
- No audience-measurement or personalisation cookie without your consent; no third-party advertising or tracking service.
- No resource from another site on our pages (no font, video, statistics or social network).
- No sale or transfer of data.
- No automated decision about a person: an appraisal suggested by artificial intelligence is saved only after the imam has reviewed it.
Who receives the data
- The publisher alone, for the site and subscription data.
- Technical providers (hosting, storage, e-mail sending, payment, SMS, translation, artificial intelligence).
- Families, pupils and a school’s team only see what their association opens to them.
- The publisher’s artificial intelligence model (Anthropic) only receives aggregated figures for the site analysis and, for the visitor assistant, your cleaned question.
Transfers outside the European Union
The application, the database, the files, the backups and e-mail sending are hosted in France. Four cases leave the European Union:
1. The assistant and the appraisals suggested by artificial intelligence, provided by Anthropic (United States), which the association can switch off. The appraisals receive a grade and a scale, without any pupil name or identifier. The assistant receives the message written by the person (addresses, numbers and links removed; first and last names of their account and of their children masked, without guarantee; health questions refused without being sent), their first name and the school information their role allows them to read.
2. Reading a photographed registration sheet (photo import), by Anthropic (United States), which the association can switch off in its settings (Privacy section). The photo may contain pupils’ names, phone numbers, e-mail addresses and dates of birth; it is reduced in size, sent only to be read, and the application does not keep it (only the lines you have reviewed are saved). Its retention by the provider is governed by the provider’s own terms.
3. The publisher’s inbox, which receives demo requests, is at Google (Gmail, United States).
4. The assistant on the website, provided by Anthropic (United States): it receives the question typed by the visitor, without name, e-mail or number; the publisher does not keep it.
4. The site’s visitor assistant and the hourly audience analysis, by Anthropic (United States). The assistant receives your question without name, e-mail, number or web address, with extracts of the site’s public texts; the analysis only receives aggregated figures. The publisher keeps nothing beyond the answer.
Retention periods
- Demo request: 3 years after the last exchange with a person who does not become a customer; erased earlier on simple request.
- An association’s space: during the subscription. At the end, see the terms of sale (article “Term, cancellation and data”).
- Invoices and accounting records: the period required by accounting law.
- Technical logs: one year at most. Submission counters: 24 hours. Usage events: 13 months. Encrypted backups: 80 days at most.
- Assistant conversations: 90 days after the last exchange, visible only to their author.
- Detailed measurement and personalisation (with consent): visit identifier and events 13 months at most; cookie choice: 6 months; proof of the choice: 13 months; refusal or withdrawal: events of the visit erased immediately.
Security
- Data hosted in France; encrypted connections.
- Passwords stored in unreadable form; two-step verification is offered to the president, the treasurer and the management (optional).
- Health data encrypted (AES-256-GCM) and never written to the logs.
- Strict separation between associations in the database; log of administration actions.
- Backups encrypted before they leave the server.
Your rights
You can ask for access to your data, its rectification or erasure, the restriction of or objection to a processing, and portability of your data. Write to contact@bilgi.fr or, for a school, to its association.
In the application, the “Delete my data” button in your profile sends an erasure request to the association. Every non-essential e-mail contains a one-click link to stop receiving them.
You can also lodge a complaint with the CNIL (cnil.fr).
Children and teenagers
The site is for associations, not for children: no form on the site is meant for a minor. In a school’s space, the account of a pupil under 15 is created only with the recorded consent of a parent or guardian, and messaging between pupils is reserved for pupils aged 15 and over.